This code is as simple as the project owners say it is, but a couple things about it that I wish were different:

* The "nacltai" protocol driver uses C VLAs to store attacker-controlled numbers of bytes; a VLA is morally the same as an "alloca" call. I have no clue if this is exploitable but reading it gives me a painful burning itching sensation.

* I sort of wish the authors didn't parse strings to recover crypto parameters from the packets, but instead just used a straightforward binary encoding that would require less use of C's terrible string functions.

I'm still a lot more comfortable with this codebase than with OpenVPN. :)