Heroku learned of and resolved a security vulnerability last week. We want to report this to you, describe how we responded to the incident, and reiterate our commitment to constantly improving the security and integrity of your data and source code.
On Tuesday, June 26, Jonathan Rudenberg notified us about an issue in our Codon build system. The Codon build system is responsible for receiving application code from Git and preparing it for execution on the Aspen and Cedar stacks. This vulnerability exposed a number of sensitive credentials which could be used to obtain data and source code of customer applications. Upon receiving notification we rolled the most sensitive credentials. An...