Hacker News Reader

Hm, is the secrecy of that URL the only thing stopping someone else downloading the backup?

I believe it expires after 1 hour (X-Amz-Expires=3600).

No, you'd have to be logged in with the CLI as a heroku user that has privileges to said database.