I went to Heroku Meetup #6 this night. At this meetup I asked a question about how slug compiler handles security during running
bundle install in build process because it is my responsibility at Sqale.
They also let me know another approach that Travis CI does.
Thank you very much Terence, JD and translator.