download_client_game_speed_limiter.json stores download-client remote-control credentials in plain text on the local machine.

Recommendations:

• Use localhost-only remote control and built-in authentication bypass options when possible.
• Do not commit your personal config file.
• Do not share logs if they contain private paths or usernames.
• Rotate exposed downloader passwords or remote-control tokens.

For vulnerability reports, open a private security advisory on GitHub if available, or create an issue without including secrets.