{
  "type": "bundle",
  "id": "bundle--5082638c-9d2d-5052-8227-e93c06fa097b",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--f0b7e1eb-0221-5381-811c-2242c77de0fe",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "org:a0034b09-ac18-4127-9a39-9368f0c07386",
      "name": "Railway",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--8d519594-0067-5178-8ee2-79744c7f0530",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "brh:90e64db2-f6ef-48e6-840e-8ee81b76e4b5",
      "name": "Railway environment-variable security incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--bb0949fb-1396-5e99-8dae-80a8b9d39c11",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "inc:ee12fde8-aa96-435e-bad0-18e14d0fc1a2",
      "name": "Railway environment-variable security incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--53134cfb-c0eb-5d77-85da-e2e0af1cc97c",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:54019b54-a9ba-4e48-88e5-f96182fb3d55",
      "relationship_type": "resulted-in",
      "source_ref": "incident--bb0949fb-1396-5e99-8dae-80a8b9d39c11",
      "target_ref": "x-ally-event--d045a6e4-549c-521a-8ed8-c499c983ffe9",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Railway",
          "url": "https://status.railway.com/incident/QH8L8B3E",
          "external_id": "cit:fbadd5a4-35ca-411c-a86f-c52dc86f2021",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bc5c75309fbb261ebe993245c3d5c6d96ebb9cb0a6d714bcf41a87db283e6775"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3d9702f-5261-5119-8be7-8269f3925eb5",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:ff30420b-519e-493a-b998-7a4168a95c47",
      "relationship_type": "affected-organization",
      "source_ref": "incident--bb0949fb-1396-5e99-8dae-80a8b9d39c11",
      "target_ref": "identity--f0b7e1eb-0221-5381-811c-2242c77de0fe",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Railway",
          "url": "https://blog.railway.com/p/security-disclosure-wednesday-october-21st",
          "external_id": "cit:980e662f-deab-490d-96e0-b30699e56bfd",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d72936705bf44e8ab6ccb18b62a4772ebdb38be0a56e486bd6af661a3e1fb775"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df10cb18-a4e9-5bd5-8080-603bf9d08a16",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:dded2979-12b2-4340-ad31-941e3685439f",
      "relationship_type": "resulted-in",
      "source_ref": "incident--bb0949fb-1396-5e99-8dae-80a8b9d39c11",
      "target_ref": "x-ally-event--931791e9-136e-554d-8c68-c0b5a9429cd5",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Railway",
          "url": "https://blog.railway.com/p/security-disclosure-wednesday-october-21st",
          "external_id": "cit:b34679ef-b065-4dd2-adb0-fcae596a4022",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d72936705bf44e8ab6ccb18b62a4772ebdb38be0a56e486bd6af661a3e1fb775"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--1dcfa64b-ee35-5cab-8faf-a0e419d8c1fc",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:21359d00-c8d0-4554-ab84-276d6e94dcb8",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Railway",
          "url": "https://status.railway.com/incident/QH8L8B3E",
          "external_id": "cit:6278f3e7-1d16-4bc8-87b1-7943f6d3beef",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bc5c75309fbb261ebe993245c3d5c6d96ebb9cb0a6d714bcf41a87db283e6775"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Railway said it notified customers with a very high likelihood of impact by October 23 while forensic analysis of other cohorts continued."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--2fda3150-b709-50ee-8920-ea026482b3bf",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:201600ac-73e2-455c-a175-1db13d181c9d",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Railway",
          "url": "https://status.railway.com/incident/QH8L8B3E",
          "external_id": "cit:9d4a21e5-7308-432c-8e3e-3b4d2a709b46",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bc5c75309fbb261ebe993245c3d5c6d96ebb9cb0a6d714bcf41a87db283e6775"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-22"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--5032f248-517f-5383-894c-29e3734c511b",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:a75f038d-e575-480e-bd2e-481f10d0ad27",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Railway",
          "url": "https://blog.railway.com/p/security-disclosure-wednesday-october-21st",
          "external_id": "cit:30b80414-3fbc-4a53-8c9e-c410be50330f",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d72936705bf44e8ab6ccb18b62a4772ebdb38be0a56e486bd6af661a3e1fb775"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-21"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--85de39ce-ef76-5613-8696-fbf5b4d02416",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:e2c01527-6142-405e-a97c-0d142960187b",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Railway",
          "url": "https://blog.railway.com/p/security-disclosure-wednesday-october-21st",
          "external_id": "cit:966a5fad-4c3f-45e8-8aa5-ebdb17a88d20",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d72936705bf44e8ab6ccb18b62a4772ebdb38be0a56e486bd6af661a3e1fb775"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-21"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--afced56d-8b4a-5382-8631-11df611086ae",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:126bfcb5-79cb-4088-b2f0-42bd0a74eaa2",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Railway",
