aws-lc-sys 0.47.0

Source: https://github.com/aws/aws-lc-rs
Artifact scanned: aws-lc-sys-0.47.0.crate (crate · 9.3 MB · SHA-256 8bfbe32ac36b…)
Compared with: aws-lc-sys-0.46.0.crate (0 signals introduced since)
Files: 943 scanned, 1147 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 125 warn · 122 info
Scan time: 70.8 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): the 100 most severe of 225 warn and critical signals (100 with a verdict); 100 demoted to info. The rest are unreviewed.
Disclude version: 4.3.0
Scanned (UTC): 2026-11-01 09:43

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

warn encoding-base64 aws-lc/crypto/x509/x509_compat_test.cc:1611:1

base64-like blob (832 bytes over 13 lines, compression ratio 0.73) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_compat_test.cc:1672:1

base64-like blob (836 bytes over 14 lines, compression ratio 0.74) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_compat_test.cc:1917:1

base64-like blob (924 bytes over 15 lines, compression ratio 0.71) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:80:1

base64-like blob (660 bytes over 11 lines, compression ratio 0.72) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:96:1

base64-like blob (616 bytes over 10 lines, compression ratio 0.70) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:111:1

base64-like blob (692 bytes over 11 lines, compression ratio 0.76) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:129:1

base64-like blob (840 bytes over 14 lines, compression ratio 0.70) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:148:1

base64-like blob (804 bytes over 13 lines, compression ratio 0.77) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:166:1

base64-like blob (820 bytes over 13 lines, compression ratio 0.74) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:184:1

base64-like blob (816 bytes over 13 lines, compression ratio 0.76) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:202:1

base64-like blob (824 bytes over 13 lines, compression ratio 0.70) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:220:1

base64-like blob (816 bytes over 13 lines, compression ratio 0.75) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:238:1

base64-like blob (760 bytes over 12 lines, compression ratio 0.74) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:255:1

base64-like blob (828 bytes over 13 lines, compression ratio 0.77) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:275:1

base64-like blob (820 bytes over 13 lines, compression ratio 0.73) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:296:1

base64-like blob (1196 bytes over 19 lines, compression ratio 0.72) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:321:1

base64-like blob (1188 bytes over 19 lines, compression ratio 0.74) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:373:1

base64-like blob (1060 bytes over 17 lines, compression ratio 0.76) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:395:1

base64-like blob (816 bytes over 13 lines, compression ratio 0.80) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:413:1

base64-like blob (184 bytes over 3 lines, compression ratio 0.90) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:422:1

base64-like blob (1592 bytes over 25 lines, compression ratio 0.77) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:452:1

base64-like blob (1180 bytes over 19 lines, compression ratio 0.75) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:476:1

base64-like blob (1224 bytes over 20 lines, compression ratio 0.76) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:501:1

base64-like blob (572 bytes over 9 lines, compression ratio 0.77) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:515:1

base64-like blob (656 bytes over 11 lines, compression ratio 0.74) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:531:1

base64-like blob (608 bytes over 10 lines, compression ratio 0.77) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:548:1

base64-like blob (592 bytes over 10 lines, compression ratio 0.78) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:564:1

base64-like blob (600 bytes over 10 lines, compression ratio 0.77) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:581:1

base64-like blob (620 bytes over 10 lines, compression ratio 0.77) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:598:1

base64-like blob (596 bytes over 10 lines, compression ratio 0.79) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:616:1

base64-like blob (572 bytes over 9 lines, compression ratio 0.78) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:633:1

base64-like blob (572 bytes over 9 lines, compression ratio 0.78) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:648:1

base64-like blob (540 bytes over 9 lines, compression ratio 0.74) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:664:1

base64-like blob (548 bytes over 9 lines, compression ratio 0.74) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:680:1

base64-like blob (408 bytes over 7 lines, compression ratio 0.82) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:694:1

base64-like blob (7364 bytes over 116 lines, compression ratio 0.76) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:817:1

