Heroku was alerted to a security vulnerability that let anyone change an account's password and take over the account. The company reacted quickly, pushing out a fix the next day.