content: The key is to make sure your VPN doesn't need unnecessary permissions. The ability of the BIND_VPN_SERVICE permission to break Android's sandboxing  is important too. Good luck in your hunt post what you find!