Google’s push to ferret out security holes in external products has been expanded to include the OpenVPN and Apache https, two of the most widely deployed open-source programs.