security assistance — unmapped Railway TCP proxy referenced by exposed database credential
fdchub
HOBBYOP

17 days ago

Account: fraser.d.coleman@gmail.com

I need to identify the owner of a Railway TCP proxy endpoint that does not

appear anywhere in my authenticated account:

reseau.proxy.rlwy.net:54032 (database "railway")

I have enumerated every project, environment, and service available to me.

Complete inventory:

Project e8904b9e-a49c-47e8-a1c5-bb6d74118051

Environment production 6583038e-fe0a-4c31-a059-4885c4dec6b3

Postgres        cd0ba357-63dc-4c9e-800f-362b004246e7

                volume 16983665-ead5-4225-9abf-7bfd29a08b96

                TCP proxy hayabusa.proxy.rlwy.net:15707 -> 5432

postgres-test   f03178f3-ecce-4a12-9d58-39125e41a161

                volume 9f491b83-81f5-4609-bcfd-7b223db06794

                TCP proxy sakura.proxy.rlwy.net:12561 -> 5432

fantasy-beefs   9400fc77-6050-4f34-b6a2-d5a2f963716a

                HTTP only, no TCP proxy

Project 7e972e72-530b-43df-95ce-2bb691196a59

Environment production baaeccc8-d333-4c9e-a97d-71b23a772c26

Postgres            80c57430-8680-4cd8-89a6-4d1237da8455

                    volume 875b183b-b52a-499f-922d-2da652fed047

                    TCP proxy turntable.proxy.rlwy.net:36223 -> 5432

fantasy-beefs-api   964993eb-1510-4bd5-add3-87f2325015fb

                    HTTP only, no TCP proxy

reseau.proxy.rlwy.net:54032 appears in none of these. A TCP connection to

that host and port currently completes a handshake.

QUESTIONS

  1. Which current or historical project, environment, service, volume, and

    database role own or previously owned reseau.proxy.rlwy.net:54032?

  2. Does that proxy still route to a live backend?

  3. If the endpoint is not visible to my account, can Railway disable the

    proxy or invalidate the associated database role directly?

  4. Did it belong to a deleted service, a deleted project, an inaccessible

    workspace, or a different account?

  5. What exact action is required from me to invalidate it?

There is a security reason this is time-sensitive. I would prefer to

provide that detail through a private channel — my plan tier does not

appear to offer Private Threads. Please advise how to send it.

Closed

1 Replies

Status changed to Awaiting Railway Response Railway 17 days ago


17 days ago

We're not going to help with this. Every question here asks us to disclose details about another customer's infrastructure, and we won't, for any reason. No private channel changes that.

Rotate the credentials on the resources you control.


Status changed to Awaiting User Response Railway 17 days ago


Status changed to Closed brody 17 days ago


Welcome!

Sign in to your Railway account to join the conversation.

Loading...