Erm, qmail had lots of bugs[1], when compiled for 64-bit processors (lots of integer overflows), but djb pushed back and said 64-bit wasn't supported.

qmail is a great demonstration that if you declare enough things out of scope, you can claim that the software is secure.