Thanks, this approach seems to work albeit it does require some extra plumbing:

1. Create second application (YourApp-Dev)
   
2. Add a new remote to your repository: git remote add appharbor-d {your dev url}
   
3. Associated it with a sub-domain or leave it as is
   
4. In Configuration Variables, add RuntimeEnvironment and the value of D or some value indicating this is the staging environment.
   
5. In your project, add the appSetting with the same key but a different value (e.g. L) to denote a localhost.
   

6. Create a new derived Authorize attribute and attach it to your BaseController or a controller you'd like to be protected in dev:

   public class AuthorizeLocalAttribute : AuthorizeAttribute {
   private const string LOCAL = "L";
   private const string DEVELOPMENT = "D";
   private const string PRODUCTION = "P";
   
   protected override bool AuthorizeCore(HttpContextBase httpContext) {
       // Ignore all Account controller calls (Anonymous)
       if (httpContext.Request.RequestContext.RouteData.Values["controller"].ToSafeString() == "Account")
           return true;
   
       // Get runtime environment
       string runtimeEnvironment = ConfigurationManager.AppSettings["RuntimeEnvironment"];
   
       if (runtimeEnvironment == DEVELOPMENT) {
           return base.AuthorizeCore(httpContext);
       }
       else {
           return true;
       }
   }
   }
   

Change it according to your needs. I might refactor into an Enum. In my main app, I set the variable to "P" to denote production... but I don't use it yet.

To push to dev: git push appharbor-d master and to prod: git push appharbor master.

I also added a line to skip authorization for the Account controller. This was important for me because otherwise my OpenID redirection didn't work (it still has an issue with the port numbers but that's for a different discussion).

Hope this helps other people. I'd love to this baked into AppHarbor so I don't need to require code but this works and is fairly lightweight.

PS. ToSafeString() is a simple extension: return value == null ? String.Empty : value.ToString().

Use the attribute like:

[AuthorizeLocal(Users = "My Admin ID")]
public abstract class BaseController : Controller { }

I just made one:

http://kamranicus.com/Blog/Posts/2/befriending-appharbor-and-making...

Hope that helps some people out!