How can I defend against Heroku (or any PAAS) ID theft?

Is it correct to assume that if someone obtained my Heroku credentials that they would have access to any data in my app, regardless of any encryption that might be in-place, due to the fact that they could access my source code, database & environment vars?

If so, wouldn’t that one username/password be a weak link in my app’s overall security?


Yes, your heroku username/password might be a weak link in the app’s overall security, but so would be your database credentials, your router credentials and any other credentials...

As long as you have a strong password in place I would not be worried about heroku ID being stolen any more than any other ID you use.

what you CAN do to improve your heroku account security is enable two factor authentication: https://blog.heroku.com/archives/2014/9/25/two-factor-authentication-ga

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.