On Railway I have 2 environments, one is configured with master branch, another with staging branch.

Yesterday night, I raised a PR for branch feature-xyz and 1h later I noticed it had been deployed on production!

I believe this bug is not with Github settings, something is wrong at your end because this branch should never have been deployed.