Resolved: Brief Data Exposure via Railway CDN Misconfiguration
Timeline:
• Investigating: We received reports of unexpected data exposure where users were occasionally served pages or dashboard views belonging to other active sessions.
• Identified: The root cause was an upstream incident at our hosting provider, Railway. A configuration change on their platform accidentally enabled CDN caching on domains where it was explicitly disabled. As a result, the edge network cached HTTP GET responses that lacked strict cache headers, causing some authenticated sessions to be briefly visible to other traffic.
• Resolved: Railway reverted the deployment and performed a full, global purge of their CDN cache. All systems are back to normal operating status.
Next Steps: While the fault occurred at the infrastructure level, we are actively deploying application-wide overrides to force strict Cache-Control: no-store, no-cache, must-revalidate headers on all authenticated endpoints. This ensures that even if a provider misconfigures their edge routing in the future, your private data remains protected.