No discussion of Heroku and the free tier should happen without the context of the massive cryptomining scheme that was directly targeting their free tier:

https://www.bleepingcomputer.com/news/security/massive-crypt...

Note, oddly the article doesn't state Heroku by name, but the network diagrams all do.