When I got an email from Salesforce talking about Heroku I assumed phishing. Huge +1 on that 2nd point :)