It was built for use within your company / personal server - there is no authentication mechanism, so you have to make sure that it cannot be accessed from outside without at least HTTP Basic Auth.

I haven't tried running it on Heroku, it would be insecure, and I guess Heroku infrastructure would forbid some of system calls hubot-control app is doing, like checking pids, killing processes.