Hi. Rust core here.

I like to say that of course Rust prevented Heartbleed, because we don't currently support wrapping malloc ;). That's of course a bit glib.

While it's true that Rust gives you a lot of assistance with writing safe code, given that unsafe exists, and that we, as a systems language, need to give you underlying access to the machine, Rust will allow you to do all kinds of stupid things if you vouch to the compiler that you're going to handle the safety aspect. This means that ultimately, you can do any kind of stupid thing in Rust that you can do in any other language.

An example: a common problem in C code is buffer overflows, which happens when some code thinks that an array has more elements in it than it does. Because C's arrays don't have a length as part of the type, it can be error prone to keep track of the length of the array. Rust's arrays, vectors, and slices all have a length as a part of the type, and so it's more difficult to have this data be out of sync. But Rust will let you be stupid if you want to:

    fn bad_stuff(v: Vec<i32>) -> i32 {
        unsafe {
            *(v.get_unchecked(v.len() + 1))
        }
    }

    fn main() {
        let vec = vec![1, 2, 3];

        let val = bad_stuff(vec);

        println!("{}", val);
    }

The `bad_stuff` function here uses `get_unchecked()`, which skips the array bounds check, to grab some memory past the length of the end of the vector. Rust will happily compile this code, your `unsafe` block tells the compiler to trust that you're using `get_unchecked()` in a safe way, even though it can't verify it.

Now, there's a decent discussion that can be had on this topic: 'usual' Rust code will of course be significantly safer than 'usual' C code, since you have the compiler's assistance. Unfortunately, security is often about the edge cases. While it's true that not wrapping malloc would have prevented Heartbleed from happening, and most C projects don't wrap malloc... it did happen. Once Rust starts getting used in the wild, we'll see Rust with security problems, I'm sure of it. That doesn't mean that Rust has no value, just that we need to be realistic about the tradeoffs that any of our technologies make. Rust is not a panacea, even if it does cure some of your aches and pains.