Hi Railway team/community,

I need help understanding how to investigate a production environment variable incident.

In my Railway project, I selected the production environment and confirmed that at least one production service has environment variables that appear to match my development values. This is not limited to DATABASE_URL; it appears to include unrelated configuration such as object storage values and other app credentials/flags.

Example, with no secrets shown:

• Production service: @maaate/app
• Production variable observed: R2_BUCKET=maaate-dev

I did not intentionally update production variables to these development values.

A local read-only audit has already ruled out the following on my side:

• no Railway CLI installed locally
• no local Railway credential files found
• no Railway CLI commands in shell history
• no repo scripts found that write Railway variables
• no RAILWAY_TOKEN / RAILWAY_API_TOKEN references in repo scripts
• GitHub Actions does not deploy to Railway or modify Railway variables
• recent local commits were not pushed and did not modify Railway service configs

This does not look like a normal database cutover issue, because a DB cutover might explain DATABASE_URL, but should not affect unrelated values like R2/storage, payment, email, analytics, or feature flags.

What I need help with:

1. Where can I view production environment variable change history?

2. Can Railway show:

   • timestamp of variable changes
   • actor/user/API token identity
   • whether a bulk variable import occurred
   • whether variables came from UI, CLI, API, GraphQL, shared variables, duplication, rollback, or another source

3. Is there a way to confirm whether any of these occurred:

   • raw .env paste/import
   • bulk variable update
   • environment duplication from dev/staging into production
   • shared variable group attachment/change
   • service variable rollback
   • API token action
   • platform-side restore/rollback

4. Is there any way to roll back production variables to a previous timestamp/state?

5. If audit logs are only available on certain plans, what is the correct path to get Railway staff to privately review this?

I am not posting secrets publicly. I can provide masked screenshots, deploy timestamps, and affected variable names if Railway staff can advise the correct private channel.

Also WTF is up with Railway price-gating bloody support requests?? Are us users on lower tier paid plans simply forced into crowd-sourcing answers to our platform issues?