> Heroku still requires authentication, but doesn't filter access by ip.

Which means unauthenticated access to the postgres port as I said in my post. I didn't say "unauthenticated access to postgres" which would be plainly ridiculous.