>Insecure until proven secure" is probably a good motto.

So just always insecure, as no amount of testing can guarantee there isn't some heartbleed like bug in there still.