Is it illegal to hack your own Heroku web app?

No, you would be an authorized party to attempt to find an exploit in your code. Since Heroku apps are heavily isolated from each other, hacking it doesn't really induce many problems for them (only you).