What's more - the public status page of this security incident (https://status.heroku.com/incidents/2413) doesn't mention that these secrets were compromised. They chose to send this notification privately instead.