Has GAE ever used OpenSSL for its frontend servers? It’s quite interesting in the context of the Heartbleed security hole. It would be nice to get a confirmation from Google that no risks are present.
As already mentioned in the comment according to the Google Online Security Blog App Engine was affected.
A patch has been written and I assume applied to the Google services on March 21st, long before the vulnerability became public.
Assuming nobody knew about this bug before March 21st no further steps are necessary. Since you can't be entirely sure the best way to ensure a secure service is to follow this checklist.
- Re-issue new SSL certificates for your domains (find a guide here)
- Change your passwords and revoke existing sessions
- Revoke and recreate access tokens
There is more good news. App Engine supports Forward Secrecy. This feature mitigates attacks by making it impossible to use a stolen encryption key to read old encrypted communication.