Evaluating and Implementing Custom WordPress Code

Where to put custom WordPress code, make sure it works and is secure. Do you use functions.php or a plugin for custom WordPress code?