GitHub account breach exposes Railway repositories to IP theft

Compromised GitHub accounts linked to Railway gave attackers full read and write access to repositories due to overly permissive API permissions. GitHub's API lacks full auditing, Railway has not disclosed how many accounts were affected, and its response drew criticism for vague guidance.

• Railway's GitHub integration defaulted to full read and write repository access
• GitHub API auditing limits leave the scope of code exposure unknown
• Railway did not disclose the number of affected accounts or clearly accept responsibility
• Users have begun migrating to competitors such as Fly