https://api.heroku.com/invoices/show/xxxxxx
The last 6 digits are clearly an 'invoice id' number. On a whim I tried incrementing it by one to see if my next invoice was the next id, and I saw SOMEONE ELSES INVOICE. Sure enough, any number I put in there gives me someone else's latest invoice. Go ahead, try it. You have to be logged in, but once you are you can see anyones. There's no credit card information available, but you can see name, addresss, and detailed invoice. Interestingly, just about everyone spends $0.
I've notified Heroku.
UPDATE: Heroku has taken down their API site, presumably to fix this. As for all the backlash about posting this, I do understand it and feel bad in retrospect. I certainly wouldn't have posted it if there was credit card or SSN information available. I notified Heroku prior to posting and mostly wanted someone else to confirm that it wasn't just my account before they closed it down. They frequently take down the API site during outages and I expected them to do that a lot quicker than they did. I didn't expect it to reach the front page until it was a 'look at the problem that Heroku had' type of story. Lesson learned.