That's great. They make good points on securing databases as well. Everything has to be open with Heroku's basic dynos. It would be nice to secure PostgreSQL or Elasticsearch so the IP is not publicly available.