Heroku CI and Review App Secrets Compromised

Re:Heroku CI and Review App Secrets Compromised by heartbreak on Tuesday May 17, 2022 @10:23PM (#31418610)

I completely stopped getting their update emails when I deleted all of my running apps. This is the second one I've seen on HN that I haven't received (though I received the others).

Is the impact limited to specific customer accounts, or are they just not updating me anymore?

[ Parent | on HN ]

Re:Heroku CI and Review App Secrets Compromised by hthrowaway5 on Tuesday May 17, 2022 @10:27PM (#31418637)

From the email:

> We value transparency and wanted to notify you of an issue affecting your account.

My guess is they sent it to users with pipelines that have env vars. It's funny since this sentence demonstrates they don't value transparency by not telling the other users more information about the hack.

They updated Heroku Status but surprisingly failed to mention anything about CI or pipelines.

[ Parent | on HN ]

Re:Heroku CI and Review App Secrets Compromised by Ozzie_osman on Tuesday May 17, 2022 @10:27PM (#31418634)

I think it's specific to apps with Review Apps or Heroku CI (specifically the Config Vars). If you didn't have those, based on this email, you may not be impacted.

[ Parent | on HN ]

Re:Heroku CI and Review App Secrets Compromised by heartbreak on Tuesday May 17, 2022 @10:39PM (#31418691)

I had both of those, and I had config vars for my pipeline apps.

[ Parent | on HN ]