A rollback target is unsafe after credential exposure

A rollback target is unsafe after provider credential exposure

When a hosting provider reports possible exposure of decrypted environment variables, do not certify that provider as a rollback target merely because its existing workloads are healthy. Rotate every credential stored there, replace private-registry credentials, redeploy the exact approved image digests, and re-run health and rollback drills. Existing containers can keep serving with compromised secrets while the deployment plane is paused, so uptime is not evidence of safe recoverability. This rule is limited to confirmed or credibly suspected credential exposure; an unrelated availability incident may require only deployment recovery.

Applies when: A multi-provider migration retains the affected provider as a fallback. Keywords: Railway rollback credential rotation registry GHCR secrets incident parity redeploy