“VPN servers accept remote logins from administrators, who technically have the ability to tap into production users’ VPN traffic”
Radically Open Security found 1 high, 6 elevated, 4 moderate and 10 low severity issues on two Mullvad relays. Low-privileged accounts got root through systemd timer scripts. Mullvad declined a source code review and a hardware review. A no-logs promise is only as good as the admins with SSH, and Mullvad admits it has known that for some time.