That is my understanding as well. Any memory in the same process as OpenSSL could be compromised. In the case of Heroku that includes any traffic to/from your a

That is my understanding as well. Any memory in the same process as OpenSSL could be compromised. In the case of Heroku that includes any traffic to/from your app, but not dynos' memory, so internal application credentials should be ok, unless those services were also vulnerable. Hopefully Heroku is coordinating with add-ons to determine that and automatically regenerate affected credentials.