2 ms·
If it was locked down presumably all you would need to connect to the DB host is a Heroku account. I’d rather have it intentionally open with complimenting secu
by xfitm3 8y ago
If it was locked down presumably all you would need to connect to the DB host is a Heroku account. I’d rather have it intentionally open with complimenting security controls.
- larrik 8y agoThis doesn't make any sense. There's no scenario that keeping the DB limited to being accessed by Heroku dynos would make it less secure than leaving it open to the internet AND all of the other ways you can access it currently. Beyond that, if you leave it accessible via the internet, you are banking hard on postgres not having a zero-day that lets someone get through without brute-forcing the password (or heroku being slow to update your software).