Zend certified PHP/Magento developer

Is there an easy way to implement IP whitelisting on Heroku? [closed]

My organization hosts an app on Heroku, and the dev and qa environments (with swagger) are all accessible to the internet with no vpn required or IP whitelisting. Isn’t this strongly discouraged? And what can we do to implement whitelisting on Heroku?