I recommend Weekend Reading by Assaf Arkin to everyone, covers several topics from design and front-end to security, tooling and peopleware. More than just a collection of links, includes a bit of commentary which makes it feel much more personal.
Yes, self-signed certificates without a CA is MitM-prone, but that's the only thing Heroku enables. You're only given a username and password and have to do with whatever configuration they've done, thus the problems.
I would guess so, yes. You can never prove that something is random, merely that it behaves randomly "enough". There are lots of testsuites[1][2] you can run that will test that a generator is uniform and doesn't follow any patterns or has any other statistical weaknesses, but you can never prove that something is fully random without knowing the process that generates those numbers. A statistically sound RNG might just output the digits of pi, which would be non-repeating, uniform and pass any randomness test, but if you knew which digit the RNG started from and how many it has output so far you can easily predict the next one. Likewise if you're given a large enough sample you can search the digits to figure out the state of the RNG.
https://labnotes.org/