Problem:

If steal my notebook or access railway.com in browser, the invasor can see my .env variables

Solution:

In settings page must be have a option with this functionality:

Enable 2FA in login = true|false

and/or time expiration of cookie auth/retry cookie auth

------

For critical application, like fintechs, health systems and etc

this could mean the startup/project going bankrupt

I love railway, I do not want to go to mainstream clouds, I followed the progress of railway together as a customer, loving the service offered and for sure in the near future we will grow together and stronger

Sorry my bad english, I leaning...

Thank you for your time and consideration. Sincerely, John Doe

Albert Keiyza