As much as I'd like everyone to be diligent about security as David suggests, I don't think it's going to happen. Developers aren't security or admin experts but they (me included) want a way to deploy apps without it being a major hassle. Handing off security to the provider is one of the big reason there are > 100K apps on Heroku, and it's a calculated cost/risk tradeoff.
A company's needs might not be in tune with Heroku's general security policy. If you're creating an app that handles personal information, then I hope to god that your developer/ops guys are security minded.
This particular vulnerability is quite embarrassing, however: separation of environments should at least be a given on Heroku.
It was interesting to read how the author figured it out, and his point that he could run a bunch of reapers to steal the information.
Now, if the IT guy running Herkous operations has his hat on straight he will notice the change in bandwidth patterns (higher upload following a heroku push) from the reapers, which is what the Heroku press release alluded to.
Generally, to benefit maliciously you would have to be watching the content without downloading it ("by hand" if you will) and then find something that was worth the effort.
Now that Dynos have more time to be considered in a different light, design changes will at least make the same "lottery watch dog" effect harder to achieve than just lurking on node.
I agree that it's important to make sure the provider's security policy is sufficient for your needs in the first place, however.
"For example, one Node.js platform provider that has been in the news recently was hacked in the past few days and all of their user databases were deleted. The reason why? They accidentally published their database password on GitHub. Oops."
This doesn't really surprise me, considering everyone and their mother is currently building "Heroku for Python/Node.js/[hot technology]".
I've looked around on a couple of hosts, 1and1 and I think he.net and found that it was quite possible to go looking around in other users accounts through the shell.
I'll stick with VPSs and dedicated servers.
