Bug-free is a bit strong, since you can only use a dependent type-theory like HoTT to establish that a program meets its specification, but the specification might be buggy.