News
Railway’s Security Incident: Why CI/CD Needs Runtime Security
The Brief
- Step Security published a blog post on 2026-11-10 analysing Railway's security incident, based on Railway's report of November 10.
- The post recommends reviewing build access, tightening OIDC trust, and using Harden-Runner to observe and restrict CI/CD runtime activity.
- The provided sources do not describe the nature, scope or root cause of the incident itself.
Why it matters
The post argues that CI/CD pipelines need runtime controls, not only access reviews, because build environments can be a path to compromise.
Who’s affected
- Teams running CI/CD pipelines that use OIDC federation
- Railway users
What to do
- Review who has access to build pipelines
- Tighten OIDC trust configuration for CI/CD workflows
- Evaluate runtime monitoring and restriction of CI/CD activity, such as Harden-Runner
- #ci-cd
- #runtime-security
- #oidc
- #railway
- #devsecops
Lessons from Railway’s November 10 report: review build access, tighten OIDC trust, and use Harden-Runner to observe and restrict CI/CD runtime activity.
Timeline
Railway publishes its incident report
Step Security publishes blog post analysing the incident
Step Security Blog
Railway’s Security Incident: Why CI/CD Needs Runtime Security