There is more to security than hardening your code. For example, I assume you have some sort of master/root/admin level account on your own website. Are you using the same password as your email account? Do you use a third party email account? Do you have a 'forgot my password' feature? Here's an attack vector: I get read access to your gmail account, then I use the 'forgot my password' feature to change your password and I have then rooted your site.

From the web application & OS level everything is fine. No-one has compromised anything, the web application has performed exactly as required, since the admin user has just logged in normally.

There's also social engineering attacks, could I get you to open a certain webpage that I control? What will that tell me about your web browser? Does that give me control of your heroku server?