Is there a way to create an app that isn't web accessible (e.g. for MySQL instance)?
railway does not have internal networking, so at the moment all services and plugins have to be accessed from their public domains
isn't this a serious security risk?
no not really
unless you regularly leak your credentials lol