A proof-of-concept app demonstrating a (patched) CSRF attack on Heroku's SSO for add-on providers. - View it on GitHub