It&#x27;s one of the most heavily audited codebases on the planet. Nobody likes the code quality, and Google has been restructuring it and rewriting it with their BoringSSL project.<p>At this point: when new bug classes are discovered, like carry propagation in optimized multiplication routines, or even simpler stuff like memory corruption due to bignum copies, yes, there&#x27;s some cause for alarm, because you might not be able to count on OpenSSL having been audited for them.<p>But the basic stuff, at least in the core functionality (ie: not oddball TLS extensions) has received a very good shake.