Security incident at our hosting provider
Updates
All keys and tokens PayGlue kept at Railway have been replaced, and every connection detail our customers store with us is now encrypted with a new key. Emails, invitations and the support form work again. We found no indication that any of the exposed keys were misused. As a precaution we recommend creating new keys for the services connected to PayGlue. The full write-up, including the steps: Security Update: What We Did After Our Host's Incident: https://payglue.io/blog/our-host-had-a-security-incident-here-is-what-we-did/
Railway, the provider that hosts the PayGlue application servers, reported unauthorized access to the systems where it stores configuration secrets (Railway status page: https://status.railway.com). As a precaution we are replacing every key PayGlue kept there. Purchases, renewals and cancellations continue to reach Ghost as usual. Emails sent from the dashboard, new invitations and the support form are delayed until our updated configuration is live. Railway is currently processing deployments with delays. We have reviewed our logs and found no indication of misuse. We will post an update here once everything is back to normal.