The morning Heroku check, waiting when you open the laptop

What is the config var problem exactly?

Config vars are the standard place to put secrets on Heroku, and any tool that can read an app’s config can read all of them. That is how the platform works, and it means "read the app configuration" and "read every credential the app holds" are the same operation.

So if a config-reading action exists in the tool list, decide deliberately. Switching it off is the clean answer for most teams and costs very little: the questions worth asking about a Heroku app are about releases, dynos and add-ons.

Which Heroku work suits a companion?

The morning check and the release trail.

Which apps have a dyno in a crashed state, what the last release was and who shipped it, which add-ons are attached to an app nobody has deployed in six months. Each is a small read that currently interrupts whoever has the CLI open.

The Available tools section on the Heroku entry under `strawberry://settings/integrations` lists every tool the connection exposes and marks the read-only ones. Set the read actions in the Permissions block on that page and keep anything that restarts, scales or deploys at Ask every time.

• App, dyno and release reads: the useful core, and low risk.
• Config var reads: equivalent to reading every secret, so switched off is a fair default.
• Restart, scale and release actions: consequential, so keep them at Ask every time.
• A collaborator account scoped to the specific apps rather than one with organisation-wide access.

Get the postmortem drafted while the trail is warm

A companion reads release history and dyno state, then reads the tickets and the deploy conversation, and drafts an incident postmortem you can edit. That beats the version assembled from memory two days later.

Heroku’s log stream is a streaming interface rather than a request-response one, so it sits awkwardly in an action set. If nothing for logs appears in the tool list, a live incident stays a CLI job and the connection takes the write-up. For the routine form, release notes is the neighbouring pattern.

Frequently asked questions