          "url": "https://blog.railway.com/p/security-disclosure-wednesday-october-21st",
          "external_id": "cit:379827d9-472b-469d-8f93-6ca7b4c67bbd",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d72936705bf44e8ab6ccb18b62a4772ebdb38be0a56e486bd6af661a3e1fb775"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Potentially exposed variables could contain API keys and database or private-registry credentials; Railway had not established the affected population."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--b50f89cc-18ef-515b-86bc-606e95e0bdc3",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:970a430f-d9e4-4208-ab4f-a6919de62b76",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Railway",
          "url": "https://blog.railway.com/p/security-disclosure-wednesday-october-21st",
          "external_id": "cit:1e162127-268f-4da6-8126-948482f09200",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d72936705bf44e8ab6ccb18b62a4772ebdb38be0a56e486bd6af661a3e1fb775"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Railway said it notified upstream AI inference providers to revoke keys and believed its incident was part of attacks targeting those providers."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--c392e47d-f31f-5653-871a-f0e81b180d73",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:561686f3-b3a1-4c5d-9e8b-921a8a6010f8",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Railway",
          "url": "https://blog.railway.com/p/security-disclosure-wednesday-october-21st",
          "external_id": "cit:372eb96a-07d2-4694-97da-572e3572806d",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d72936705bf44e8ab6ccb18b62a4772ebdb38be0a56e486bd6af661a3e1fb775"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-21"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--ce100f1f-1bcc-532d-8275-599ebf1c080a",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:48fef6fb-beed-404a-b0b3-b4b298b5a724",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Railway",
          "url": "https://status.railway.com/incident/QH8L8B3E",
          "external_id": "cit:f23ad260-469d-48ea-a179-5107902db3d4",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bc5c75309fbb261ebe993245c3d5c6d96ebb9cb0a6d714bcf41a87db283e6775"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "By October 22 at 22:49 UTC, builds and deployments for Enterprise, Pro, Hobby, Free and Trial were available at approximately normal speed; new signups remained paused."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--ded26ccf-6b3c-549c-856c-a6e017b3d3c8",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:6c514f58-27a8-48aa-a6de-107d54d55bf7",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Railway",
          "url": "https://blog.railway.com/p/security-disclosure-wednesday-october-21st",
          "external_id": "cit:9c27d36b-c264-4a35-ac70-3d44006ce621",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d72936705bf44e8ab6ccb18b62a4772ebdb38be0a56e486bd6af661a3e1fb775"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Railway detected anomalous activity in systems storing customer environment variables; its preliminary investigation indicated possible unauthorized access to encrypted variables and some decrypted contents."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--e7b6eab1-ae49-55cc-8c39-210b873e3c3a",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:13c9ca4d-b529-4d1e-ae03-07e12bdb1414",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Railway",
          "url": "https://blog.railway.com/p/security-disclosure-wednesday-october-21st",
          "external_id": "cit:6f2e014a-71c3-4c63-b085-48bc5ff586f9",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d72936705bf44e8ab6ccb18b62a4772ebdb38be0a56e486bd6af661a3e1fb775"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Railway paused deployments while investigating and urged all users to rotate stored secrets and inspect associated service logs."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--ea4ccb3a-e66e-57df-8466-e113ed9bdf0b",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:a8a56679-61b8-4fd3-914a-cd9991bd79be",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Railway",
          "url": "https://status.railway.com/incident/QH8L8B3E",
          "external_id": "cit:863e22a3-415b-45cd-84e5-f1fbfe969593",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bc5c75309fbb261ebe993245c3d5c6d96ebb9cb0a6d714bcf41a87db283e6775"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Railway invalidated API tokens, reset storage bucket credentials and revoked OAuth sessions during response."
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--931791e9-136e-554d-8c68-c0b5a9429cd5",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "evt:4e9d45e8-da50-4d09-b102-018c0165d4ba",
      "name": "Security disclosure and deployment pause"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--d045a6e4-549c-521a-8ed8-c499c983ffe9",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "evt:be34ab50-59b7-464b-8c3d-e0e34848a17f",
      "name": "Builds restored across all plans"
    }
  ]
}