Railway Deployment Security Review
A Railway project becomes reachable from the internet the moment someone opens a public domain or a TCP proxy. We test the roles, secrets and exposure your team actually configured. CREST-certified testers, fixed price from £2,320 for a 2-day single-project scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Railway issues three kinds of API token, account, workspace and project, and each one reaches a different slice of your resources.
A Railway project is only as secure as the access, secrets and networking your team configured
Railway workspace members hold one of three roles, Admin, Member or Deployer, and the difference is granular: a Deployer can view every project and trigger a deployment through a connected GitHub commit but cannot create, modify or delete a variable, a service or a volume, view logs, or create a new project, while only an Admin can add or remove members, change a role, or reach billing and audit logs. A workspace can also be configured with a Trusted Domain, so anyone who signs up with a matching email address is added automatically at whichever role the workspace set as the default, a convenience that is only as safe as the domain and default role chosen.
Variables can be shared across every service in a project, pulled between services with Railway’s ${{ }} reference syntax, or sealed so the value is used at build and deploy time but never shown again in the dashboard or returned by the API, though a sealed variable is then excluded when a PR environment, a duplicated environment or a duplicated service is created. Networking works on the same opt-in basis: services reach each other privately over an internal SERVICE_NAME.railway.internal address until someone generates a public domain or opens a TCP Proxy, at which point a database or any other TCP service becomes reachable from the internet on a generated host and port.
We test the workspace and project you actually run: the roles and trusted domains configured, the shared, reference and sealed variables in use, which services carry a public domain or a TCP proxy, and how production and PR environments are set up. We never test Railway’s own infrastructure, in the same way we test client configuration on Heroku apps rather than Heroku’s platform.
SCOPE
What we review on a Railway project
Workspace Roles and Project Access
Railway workspace members hold one of three roles, Admin, Member or Deployer, and the difference is specific: a Deployer can view every project and deploy through a connected GitHub commit but cannot create, modify or delete a variable, a service or a volume, view logs, or create a new project, while only an Admin can add or remove members, change a role, or reach billing and audit logs. We test how many accounts hold Admin, whether a Member or Deployer account can reach further than that matrix allows, and which projects each role can actually see.
Trusted Domain Auto-Onboarding
A workspace can be configured with a Trusted Domain, so a new user who signs up with an email address matching that domain is added to the workspace automatically at whichever role was set as the default, without an existing member sending an invite. We test which domains are configured as trusted, what default role they assign, and whether a domain wide enough to include contractors or a personal alias has ever been verified.
Shared and Reference Variables
A shared variable defined once in Project Settings can be pulled into any service in the project, and a reference variable built with Railway’s ${{ }} syntax can pull a value from another service, from a shared variable, or from elsewhere in the same service, so one exposed variable name can chain further than the service it was set on. We test which services actually consume a shared or reference variable, and whether that chain hands a service credentials or values it does not need.
Sealed Variables
Sealing a variable means its value is still provided to builds and deployments but is never shown again in the dashboard or returned by the API, cannot be unsealed, and is not copied when a PR environment, a duplicated environment or a duplicated service is created. We test which secrets are sealed against which are still stored in plain view, and whether an unsealed API key, database password or webhook secret is visible to anyone with read access to the project.
Public Domains and Exposed Services
A service stays off the public internet until someone generates a Railway-provided domain or adds a custom domain from its Networking settings, at which point Railway issues an automatic SSL certificate and routes traffic through its edge network. We test which services actually carry a public domain, whether an internal-only tool, admin panel or staging service was ever given one by mistake, and what that domain exposes once it is reachable.
Private Networking Between Services
Services in the same project and environment can reach each other over an internal SERVICE_NAME.railway.internal address without exposing a port publicly, so an API, a worker and a cache can talk to one another entirely off the public internet. We test whether a service that should only be reachable privately still carries a public domain or a TCP proxy, and what a compromised service on the private network could actually reach from there.
TCP Proxy: Databases Exposed to the Internet
TCP Proxy exposes a non-HTTP service, most commonly a database, to the internet on a Railway-generated domain and port such as shuttle.proxy.rlwy.net:15140, and it can be paired with a custom domain or run alongside private networking for the same service. We test which databases have a TCP proxy enabled against which genuinely need external access, and whether the credentials guarding that proxy would withstand a direct connection attempt from the internet.
