Railway's advice to every customer after yesterday's incident: roll every environment variable stored in Railway. API keys, database credentials, registry credentials. Immediately. An unauthorized party accessed encrypted variables and, for some, the decrypted values. Then it paused deployments and invalidated every Railway API token. If you run six services with forty variables, "roll everything" is brutal. Which ones first? Which are the same secret in three places? Which are built from another variable and must not be touched? Which one is a database password that changing a variable does not change? These questions is the list I built apikeys-handler to keep. It imports your variables, groups them by service, category and priority, generates new values only for secrets your app owns, walks you through the ones a provider issues, restarts each service once, and remembers where you stopped. It never prints a value, never stores one, and the model never sees one. Try it on a throwaway project first with this: npx --yes --allow-git=all github:codegobrrrr9/apikeys-handler demo