Zeabur, Railway and TiDB Cloud breaches: rotate leaked environment variables in the right order

# Zeabur (CLI 0.24.0): log in, pick the project, export each service
npx zeabur@latest auth login
npx zeabur@latest context set project --name my-project
npx zeabur@latest variable list --name api --json > api.json

# Railway (CLI 5.71.0)
npx @railway/cli login
npx @railway/cli link
npx @railway/cli variable list --service api --json > api.json

#!/usr/bin/env node
// env-rotation-plan.mjs: turn exported environment variables into a rotation plan.
// Reads .env files and the JSON from `zeabur variable list --json` or
// `railway variable list --json`, works out what each secret is, and prints
// what to rotate first and where. Values are never printed, only masked.
//   node env-rotation-plan.mjs api.env worker.json
//   node env-rotation-plan.mjs --json api.env > plan.json
// Exit code: 0 = no secrets found, 1 = secrets to rotate, 2 = bad input.
import { createHash } from "node:crypto";
import { readFileSync } from "node:fs";
import path from "node:path";
import { fileURLToPath } from "node:url";

/** Parses .env / KEY=value text. Ignores comments and `export `. */
export function parseEnv(text) {
  const out = [];
  for (const raw of text.split(/\r?\n/)) {
    const line = raw.trim();
    if (!line || line.startsWith("#")) continue;
    const m = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_.-]*)\s*=\s*(.*)$/.exec(line);
    if (!m) continue;
    let value = m[2];
    if (/^(['"]).*\1$/.test(value)) value = value.slice(1, -1);
    out.push({ key: m[1], value });
  }
  return out;
}

/** Accepts Zeabur ({variables:[{key,value}]}), Railway ({KEY:value}) or [{key,value}] JSON. */
export function parseJson(text) {
  const data = JSON.parse(text);
  const list = Array.isArray(data)
    ? data
    : Array.isArray(data.variables)
      ? [...data.variables, ...(data.readonlyVariables ?? [])]
      : Object.entries(data).map(([key, value]) => ({ key, value }));
  return list
    .map((v) => ({ key: v.key ?? v.name, value: v.value }))
    .filter((v) => typeof v.key === "string")
    .map((v) => ({ key: v.key, value: v.value == null ? null : String(v.value) }));
}

