But Heroku also had a major GitHub integration that devolved into CVE which could not be fixed for about a month (among other bad news parts of that story, such as lying about the scope and slow walking the disclosures, that all seemed to just get worse.)

This is ostensibly all the result of the brain drain after SalesForce acquisition has set in. It's a death spiral.