The openconnect component was only reviewed about 10 years ago. A quick look into the code won't hurt.