Hacker News Reader

Note: while building this tool, we discovered key sites that were patched yet still vulnerable to Heartbleed including reddit! (now fixed)

Patched, but still vulnerable... how come?

They probably patched their public-facing web servers, but not their internal link-fetching app servers.

Their public-facing servers (that receive requests) were patched but not the code that made outbound HTTP requests.