Run it

npx keyhouse-check railway
npx keyhouse-check env .env
npx keyhouse-check env .env --json --report exposure.md

npx downloads the package from npm and runs it. env mode reads exactly the file you name and makes zero network calls once the scanner starts.

Railway needs a fresh token

Railway invalidated every API token on October 22, 2026. Create a new one at railway.com/account/tokens. Choose No workspace for an account token, or pick a workspace for a token scoped to it. To scan one workspace, pass its ID:

npx keyhouse-check railway --workspace YOUR_WORKSPACE_ID

The CLI reads RAILWAY_API_TOKEN if it is set. Otherwise it prompts for the token without echoing it or its length, which keeps it out of your shell history. Project tokens only reach one environment and can't list projects, so they aren't supported. Revoke the scan token when you're done.

What it reads

Railway's public GraphQL API. It lists your projects, every environment including previews, shared variables, and each service's rendered variables. The token may allow writes, but the CLI only sends queries.
Or exactly the local .env path you give it, parsed with Node's built-in dotenv parser. It doesn't expand references, walk directories or change your process environment.

What it never does

Upload a secret value. Values stay in memory and are never logged, included in errors or written to the report.
Call the credential providers to test your keys.
Send telemetry, analytics or update checks, or contact any Keyhouse server.
Change anything on Railway: no mutations, deployments or automatic rotations.
Overwrite an existing file. The Markdown report is created new, with owner-only permissions where the filesystem supports them.

Reports contain placement names, variable names, the inferred provider, the reason for each finding and the rotation steps. An output guard strips secret values, and every five-character piece of them, from the terminal output, the Markdown report and the JSON.

What it can miss

The check reuses 31 MIT-licensed Gitleaks rules for distinctive key formats, plus name-based heuristics for providers such as OpenAI, Anthropic, Stripe, Apify, AWS, GitHub, Supabase and Cloudflare. Heuristic matches are labeled as candidates for you to review. It is not a complete Gitleaks scan.

Secrets in unusual formats with innocent-looking names can slip through.
Railway may leave out sealed or inaccessible variables.
It reads current values, not old deployment snapshots.
A finding doesn't prove a key was stolen or still works, and an empty report doesn't prove your account is safe.

Where it fits

The check gives you the list of keys to rotate by hand. Keyhouse, which is still being built, is meant to make the next rotation one step: your hosts would hold proxy keys, and the real keys would stay in one place. The full details are in the README.