base64-like blob (7364 bytes over 116 lines, compression ratio 0.76) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:940:1

base64-like blob (7368 bytes over 116 lines, compression ratio 0.76) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:1065:1

base64-like blob (892 bytes over 14 lines, compression ratio 0.73) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:1100:1

base64-like blob (792 bytes over 13 lines, compression ratio 0.76) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:1213:1

base64-like blob (576 bytes over 9 lines, compression ratio 0.77) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:1227:1

base64-like blob (456 bytes over 8 lines, compression ratio 0.80) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:1242:1

base64-like blob (592 bytes over 10 lines, compression ratio 0.79) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:1257:1

base64-like blob (472 bytes over 8 lines, compression ratio 0.77) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:1270:1

base64-like blob (1780 bytes over 28 lines, compression ratio 0.73) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:1306:1

base64-like blob (640 bytes over 10 lines, compression ratio 0.77) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:1323:1

base64-like blob (588 bytes over 10 lines, compression ratio 0.79) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:1341:1

base64-like blob (600 bytes over 10 lines, compression ratio 0.77) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:1359:1

base64-like blob (584 bytes over 10 lines, compression ratio 0.78) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:1402:1

base64-like blob (588 bytes over 10 lines, compression ratio 0.78) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:1417:1

base64-like blob (588 bytes over 10 lines, compression ratio 0.76) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:1432:1

base64-like blob (584 bytes over 10 lines, compression ratio 0.78) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:1447:1

base64-like blob (600 bytes over 10 lines, compression ratio 0.78) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:1462:1

base64-like blob (580 bytes over 10 lines, compression ratio 0.78) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:1477:1

base64-like blob (556 bytes over 9 lines, compression ratio 0.79) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:3803:1

base64-like blob (800 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:5281:1

base64-like blob (516 bytes over 9 lines, compression ratio 0.76) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:5296:1

base64-like blob (516 bytes over 9 lines, compression ratio 0.77) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:5312:1

base64-like blob (516 bytes over 9 lines, compression ratio 0.77) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:5328:1

base64-like blob (560 bytes over 9 lines, compression ratio 0.71) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:5343:1

base64-like blob (616 bytes over 10 lines, compression ratio 0.73) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:5359:1

base64-like blob (624 bytes over 10 lines, compression ratio 0.73) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:5375:1

base64-like blob (524 bytes over 9 lines, compression ratio 0.79) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:5390:1

base64-like blob (524 bytes over 9 lines, compression ratio 0.79) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:5405:1

base64-like blob (568 bytes over 9 lines, compression ratio 0.78) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:5421:1

base64-like blob (548 bytes over 9 lines, compression ratio 0.80) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:5436:1

base64-like blob (572 bytes over 9 lines, compression ratio 0.78) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:5451:1

base64-like blob (272 bytes over 5 lines, compression ratio 0.85) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:5462:1

base64-like blob (272 bytes over 5 lines, compression ratio 0.85) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:5568:1

base64-like blob (392 bytes over 7 lines, compression ratio 0.76) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:5579:1

base64-like blob (396 bytes over 7 lines, compression ratio 0.77) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:5590:1

base64-like blob (412 bytes over 7 lines, compression ratio 0.73) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:5601:1

base64-like blob (468 bytes over 8 lines, compression ratio 0.78) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:5613:1

base64-like blob (476 bytes over 8 lines, compression ratio 0.76) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:5625:1

base64-like blob (492 bytes over 8 lines, compression ratio 0.78) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:5638:1

base64-like blob (244 bytes over 4 lines, compression ratio 0.88) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:6567:1

base64-like blob (396 bytes over 7 lines, compression ratio 0.75) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:6581:1

base64-like blob (396 bytes over 7 lines, compression ratio 0.76) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:6595:1

base64-like blob (392 bytes over 7 lines, compression ratio 0.76) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:6609:1

base64-like blob (624 bytes over 10 lines, compression ratio 0.73) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:6626:1

