I also discovered XMPP recently. I’ve been evaluating my options for private and secure messaging and it’s at the top of my list along with Signal. I wouldn’t use a public server, personally. You should host it yourself or join one that someone you trust is hosting. Server admins are privy to a lot of metadata. I’m on the fence right now but with the IETF actively working on MLS and MIMI, I am not sure if XMPP will live on. By all means play around with it and let us know how it goes!

Do you think address or thread sanitizer would have been able to catch this? It sounds like it would.