While Heroku implements extended security measures, installing modules from untrusted developers may still cause damage to your server/account.