base64-like blob (392 bytes over 7 lines, compression ratio 0.76) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:7387:1

base64-like blob (804 bytes over 13 lines, compression ratio 0.75) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:7418:1

base64-like blob (1208 bytes over 19 lines, compression ratio 0.76) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/crypto/x509/x509_test.cc:7454:1

base64-like blob (824 bytes over 13 lines, compression ratio 0.74) (raw pass, confidence 0.60)

warn embedded-nul-in-string aws-lc/crypto/x509/x509_test.cc:8918:47

string literal contains an embedded NUL followed by 5 more bytes of source (token pass, confidence 0.85)

      {CBS_ASN1_IA5STRING, "abc", V_ASN1_IA5STRING, "abc"},
      {CBS_ASN1_UNIVERSALSTRING, std::string("\0\0\0a", 4),
       V_ASN1_UNIVERSALSTRING, std::string("\0\0\0a", 4)},
      {CBS_ASN1_BMPSTRING, std::string("\0a", 2), V_ASN1_BMPSTRING,

warn embedded-nul-in-string aws-lc/crypto/x509/x509_test.cc:8919:45

string literal contains an embedded NUL followed by 5 more bytes of source (token pass, confidence 0.85)

      {CBS_ASN1_UNIVERSALSTRING, std::string("\0\0\0a", 4),
       V_ASN1_UNIVERSALSTRING, std::string("\0\0\0a", 4)},
      {CBS_ASN1_BMPSTRING, std::string("\0a", 2), V_ASN1_BMPSTRING,
       std::string("\0a", 2)},

warn embedded-nul-in-string aws-lc/crypto/x509/x509_test.cc:8920:41

string literal contains an embedded NUL followed by 1 more bytes of source (token pass, confidence 0.85)

       V_ASN1_UNIVERSALSTRING, std::string("\0\0\0a", 4)},
      {CBS_ASN1_BMPSTRING, std::string("\0a", 2), V_ASN1_BMPSTRING,
       std::string("\0a", 2)},

warn embedded-nul-in-string aws-lc/crypto/x509/x509_test.cc:8921:21

string literal contains an embedded NUL followed by 1 more bytes of source (token pass, confidence 0.85)

      {CBS_ASN1_BMPSTRING, std::string("\0a", 2), V_ASN1_BMPSTRING,
       std::string("\0a", 2)},

      // ENUMERATED is supported but, currently, INTEGER is not.

warn embedded-nul-in-string aws-lc/crypto/x509/x509_test.cc:9072:15

string literal contains an embedded NUL followed by 1 more bytes of source (token pass, confidence 0.85)
```
      {
          "der\0p",
          V_ASN1_TELETEXSTRING,
          5,
```

warn identifier-confusable-collision aws-lc/include/openssl/x509.h:3386:60

two identifiers collapse to visual skeleton `arg|` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)

OPENSSL_EXPORT int X509_LOOKUP_ctrl(X509_LOOKUP *lookup, int cmd,
                                    const char *argc, long argl, char **ret);

// X509_load_cert_file loads trusted certificates from |file| and adds them to

warn encoding-base64 aws-lc/ssl/ssl_common_test.cc:82:1

base64-like blob (444 bytes over 7 lines, compression ratio 0.76) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/ssl/ssl_common_test.cc:98:1

base64-like blob (184 bytes over 3 lines, compression ratio 0.92) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/ssl/ssl_common_test.cc:110:1

base64-like blob (488 bytes over 8 lines, compression ratio 0.79) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/ssl/ssl_common_test.cc:127:1

base64-like blob (488 bytes over 8 lines, compression ratio 0.79) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/ssl/ssl_common_test.cc:144:8

7 rows of base64-like lines, lines 144-150 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)

