Private apps

Is there a way to create an app that isn't web accessible (e.g. for MySQL instance)?

N/A

railway does not have internal networking, so at the moment all services and plugins have to be accessed from their public domains

isn't this a serious security risk?

no not really

unless you regularly leak your credentials lol