I don't know, I really don't agree. I've never had a sysadmin job but I never found any problems with any of these things. All it takes is basic *nix knowledge.

I don't know, I really don't agree. I've never had a sysadmin job but I never found any problems with any of these things. All it takes is basic *nix knowledge. I do work in infosec though, so as for your pop quiz: 1. Disable root login and enable public key auth only (PasswordAuthentication no, PermitRootLogin no). 2. Run mysql_secure_installation All of these things are easy to learn with a little Googling. "How do I secure X?" "How do I install/configure X?" Way, way easier to learn than learning how to program or start a business, at least. It is not worth $300 or more per month just to outsource some sys admin tasks. Not to mention I doubt Heroku is paying very close attention to your log files for you; it's probably easier for you to do that yourself on your own VPS (where you'll also have access to more logs in the first place). If you have a vulnerability in your application then no hosting/platform provider is going to notice it and fix it for you 9 times out of 10.