Summary

Subdomain reuse, also known as subdomain takeover, is a security vulnerability that occurs when an attacker claims and takes control of a target domain. Typically, this happens when an application is deprecated and an attacker directs residual traffic to a host that they control.

As of 14 June 2023, we changed the format of the built-in herokuapp.com domain for Heroku apps. This change improves the security of the platform by preventing subdomain reuse. The new format is <app-name>-<random-identifier>.herokuapp.com . Previously, the format was <app-name>.herokuapp.com . The new format for built-in herokuapp.com domains is on by default for all users.

Why It's Important

When you delete a Heroku application, its globally unique name immediately becomes available to other users.…