I'm not sure if I'm searching right as there are a lot of methods named the same thing in this codebase, but I see these uses:

src/rhsm/certificate.py:        products = rhns.find('1.*.1', 1)
src/rhsm/certificate.py:        order = rhns.find('4.1', 1)
src/rhsm/certificate.py:        ext = self.find(oid, 1)

Not sure if these are safe but switching off to get that bug so hopefully someone else can look. Honestly if we can see autosub working ok with this code deployed we're probably ok.