On October 21, 2026, Railway, the hosting platform used by one of our AI infrastructure providers (Mastra), disclosed that an unauthorized party may have accessed environment variables stored on its platform. Some of the credentials Replay uses to run its AI features were stored there.
We have no indication that any Replay credential was misused or that any customer data was accessed, and neither provider has told us that our account was affected. As a precaution, we treated every credential held by that provider as exposed. We started work within an hour of being notified and replaced every credential that night.
October 21, 11:23 PM: Mastra notified us of Railway's disclosure and asked customers to replace any credentials stored with them.
October 22, 12:07 AM: We began work: we listed every credential the provider held and prepared replacements.
1:14 AM: We posted a scheduled maintenance notice on this page.
1:25 – 2:14 AM: Replay was in scheduled maintenance while we replaced database and service credentials.
About 2:00 – 4:04 AM: AI assistant features (AI activity editors and the Expert coach) were unavailable. The provider's deployment system had an unrelated problem that delayed applying the new credentials to our AI service. All other features worked normally.
4:04 AM: AI assistant features were fully restored.
About 50 minutes of scheduled maintenance, overnight in US time zones.
About two hours when AI assistant features were unavailable.
No data was lost.
Nothing. You don't need to change your password or take any other action.
Each provider will get its own narrowly scoped credentials, separate for each environment, so that a problem at one provider affects less.
We're improving our credential-rotation process so that a full rotation needs a shorter maintenance window and doesn't affect open browser tabs.
If you have questions, contact us at hello@replay.sale.
