I am not sure you can put down a real number, but the developers are in concert with power users, and they are well aware of when something is fishy and they pa

I am not sure you can put down a real number, but the developers are in concert with power users, and they are well aware of when something is fishy and they patch quickly, specifically for the very well-known state actors that Tor irks (e.g., China and Iran). See one such recent example: https://blog.torproject.org/blog/iran-blocks-tor-tor-releases-same-day-fix https://blog.torproject.org/blog/iran-blocks-tor-tor-release... And yes, I know this supposes it is an obvious attack vector, and this is not really disastrous; they got blocked. I encourage you to read the Tor Project blog. They did, for example, an excellent writeup of how BEAST was not impacting them, and did a very detailed layman's article on how, even if their implementation did not pad TLS the way it did, would still not be exploitable with the BEAST exploit. https://blog.torproject.org/blog/tor-and-beast-ssl-attack https://blog.torproject.org/blog/tor-and-beast-ssl-attack There are a lot of eyeballs, and all the usual cathedral and bazaar quotes will tell you I trust their implementations, despite its dubious origin with a Naval Postgraduate School thesis, than other systems that are not open source.