Rails Asset Pipeline Directory Traversal Vulnerability (CVE-2018-3760) (blog.heroku.com)

Of note, this is the first security vulnerability that Heroku has ever decided to explicitly target via config https://devcenter.heroku.com/changelog-items/1437