Heroku doesn't require any Github account - that's the beauty of git :) That said, I'd still argue that you should practice defense-in-depth; plan for "this is

Heroku doesn't require any Github account - that's the beauty of git :) That said, I'd still argue that you should practice defense-in-depth; plan for "this is how I'll limit damage when someone gets ahold of these credentials" rather than "Nobody will get these, so I can do dangerous things with them". It's the same argument behind "don't do things as root unless you have no other choice"; trading security for convenience works really nicely right up to the point where you get your teeth kicked in.