Ваш гагатовый сервер слушает только на localhost. Причал изменения конфигурируется для слушания во всех интерфейсах. Затем установите правило в своем брандмауэре для принятия запросов на порте 24030, например, sudo ufw allow 24030
If you don't want a third party having the credentials, you run your own CI server instead of using a third party server. Easy as that.
Of course, if you host on Heroku, a third party already has your data anyway, and doesn't really need the credentials to get to it, so...
If you must use the third party server, you use legal agreements where the third party is obliged to protect your confidential data similarly to their own.