Body： Lately we built a Chrome Extension called Ballloon, which enables people to save any files on webpages they need directly and quickly to Dropbox or Googledrive.To guarantee the users' account safety, we chose to go Https, while, what makes us uptight is that there's a huge and severe bug living with OpenSSL, Heartbleed. We are grateful to anyone answeres my questions below:
1. How does Heartbleed work?
2. What can we do to avoid Heartbleed bug?
3. Should extensions like Ballloon keep free from Heartbleed, if yes, how ?

Thanks

There are test sites available to see if your SSL/tls certificate has been affected. If it has, buy yourself a new certificate that was created with a patched openssl