I'm using Heroku to host a small number of services. I want to better understand the access permissions on the files that I'm putting onto my Heroku instances.
First off, I am aware that I am handing my data over to an external company, and that it's game over if bad actors manage to infiltrate Heroku or to hack my individual user account.
With that out of the way, I have a few questions:
How secure is the source code of the microservices that I'm pushing to a Heroku dyno? If someone else knows the URL of my app, e.g.
https://newbs-dyno.herokuapp.com, what can they do? Can unauthorized users clone the underlying git repo? Can they view the contents (files and folders) that I've put on the dyno?
How securely stored are the configuration variables? I want to use config vars to store some credentials, as described in the documentation. Is this good practice?
What defines how visible or invisible my dyno's contents, configuration variables included, are? Is it correct to think of my dyno as a server-side application that exposes a few well-defined endpoints?