Have there been security-related incidents before with their slugs?

Absolutely. http://daverecycles.com/post/2858880862/heroku-hacked-dissec...