Yeah, it’s well known that you can prove the presence of bugs but you can’t prove their absence.

All software is to be considered insecure, formally speaking.