Heroku Security Notification

I do remember hooking up Heroku to Github for auto-deployments and thinking to myself something along the lines of, "why does Heroku need ALL of this access?"

It'd be great if Github could allow read/write permission grants on a per-repo basis. Maybe they do already!.. in which case I'd much rather have and setup that granular detail than have a token that goes across all my public/private repos...

Edit: I do see in my Github's integration page that the Heroku connection was used within the past week... but it doesn't show how exactly it was used. Until Github can provide specific details, is it safe to assume that all repos, public and private, could have been cloned?

Re: Heroku Security Notification

#7

Post by frays » Sat, Apr 16, 2022, 3:58 AM UTC

> Additionally, we recommend disconnecting Heroku from your GitHub repositories.

I have respect for the Heroku/Salesforce Security team for willing to ask users to perform this action. Many companies would be too worried about losing customers or having users not reconnect it afterwards.

My thoughts are with the team working on responding to this incident on Easter Friday.

Re: Heroku Security Notification

#8

Post by jayzalowitz » Sat, Apr 16, 2022, 4:00 AM UTC

roddylindsay wrote: post #5

Ah yes, the Friday night security incident drop.

Trash day

Re: Heroku Security Notification

#9

Post by pineconewarrior » Sat, Apr 16, 2022, 4:04 AM UTC

TheSpiciestDev wrote: post #6

I do remember hooking up Heroku to Github for auto-deployments and thinking to myself something along the lines of, "why does Heroku need ALL of this access?" It'd be great if Github could allow read/write permission grants on a per-repo basis. Maybe they do already!.. in which case I'd much rather have and setup that granular detail than have a token that goes across all my public/private repos... Edit: I do see in…

> It'd be great if Github could allow read/write permission grants on a per-repo basis. Maybe they do already!

They totally do. Shopify's Github integration works this way, and it is fantastic!

Re: Heroku Security Notification

#10

Post by bswinnerton » Sat, Apr 16, 2022, 4:11 AM UTC

pineconewarrior wrote: post #9

TheSpiciestDev wrote: post #6

I do remember hooking up Heroku to Github for auto-deployments and thinking to myself something along the lines of, "why does Heroku need ALL of this access?" It'd be great if Github could allow read/write permission grants on a per-repo basis. Maybe they do already!.. in which case I'd much rather have and setup that granular detail than have a token that goes across all my public/private repos... Edit: I do see in…

> It'd be great if Github could allow read/write permission grants on a per-repo basis. Maybe they do already! They totally do. Shopify's Github integration works this way, and it is fantastic!

These are known as GitHub apps and were designed to address this problem. https://docs.github.com/en/developers/apps/getting-started-w...