How can I defend against Heroku (or any PAAS) ID theft?

Is it correct to assume that if someone obtained my Heroku credentials that they would have access to any data in my app, regardless of any encryption that might be in-place, due to the fact that they could access my source code, database & environment vars?

If so, wouldn’t that one username/password be a weak link in my app’s overall security?

1 Answer 1


Yes, your heroku username/password might be a weak link in the app’s overall security, but so would be your database credentials, your router credentials and any other credentials...

As long as you have a strong password in place I would not be worried about heroku ID being stolen any more than any other ID you use.

what you CAN do to improve your heroku account security is enable two factor authentication: https://blog.heroku.com/archives/2014/9/25/two-factor-authentication-ga

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .