FYI, I tested herokuapp.com's SSL support. It reports as vulnerable. :( On the bright side, since such servers are Heroku's inbound load-balancers, individual

FYI, I tested herokuapp.com's SSL support. It reports as vulnerable. :( On the bright side, since such servers are Heroku's inbound load-balancers, individual app dyno secrets in RAM probably aren't at risk. But, impersonating herokuapp.com, decoding its sessions, or viewing fragments of arbitrary other traffic through the same server may all be possible. Heroku reports they're aware and working on it: http://status.heroku.com http://status.heroku.com