[frisco]

If this is being presented as a security problem, know that this is a non-issue. This is intended behavior; Heroku config vars are considered secret. If this is just showing off that you can run multiple apps from a single database, then, yes, that too should have been clear.

[ollysb]

Yeah, don't really get this, it's basically saying, if you have the username, password and hostname for a database, you can access it...