Lots of people have looked at the spiped source code; it has been around since 2011 and I've even handed out a few bug bounties.

It's also considerably simpler than wireguard, which reduces the potential for vulnerabilities; and operates on a per-connection basis, which means you can do things like establishing a secure connection to another host but have a socket endpoint which can only be accessed by certain users.