Post #2243550
2026-04-27 16:44 UTC
"Railway markets volume backups as a data-resiliency feature. But per their own docs: "wiping a volume deletes all backups.""
... ok yeah, that is on Railway, but um... also on anyone using it???
Replies (1)
-
@platypus@glammr.us 2026-04-27 16:45
"3. CLI tokens have blanket permissions across environments. The Railway CLI token I created to add and remove custom domains had the same volumeDelete permission as a token created for any other purpose. Tokens are not scoped by operation, by environment, or by resource at the permission level. There is no role-based access control for the Railway API — every token is effectively root. The Railway community has been asking for scoped tokens for years. It hasn't shipped." equal blame here...