Oh fun fact we also deployed using Railway, which hackers just stole env vars from. But even after we rotated all of our API and encryption keys, Railway *disabled new deploys* so we were forced to just take the website down
The codebase that I deal with at work was entirely vibecoded by my boss and it's such a hulking piece of shit it's utterly mindbending. One like = one horror story