So far, I have not heard anyone who has found any security holes and I'm active in the #WireGuard IRC channel with 300+ users, where many have looked at the code. There may be some unscrupulous hacker who has reviewed the code and found something but choose not to publish it, but it may also apply to WireGuard's source code.

A security hole in WireGuard's wg-quick that many use to establish the connection is that it allows the .conf file to download and execute programs without asking the user, and this feature is enabled by default.

This is basically a good feature and allows admins to run custom software as soon as the connection has been established.

However, it allows an evil (or NSA-hooked) VPN provider to issue .conf files to infect the user's computer with malicious code because users of VPN services rarely review the .conf files.

TunSafe has the same feature but it is disabled by default and requires Admin privileges to enable it.

I like that TunSafe seems to have more restrictive security settings as default, though it may not be appreciated by hardcore users.