Is the server side open-source too, as gruez brought up in the sibling comment?

Technically they can still do potentially any- and everything undetected there; and for what it’s worth, even with a closed-source client bad behavior would get detected eventually through network inspection.