As you may have heard, reddit quickly patched its SSL endpoints against server attack of the infamous heartbleed vulnerability. However, the heartbleed vulnerability has been around for quite some time, and up until it was publicly disclosed reddit's SSL endpoints were vulnerable.
Additionally, our application was found to have a client-side vulnerability to heartbleed which allowed memory to be leaked to external servers. We quickly addressed this after it was reported to us. Exploiting this vulnerability required the use of a specific API call on reddit, and we have analyzed our logs and found nothing to suggest that this API call was being exploited en masse. However, the vulnerability did exist.
Given these two circumstances, it is recommended that you change your reddit password as a precaution. Updating your password will log you out of all other reddit.com sessions. We also recommend that you make use of a unique, strong password on any site you use. The most common way accounts on reddit get broken into is by attackers exploiting password reuse.
Stay safe out there.
Edit: A few people indicated that they had changed their passwords recently and wanted to know if they're now safe. We addressed the server issue hours after it was disclosed on April 7th. The client-side leak was disclosed and addressed on April 9th. Our old certs were revoked by the 9th (all dates in PDT). If you have changed your password since April 9th, you're AOK.