Environments: Production, Staging and PR Previews
Railway excludes sealed variables when creating a PR environment or duplicating an environment, so every variable that was not sealed carries across, and a PR environment is otherwise temporary, spun up automatically when a Pull Request opens and deleted once it is merged or closed. We test what a PR or staging environment actually inherited from production, and whether Environment RBAC, where available, genuinely stops a non-admin member from reaching production configuration.
API Tokens: Account, Workspace and Project Scope
Railway issues three kinds of API token, an account token tied to one person’s login and reaching every workspace and resource they can access, a workspace token scoped to a single workspace and shareable with teammates for CI, and a project token scoped to one environment within a project and authenticated with a separate Project-Access-Token header. We test which token type is used where, whether an account token was issued for a job a project token would do, and whether any live token is still valid after the person or pipeline that needed it moved on.
GitHub Deploy Triggers and Wait for CI
A service linked to a GitHub repository deploys automatically on every push to its configured branch, provided at least one project member has a connected GitHub account with contributor access to that repository, and Wait for CI can hold a deployment until every GitHub Actions check suite on the commit finishes rather than shipping the moment code lands. We test whether Wait for CI is enabled where a workflow should gate production, and whose GitHub access is actually driving deployments into each environment.
OUR PROCESS
Railway Deployment Security Review: From Scope to Attestation
Scope and Access
We agree which Railway workspace, project, environments and services are in scope, plus a login for each workspace role you use.
Configuration and Role Mapping
We map every workspace role, trusted domain and API token against what it actually grants, alongside your current variables, domains and TCP proxy configuration.
Manual Testing
A CREST-certified tester manually tests exposed services, sealed and shared variables, private networking boundaries and environment separation, chaining findings where they compound.
Attestation and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Railway pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Railway Deployment Security Review Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 3 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote3 to 4 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote4 to 6 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Railway For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Railway Deployment Security Review
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Railway project?
We need a login for each workspace role in use, ideally an Admin or Member account rather than a Deployer, plus read access to your current variables, domains, TCP proxies and environments. A project token scoped to an environment speeds up several checks but is not required to start.
Will testing touch our live data?
Testing focuses on workspace roles, variables, domains, TCP proxy and environment configuration, rather than the content of your databases. Where proving a finding needs a test record, we agree the exact scope with you first and remove anything we create once testing is complete.
Is this hosted on our infrastructure or Railway’s?
Your services, databases and volumes all run on Railway’s infrastructure, so there is nothing separate for you to host. The review is scoped to the project configuration you control, roles, variables, networking and environments, not to Railway’s own platform.
How long does a Railway security review take?
A single project with a typical number of services and one or two databases sits in our 2-day single-project scope, with a report usually landing around 5 working days after kickoff. A project running several environments, multiple databases with TCP proxies enabled, or a large number of services extends that scope.
What is out of scope for a single-project review?
Testing Railway’s own infrastructure or shared platform is never in scope, and we do not run denial-of-service testing against any Railway service. The application code running inside your services is scoped and quoted separately from the project and configuration review.
Does Railway have a customer penetration-testing policy we need to follow?
Railway’s published Terms of Service and Acceptable Use Policy do not set out a dedicated penetration-testing notification process or rules of engagement in the way some other providers do; the Acceptable Use Policy prohibits gaining unauthorised access to systems or data you do not control. We confirm Railway’s current terms and any account-specific conditions during scoping before testing begins.
Do you need our source code or admin access?
No. We test with the workspace role accounts and access you provide, and we do not need standing Admin access beyond what is needed to verify a specific finding during the engagement. Source code for anything you deploy is only needed if you commission the application itself as a separate assessment.
Are your testers CREST certified?
Yes. Every Railway engagement is carried out by UK-based, CREST-certified testers, and your report and attestation letter are recognised by auditors and insurers accordingly.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Railway project
A Railway project becomes reachable from the internet the moment someone opens a public domain or a TCP proxy. We test the roles, secrets and exposure your team actually configured. CREST-certified testers, fixed price from £2,320 for a 2-day single-project scope, quoted within 24 hours.