// Priority 1 is the most urgent. Ordered by how fast a stolen value turns
// into money or wider access. AI keys sit at 2 because the October 2026
// platform attacks were after them.
const RULES = [
  { id: "wallet", p: 1, name: "Crypto wallet key or seed phrase", test: (k, v) => /MNEMONIC|SEED_PHRASE|WALLET/.test(k) || (/PRIVATE_KEY/.test(k) && /^(0x)?[0-9a-fA-F]{64}$/.test(v)) || /^([a-z]+ ){11}[a-z]+$|^([a-z]+ ){23}[a-z]+$/.test(v), action: "Move funds to a new wallet first, then retire the key. A wallet key cannot be revoked." },
  { id: "stripe", p: 1, name: "Stripe live secret or restricted key", prefix: /^(sk|rk)_live_/, action: "On the API keys page: ... menu > Rotate key, with Expiry set to Now (the default grace period keeps the old key working). Check its request logs.", where: "https://dashboard.stripe.com/apikeys" },
  { id: "aws", p: 1, name: "AWS access key pair", test: (k, v) => /^(AKIA|ASIA)[0-9A-Z]{16}$/.test(v) || /^AWS_SECRET_ACCESS_KEY$/.test(k), action: "Deactivate the key now (aws iam update-access-key --status Inactive), create a new one, then check CloudTrail and billing.", where: "https://console.aws.amazon.com/iam/" },
  { id: "gcp", p: 1, name: "Google Cloud service account key", test: (k, v) => /"type"\s*:\s*"service_account"/.test(v), action: "Delete the key in IAM > Service accounts > Keys, create a new one, check audit logs.", where: "https://console.cloud.google.com/iam-admin/serviceaccounts" },
  { id: "privkey", p: 2, name: "Private key (PEM)", test: (k, v) => /-----BEGIN [A-Z ]*PRIVATE KEY-----/.test(v), action: "Generate a new key pair where it is issued (GitHub App, SSH, JWT signing, TLS) and delete the old one." },
  { id: "github", p: 2, name: "GitHub token", prefix: /^(ghp_|github_pat_|gho_|ghu_|ghs_|ghr_)/, action: "Revoke it under Settings > Developer settings, create a new one with the least scope, check the audit log.", where: "https://github.com/settings/tokens" },
  { id: "gitlab", p: 2, name: "GitLab token", prefix: /^glpat-/, action: "Revoke it under Access tokens and create a new one.", where: "https://gitlab.com/-/user_settings/personal_access_tokens" },
  { id: "registry", p: 2, name: "Container registry credential", test: (k) => /DOCKER|REGISTRY|GHCR/.test(k) && /PASS|TOKEN|SECRET/.test(k), action: "Revoke the token at the registry, create a new one, check the registry audit log for pushed images." },
  { id: "database", p: 3, name: "Database URL with password", test: (k, v) => /^(postgres(ql)?|mysql|mariadb|mongodb(\+srv)?|rediss?|amqps?):\/\/[^:/\s]*:[^@\s]+@/.test(v), action: "Change the password inside the database (ALTER ROLE / ALTER USER), update every service, and close public access." },
  { id: "dbpass", p: 3, name: "Database password", test: (k) => /(DB|DATABASE|POSTGRES|PG|MYSQL|MONGO|REDIS)\w*(PASSWORD|PASS)$/.test(k), action: "Change the password inside the database and update every service that uses it." },
  { id: "openai", p: 2, name: "OpenAI API key", prefix: /^sk-(proj|svcacct|admin)-/, action: "Delete it under API keys and create a new one; check Usage for spend you do not recognise.", where: "https://platform.openai.com/api-keys" },
  { id: "anthropic", p: 2, name: "Anthropic API key", prefix: /^sk-ant-/, action: "Delete it in the Console under API keys and create a new one; check usage.", where: "https://console.anthropic.com/settings/keys" },
  { id: "openrouter", p: 2, name: "OpenRouter key", prefix: /^sk-or-v1-/, action: "Delete it under Keys and create a new one; check activity.", where: "https://openrouter.ai/settings/keys" },
  { id: "googleapi", p: 2, name: "Google API key (Gemini, Maps)", prefix: /^AIza/, action: "Delete or regenerate it under APIs & Services > Credentials and add restrictions.", where: "https://console.cloud.google.com/apis/credentials" },
  { id: "ai-generic", p: 2, name: "AI provider key", test: (k) => /(OPENAI|ANTHROPIC|CLAUDE|GEMINI|MISTRAL|GROQ|DEEPSEEK|COHERE|TOGETHER|REPLICATE|HUGGING|PERPLEXITY|XAI)\w*(KEY|TOKEN)/.test(k), action: "Delete it with the provider, create a new one, check usage and billing." },
  { id: "slack", p: 5, name: "Slack token or webhook", test: (k, v) => /^xox[abpr]-/.test(v) || /hooks\.slack\.com\/services\//.test(v), action: "Revoke the token or regenerate the webhook URL in the Slack app settings." },
  { id: "email", p: 5, name: "Email or SMS provider key", test: (k, v) => /^SG\.[\w-]{20,}\.[\w-]{20,}$/.test(v) || /^re_[A-Za-z0-9_]{20,}$/.test(v) || /(SENDGRID|RESEND|MAILGUN|POSTMARK|TWILIO|SES_|SMTP)\w*(KEY|TOKEN|PASS|SECRET)/.test(k), action: "Revoke it with the provider and create a new one; attackers use these for phishing from your domain." },
  { id: "stripe-webhook", p: 6, name: "Stripe webhook signing secret", prefix: /^whsec_/, action: "Roll the signing secret on the webhook endpoint in the Dashboard (Workbench > Webhooks).", where: "https://dashboard.stripe.com/webhooks" },
  { id: "n8n", p: 6, name: "n8n encryption key", test: (k) => k === "N8N_ENCRYPTION_KEY", action: "Set a new key, then recreate every credential stored in n8n; the old ones can be decrypted with the leaked key." },
  { id: "signing", p: 6, name: "Session, JWT or app signing secret", test: (k) => /^(JWT_SECRET|JWT_SIGNING_KEY|SESSION_SECRET|COOKIE_SECRET|NEXTAUTH_SECRET|AUTH_SECRET|BETTER_AUTH_SECRET|SECRET_KEY_BASE|APP_KEY|DJANGO_SECRET_KEY|SECRET_KEY|FLASK_SECRET_KEY)$/.test(k), action: "Generate a new value. Anyone with the old one can forge sessions or tokens; rotating it signs everyone out." },
  { id: "encryption", p: 6, name: "Encryption key", test: (k) => /ENCRYPTION_KEY|ENCRYPT_KEY|CIPHER_KEY|MASTER_KEY|DATA_KEY/.test(k), action: "Data encrypted with it should be treated as readable: decrypt and re-encrypt with a new key, and rotate any secrets stored that way." },
  { id: "stripe-test", p: 8, name: "Stripe test key", prefix: /^(sk|rk)_test_/, action: "Low risk, but rotate it with the live key so old values stop working." },
  { id: "generic", p: 7, name: "Other secret", test: (k) => /(SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE|CREDENTIAL|API_?KEY|ACCESS_KEY|AUTH)/.test(k), action: "Find who issued it, revoke it there and create a new one." },
];
const NOT_SECRET = /^(PORT|HOST|HOSTNAME|NODE_ENV|ENV|TZ|LANG|LOG_LEVEL|DEBUG|PUBLIC_.*|NEXT_PUBLIC_.*|VITE_.*|.*_URL|.*_URI|.*_ENDPOINT|.*_REGION|.*_BUCKET|.*_PUBLISHABLE_KEY|.*_ID)$/;

