The only potential problem is that Cloudflare doesn&#x27;t check the validity of the herokuapp.com cert, so in theory someone could MITM the connection. In practice, I&#x27;m not sure how you&#x27;d even get Cloudflare to connect to the rogue proxy, short of taking control of the DNS of *.herokuapp.com.