I can't imagine it's considered a vulnerability. Heroku has had a documented `heroku console` that can do at least as much as bash can, security-wise.