Communication around Heroku security incident dubbed 'train wreck'