Store the creds in repo
For heroku
I dunno lol
Lock a python version
jack their run.sh
I think this is how we set this
Try enforcing basic auth
Force SSL