The Open Security Technology program at DHS can help with stuff like Heartbleed. They're underfunded.