With closed source you cannot do much besides trusting the vendor.
But I think this is not so much a discussion about open or closed source as OpenSSL is open source and the the bug was not discovered for years - so this is no guarantee at all.
Specifically for heartbleed you can i.e. deactivate the heartbeat functionality in OpenSSL which makes the attack impossible to happen.
In the wild I've seen companies, where I know that their servers where vulnerable, catching the heartbeat packages on the firewall/IDP level and making the attack impossible as no heartbleed packet was able to reach the server until they were able to patch the servers.