      "-----BEGIN CERTIFICATE-----\n"
      "MIIBRDCB9wIUKI+32tShPulvafJa3xZvj29Z9xgwBQYDK2VwMEUxCzAJBgNVBAYT\n"
      "AkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRn\n"
      "aXRzIFB0eSBMdGQwHhcNMjMwNzE4MTg0NzU4WhcNMjMwNzE5MTg0NzU4WjBFMQsw\n"

warn encoding-base64 aws-lc/ssl/ssl_common_test.cc:158:8

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      "-----BEGIN PRIVATE KEY-----\n"
      "MC4CAQAwBQYDK2VwBCIEIGPkz4xAobc5gtRidkHl+fxNLHfiWo3efRG2G8Z617yk\n"
      "-----END PRIVATE KEY-----\n";
  return KeyFromPEM(kKeyPEM);

warn encoding-base64 aws-lc/ssl/ssl_common_test.cc:375:8

13 rows of base64-like lines, lines 375-387 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)

      "-----BEGIN CERTIFICATE-----\n"
      "MIICWDCCAcGgAwIBAgIJAPuwTC6rEJsMMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNV\n"
      "BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX\n"
      "aWRnaXRzIFB0eSBMdGQwHhcNMTQwNDIzMjA1MDQwWhcNMTcwNDIyMjA1MDQwWjBF\n"

warn encoding-base64 aws-lc/ssl/ssl_common_test.cc:395:8

13 rows of base64-like lines, lines 395-407 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)

      "-----BEGIN RSA PRIVATE KEY-----\n"
      "MIICXgIBAAKBgQDYK8imMuRi/03z0K1Zi0WnvfFHvwlYeyK9Na6XJYaUoIDAtB92\n"
      "kWdGMdAQhLciHnAjkXLI6W15OoV3gA/ElRZ1xUpxTMhjP6PyY5wqT5r6y8FxbiiF\n"
      "KKAnHmUcrgfVW28tQ+0rkLGMryRtrukXOgXBv7gcrmU7G1jC2a7WqmeI8QIDAQAB\n"

warn encoding-base64 aws-lc/ssl/ssl_common_test.cc:434:8

15 rows of base64-like lines, lines 434-448 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)

      "-----BEGIN CERTIFICATE-----\n"
      "MIIC0jCCAbqgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwDzENMAsGA1UEAwwEQiBD\n"
      "QTAeFw0xNjAyMjgyMDI3MDNaFw0yNjAyMjUyMDI3MDNaMBgxFjAUBgNVBAMMDUNs\n"
      "aWVudCBDZXJ0IEEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDRvaz8\n"

warn encoding-base64 aws-lc/ssl/ssl_common_test.cc:458:8

24 rows of base64-like lines, lines 458-481 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)

      "MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDRvaz8CC/cshpC\n"
      "afJo4jLkHEoBqDLhdgFelJoAiQUyIqyWl2O7YHPnpJH+TgR7oelzNzt/kLRcH89M\n"
      "/TszB6zqyLTC4aqmvzKL0peD/jL2LWBucR0WXIvjA3zoRuF/x86+rYH3tHb+xs2P\n"
      "Ss8EGL/Ev+ss+qTzTGEn26fuGNHkNw6tOwPpc+o8+wUtzf/kAthamo+cIDs2rQ+l\n"

warn encoding-base64 aws-lc/ssl/ssl_common_test.cc:507:8

15 rows of base64-like lines, lines 507-521 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)

      "-----BEGIN CERTIFICATE-----\n"
      "MIICwjCCAaqgAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwFDESMBAGA1UEAwwJQyBS\n"
      "b290IENBMB4XDTE2MDIyODIwMjcwM1oXDTI2MDIyNTIwMjcwM1owDzENMAsGA1UE\n"
      "AwwEQiBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALsSCYmDip2D\n"

warn encoding-base64 aws-lc/ssl/ssl_common_test.cc:529:8

10 rows of base64-like lines, lines 529-538 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)

