It is hard to see any security issues in the client. It downloads data, not code. Results data are returned. The only client-side issues that I could think of would be an unchecked buffer overrun. Most of the client is open-source, you can get the goodies
here and check for yourself.
They are holding back the network socket code, and the local file access code. Details are listed on the linked page.