Yeah, as it happens in software in general there aren't any guarantees. I could too give you a link to heartbleed. Caddy wasn't affected.

Well, yes, although security and stability are different matters. Every software has bugs, I just said that the fact something is using Go HTTP library doesn't automagically mean it's production quality. There are always many ways to accidentally shot oneself in the leg.

(Caddy, in my experience is production quality. I've used it in a few projects and haven't had any serious issues. Maybe that's just my use cases, though.)

Stability is relative. Knowing that it uses standard Go networking libs is an indication of how stable this thing is.