I am glad you asked! I built the Heroku integration at Doppler. We are doing a one way syncing as we believe Doppler should be the single source of truth for your secrets. However, we know that addons & attachments are an important part of Heroku, so we make sure we never overwrite any of the addons/attachments env vars. Those continue to live within Heroku as they wouldn't make much sense or be useful outside of that context.

Got it, thanks for sharing that! I just got local development setup via Doppler and it was a breeze.

"dev": "doppler run -- nodemon --exec \"heroku local\" --signal SIGTERM"

For managing our production secrets, we're obviously a bit more hesitant to give those over to an additional third party. Heroku secrets management works well for us, so I think we will continue to use that for now. But for managing development secrets, this is perfect.

you can do similar things with 1Password CLI.

Here is short example: https://github.com/stumyp/ope