Railway posted a security disclosure today

Railway published a disclosure about an incident. Credit for being transparent. If you deploy there, worth reading and rotating anything sensitive. How do you evaluate PaaS providers on security?