Core of Light downloads the games' setups from their GitHub releases and runs them, and the games read files from your disc and your figure folder. If you find a way any of that could be abused (a download that isn't checked well enough, a file that can make a game or the launcher run something it shouldn't, personal data in a report or a log), please don't open a public issue.

Use GitHub's private reporting: in the repository, Security > Report a vulnerability. Only the owner sees it. Say what you found, how to reproduce it, and which version.

You'll get an answer within a few days. A fix goes into the next release, and the report is credited if you like.

Only the newest release of each project gets fixes. Core of Light updates the games by itself, so that's usually what you have.