DJB still claims that qmail is exploit-free[1] as well as djbdns[2] and I think those are both 1-man shows.

[1] http://cr.yp.to/qmail/guarantee.html

[2] http://cr.yp.to/djbdns/guarantee.html