/** Returns the matching rule for one variable, or null if it does not look secret. */
export function classify(key, value) {
  const k = key.toUpperCase();
  const v = value ?? "";
  for (const rule of RULES) {
    if (rule.prefix ? rule.prefix.test(v) : rule.test(k, v)) {
      // A *_URL without credentials only matches the database rule above.
      if (rule.id === "generic" && NOT_SECRET.test(k)) return null;
      return rule;
    }
  }
  return null;
}

/** Shows only what identifies the kind of secret: a known prefix and the length. */
export function mask(rule, value) {
  if (value == null) return "(sealed, value not readable)";
  // An AWS key ID's first four letters only say what kind of key it is.
  const pre = rule.prefix ? (rule.prefix.exec(value)?.[0] ?? "") : (/^(AKIA|ASIA)/.exec(value)?.[0] ?? "");
  if (rule.id === "database") return value.replace(/:\/\/([^:/\s]*):[^@\s]+@/, "://$1:****@").replace(/\?.*$/, "");
  return `${pre}${"*".repeat(4)} (${value.length} chars)`;
}

/** True when a database URL points somewhere other than a private network name. */
export function publicDatabase(value) {
  const host = /@([^:/?\s]+)/.exec(value ?? "")?.[1] ?? "";
  if (!host) return false;
  return !/(\.internal|\.local|^localhost|^127\.|^10\.|^192\.168\.|^172\.(1[6-9]|2\d|3[01])\.)/.test(host);
}

/** Builds the plan: one entry per distinct secret value, with every place it is used. */
export function plan(sources) {
  const byValue = new Map();
  for (const { file, vars } of sources) {
    for (const { key, value } of vars) {
      const rule = classify(key, value);
      if (!rule) continue;
      // An AWS key ID and its secret are one pair: rotate them together.
      const id = rule.id === "aws"
        ? `aws:${file}`
        : value == null ? `${file}:${key}` : createHash("sha256").update(value).digest("hex");
      const entry = byValue.get(id) ?? { rule, masked: mask(rule, value), uses: [], publicDb: false };
      entry.uses.push(`${file}: ${key}`);
      if (rule.id === "database" && publicDatabase(value)) entry.publicDb = true;
      byValue.set(id, entry);
    }
  }
  return [...byValue.values()].sort((a, b) => a.rule.p - b.rule.p || a.uses[0].localeCompare(b.uses[0]));
}

function load(file) {
  const text = readFileSync(file, "utf8");
  const name = path.basename(file);
  return { file: name, vars: text.trimStart().startsWith("{") || text.trimStart().startsWith("[") ? parseJson(text) : parseEnv(text) };
}

