3 hours ago
Hello Railway team,
I reviewed the related thread "Security Confirmation — Sealed Environment Variables", but its response is marked BOT.
My production case is slightly different and requires human confirmation.
I created a new variable through the Railway Dashboard and clicked "Seal variable".
The UI now displays the sealed icon.
However, environmentStagedChanges with decryptVariables:false returns only a value field and does not include isSealed.
The variable is still STAGED, with appliedAt=null, and is not yet visible in committed-variable metadata.
I have not applied any changes or triggered deployments.
Before proceeding, could a human engineer confirm:
Is this staged representation expected after sealing a newly created variable through the Dashboard?
Will committing the current change preserve its sealed status and exact value?
Does adding only isSealed:true with merge:true preserve the already staged value, without replacing it?
What is the safest supported procedure to verify the variable is sealed before committing?
No secret values have been disclosed.
Please provide guidance only. Do not modify the project or deploy services.
Thank you.
1 Replies
3 hours ago
Yes, that's what we'd expect to see. When you seal a staged variable, the seal is saved with the staged change. The environmentStagedChanges response with decryptVariables:false simply doesn't include isSealed in what it returns, so leaving it out doesn't mean the seal was dropped.
When you commit the current change, the variable keeps both its sealed status and its staged value. We don't recommend sending a separate isSealed:true merge. A merge patch updates only the fields it includes and leaves the rest of the staged variable alone, so it would keep the value, but it repeats a seal that is already staged.
Before you commit, the staged-changes API has no read that confirms the seal. The sealed icon in the dashboard is the signal you can check. After you commit, the variable shows as sealed in its committed metadata, and its value is no longer revealed anywhere.
Status changed to Awaiting User Response Railway • about 3 hours ago