If you find a security issue, do not open a public issue. Instead:

• use GitHub's Security → Report a vulnerability (private advisory), or
• email talkdedsec@proton.me.

Please include the affected version/commit, reproduction steps, and potential impact. You'll get a response within a reasonable time; please keep details private until a fix is released.

tlk-hex is a static analysis tool and never executes the file it inspects, but you should still examine untrusted files in an isolated environment.