How does Heroku know that your password was reported as compromised?

security authentication heroku passwords

Best guess:

They are using Have I Been Pwned, which also provides an API.

Troy Hunt is collecting data breaches on this site and making them accessible.