After this thread we implemented a
crossdomain.xml file specifically for actionscript / flash developers. The issue you're having seems unrelated - it appears that
waveformjs.org don't currently have SSL configured correctly - they respond with a *.
herokuapp.com domain SSL cert, and so the connection is blocked by the browser because it doesn't match the domain it's being served on.
https://waveformjs.herokuapp.com/ seems to be the same app and work with SSL, so you could modify the script you have to point to that, or encourage
waveformjs.org to set up an SSL cert through heroku.