The status page [1] has the actual root cause (enabling "Surrogate Keys" silently bypassed their CDN-off logic). The blog post doesn't. That's backwards. "0.05

The status page [1] has the actual root cause (enabling "Surrogate Keys" silently bypassed their CDN-off logic). The blog post doesn't. That's backwards. "0.05% of domains" is a vanity metric -- what matters is how many requests were mis-served cross-user. "Cache-Control was respected where provided" is technically true but misleading when most apps don't set it because CDN was off. The status page is more honest here too: they confirmed content without cache-control was cached. They call it a "trust boundary violation" in the last line but the rest of the post reads like a press release. No accounting of what data was actually exposed. [1] https://status.railway.com/incident/X0Q39H56 https://status.railway.com/incident/X0Q39H56