function main(argv) {
  const asJson = argv.includes("--json");
  const files = argv.filter((a) => a !== "--json");
  if (files.length === 0) {
    console.error("usage: node env-rotation-plan.mjs [--json] <file.env|vars.json> ...");
    return 2;
  }
  let sources;
  try {
    sources = files.map(load);
  } catch (err) {
    console.error(`Could not read input: ${err.message}`);
    return 2;
  }
  const entries = plan(sources);
  if (asJson) {
    console.log(JSON.stringify(entries.map((e) => ({ priority: e.rule.p, kind: e.rule.name, masked: e.masked, usedIn: e.uses, publicDatabase: e.publicDb, action: e.rule.action, where: e.rule.where ?? null })), null, 2));
    return entries.length ? 1 : 0;
  }
  const total = sources.reduce((n, s) => n + s.vars.length, 0);
  console.log(`Read ${total} variables from ${sources.length} file(s); ${entries.length} distinct secrets to rotate.\n`);
  entries.forEach((e, i) => {
    console.log(`${String(i + 1).padStart(2)}. [P${e.rule.p}] ${e.rule.name}  ${e.masked}`);
    const note = e.uses.length < 2 ? "" : e.rule.id === "aws" ? "  (one key pair: rotate together)" : "  (same value: rotate once, update all)";
    console.log(`    used in: ${e.uses.join(", ")}${note}`);
    if (e.publicDb) console.log("    WARNING: host is reachable from outside a private network; restrict access");
    console.log(`    do: ${e.rule.action}`);
    if (e.rule.where) console.log(`    at: ${e.rule.where}`);
  });
  if (entries.length) console.log("\nRevoke at the provider first, then set the new value on the new platform and redeploy.");
  return entries.length ? 1 : 0;
}

if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
  process.exitCode = main(process.argv.slice(2));
}

node env-rotation-plan.mjs api.json worker.json n8n.env
node env-rotation-plan.mjs --json api.json > plan.json    # machine-readable

Read 19 variables from 3 file(s); 11 distinct secrets to rotate.

 1. [P1] AWS access key pair  AKIA**** (20 chars)
    used in: api.json: AWS_ACCESS_KEY_ID, api.json: AWS_SECRET_ACCESS_KEY  (one key pair: rotate together)
    do: Deactivate the key now (aws iam update-access-key --status Inactive), create a new one, then check CloudTrail and billing.
 2. [P1] Stripe live secret or restricted key  sk_live_**** (107 chars)
    used in: api.json: STRIPE_SECRET_KEY
    do: On the API keys page: ... menu > Rotate key, with Expiry set to Now (the default grace period keeps the old key working).
 3. [P2] OpenAI API key  sk-proj-**** (128 chars)
    used in: api.json: OPENAI_API_KEY, worker.json: OPENAI_API_KEY  (same value: rotate once, update all)
 4. [P2] Anthropic API key  sk-ant-**** (108 chars)
 5. [P2] GitHub token  github_pat_**** (81 chars)
 6. [P3] Database URL with password  postgresql://app:****@db-hnd1.example-host.com:31842/app
    WARNING: host is reachable from outside a private network; restrict access
 7. [P3] Database password  **** (24 chars)
 8. [P5] Email or SMS provider key  **** (33 chars)
 9. [P6] Session, JWT or app signing secret  **** (48 chars)
10. [P6] Stripe webhook signing secret  whsec_**** (38 chars)
11. [P6] n8n encryption key  **** (32 chars)

Revoke at the provider first, then set the new value on the new platform and redeploy.

# Stop the leaked key at once, then make a new one
aws iam update-access-key --user-name app-deployer --access-key-id AKIA... --status Inactive
aws iam create-access-key --user-name app-deployer
# Was it used, and from where?
aws iam get-access-key-last-used --access-key-id AKIA...
# After the app runs on the new key
aws iam delete-access-key --user-name app-deployer --access-key-id AKIA...

-- PostgreSQL: new password for the app role, then update every service
ALTER ROLE app WITH PASSWORD 'a-new-long-random-password';
-- MySQL / MariaDB
ALTER USER 'app'@'%' IDENTIFIED BY 'a-new-long-random-password';

# A new random value for JWT_SECRET, SESSION_SECRET, NEXTAUTH_SECRET and similar
node -e "console.log(require('crypto').randomBytes(48).toString('base64url'))"

-- pg-audit.sql: list objects an intruder could leave behind in a PostgreSQL
-- database. Read-only. Run it as the database owner or a superuser:
--   psql "$DATABASE_URL" -f pg-audit.sql
-- Anything you do not recognise is a reason to rebuild the database from your
-- own schema and import data only.

