We were running versions of OpenSSL that were vulnerable to Heartbleed. For free hosting, this really doesn't matter as much, since none of the websites operate over SSL. All our systems that were vulnerable have been patched, and SSL/TLS certificates revoked and renewed.