-- 1. Roles that can log in or hold powerful rights (built-in pg_* roles excluded)
SELECT 'role' AS kind, rolname AS name,
       concat_ws(', ',
         CASE WHEN rolsuper THEN 'SUPERUSER' END,
         CASE WHEN rolcreaterole THEN 'CREATEROLE' END,
         CASE WHEN rolreplication THEN 'REPLICATION' END,
         CASE WHEN rolbypassrls THEN 'BYPASSRLS' END,
         CASE WHEN rolcanlogin THEN 'LOGIN' END,
         CASE WHEN pg_has_role(oid, 'pg_execute_server_program', 'MEMBER') AND NOT rolsuper THEN 'CAN RUN SERVER PROGRAMS' END
       ) AS detail
FROM pg_roles
WHERE rolname !~ '^pg_' AND (rolcanlogin OR rolsuper OR rolcreaterole OR rolreplication)

UNION ALL
-- 2. Functions outside the system schemas; the risky ones first
SELECT 'function', n.nspname || '.' || p.proname || '(' || pg_get_function_identity_arguments(p.oid) || ')',
       concat_ws(', ', l.lanname,
         CASE WHEN p.prosecdef THEN 'SECURITY DEFINER' END,
         CASE WHEN p.prosrc ~* '(program|dblink|http|curl|wget|lo_export|pg_read_server_files|pg_write_server_files|copy .* to)' THEN 'REACHES OUTSIDE THE DATABASE' END)
FROM pg_proc p
JOIN pg_namespace n ON n.oid = p.pronamespace
JOIN pg_language l ON l.oid = p.prolang
WHERE n.nspname NOT IN ('pg_catalog', 'information_schema') AND n.nspname !~ '^pg_toast'
  AND NOT EXISTS (SELECT 1 FROM pg_depend d WHERE d.objid = p.oid AND d.deptype = 'e')

UNION ALL
-- 3. Triggers on tables (internal constraint triggers excluded)
SELECT 'trigger', t.tgname || ' ON ' || t.tgrelid::regclass, 'calls ' || t.tgfoid::regproc
FROM pg_trigger t WHERE NOT t.tgisinternal

UNION ALL
-- 4. Event triggers fire on DDL for the whole database
SELECT 'event trigger', evtname, evtevent || ' calls ' || evtfoid::regproc FROM pg_event_trigger

UNION ALL
-- 5. Extensions other than the default plpgsql
SELECT 'extension', extname, extversion FROM pg_extension WHERE extname <> 'plpgsql'

UNION ALL
-- 6. Foreign servers (postgres_fdw, dblink) point at other hosts
SELECT 'foreign server', srvname, array_to_string(srvoptions, ', ') FROM pg_foreign_server

UNION ALL
-- 7. Logical replication can copy every change to another server
SELECT 'publication', pubname, CASE WHEN puballtables THEN 'ALL TABLES' ELSE 'some tables' END FROM pg_publication
UNION ALL
SELECT 'subscription', subname, CASE WHEN subenabled THEN 'enabled' ELSE 'disabled' END FROM pg_subscription

ORDER BY 1, 2;

-- Run separately if they apply:
-- Where a subscription connects to (superuser only):
--   SELECT subname, regexp_replace(subconninfo, 'password=\S+', 'password=****') FROM pg_subscription;
-- Scheduled jobs, if the pg_cron extension is installed:
--   SELECT jobid, schedule, command, username FROM cron.job;

psql "$DATABASE_URL" -f pg-audit.sql

event trigger   keep_alive                       ddl_command_end calls on_ddl
extension       postgres_fdw                     1.2
foreign server  mirror                           host=collector.invalid, dbname=loot
function        public.on_ddl()                  plpgsql
function        public.sync_audit()              plpgsql, SECURITY DEFINER, REACHES OUTSIDE THE DATABASE
publication     all_changes                      ALL TABLES
role            app_user                         LOGIN
role            backup_svc                       LOGIN, CAN RUN SERVER PROGRAMS
role            postgres                         SUPERUSER, CREATEROLE, REPLICATION, BYPASSRLS, LOGIN
subscription    pull_back                        disabled
trigger         users_sync ON users              calls sync_audit

# 1. Data only from the old database: no roles, functions, triggers or grants
pg_dump "$OLD_DATABASE_URL" --data-only --no-owner --no-privileges --format=custom -f data.dump

# 2. Create the schema on the new database from your own migrations
#    (prisma migrate deploy, drizzle-kit migrate, rails db:schema:load, ...)

# 3. Load the data; --disable-triggers needs superuser on the new database
pg_restore --data-only --no-owner --disable-triggers -d "$NEW_DATABASE_URL" data.dump