      "-----BEGIN CERTIFICATE-----\n"
      "MIIBzzCCAXagAwIBAgIJANlMBNpJfb/rMAkGByqGSM49BAEwRTELMAkGA1UEBhMC\n"
      "QVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdp\n"
      "dHMgUHR5IEx0ZDAeFw0xNDA0MjMyMzIxNTdaFw0xNDA1MjMyMzIxNTdaMEUxCzAJ\n"

warn encoding-base64 aws-lc/ssl/ssl_common_test.cc:546:8

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      "-----BEGIN PRIVATE KEY-----\n"
      "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgBw8IcnrUoEqc3VnJ\n"
      "TYlodwi1b8ldMHcO6NHJzgqLtGqhRANCAATmK2niv2Wfl74vHg2UikzVl2u3qR4N\n"
      "Rvvdqakendy6WgHn1peoChj5w8SjHlbifINI2xYaHPUdfvGULUvPciLB\n"

warn encoding-base64 aws-lc/ssl/ssl_common_test.cc:547:8

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgBw8IcnrUoEqc3VnJ\n"
      "TYlodwi1b8ldMHcO6NHJzgqLtGqhRANCAATmK2niv2Wfl74vHg2UikzVl2u3qR4N\n"
      "Rvvdqakendy6WgHn1peoChj5w8SjHlbifINI2xYaHPUdfvGULUvPciLB\n"
      "-----END PRIVATE KEY-----\n";

warn encoding-base64 aws-lc/ssl/ssl_common_test.cc:696:1

base64-like blob (5324 bytes over 84 lines, compression ratio 0.76) (raw pass, confidence 0.60)

  static const char kCertPEM[] = R"(-----BEGIN CERTIFICATE-----
MIIPlDCCBgqgAwIBAgIUFZ/+byL9XMQsUk32/V4o0N44804wCwYJYIZIAWUDBAMR
MCIxDTALBgNVBAoTBElFVEYxETAPBgNVBAMTCExBTVBTIFdHMB4XDTIwMDIwMzA0
MzIxMFoXDTQwMDEyOTA0MzIxMFowIjENMAsGA1UEChMESUVURjERMA8GA1UEAxMI

warn encoding-base64 aws-lc/ssl/ssl_common_test.cc:787:1

base64-like blob (72 bytes over 2 lines, compression ratio 1.04) (raw pass, confidence 0.60)

  static const char kKeyPEM[] = R"(-----BEGIN PRIVATE KEY-----
MDQCAQAwCwYJYIZIAWUDBAMRBCKAIAABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZ
GhscHR4f
-----END PRIVATE KEY-----

warn encoding-base64 aws-lc/ssl/ssl_common_test.cc:796:1

base64-like blob (7364 bytes over 116 lines, compression ratio 0.76) (raw pass, confidence 0.60)

  static const char kCertPEM[] = R"(-----BEGIN CERTIFICATE-----
MIIVjTCCCIqgAwIBAgIUFZ/+byL9XMQsUk32/V4o0N44804wCwYJYIZIAWUDBAMS
MCIxDTALBgNVBAoTBElFVEYxETAPBgNVBAMTCExBTVBTIFdHMB4XDTIwMDIwMzA0
MzIxMFoXDTQwMDEyOTA0MzIxMFowIjENMAsGA1UEChMESUVURjERMA8GA1UEAxMI

warn encoding-base64 aws-lc/ssl/ssl_common_test.cc:919:1

base64-like blob (72 bytes over 2 lines, compression ratio 1.04) (raw pass, confidence 0.60)

  static const char kKeyPEM[] = R"(-----BEGIN PRIVATE KEY-----
MDQCAQAwCwYJYIZIAWUDBAMSBCKAIAABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZ
GhscHR4f
-----END PRIVATE KEY-----

warn encoding-base64 aws-lc/ssl/ssl_common_test.cc:928:1

base64-like blob (9972 bytes over 156 lines, compression ratio 0.76) (raw pass, confidence 0.60)

  static const char kCertPEM[] = R"(-----BEGIN CERTIFICATE-----
MIIdMzCCCwqgAwIBAgIUFZ/+byL9XMQsUk32/V4o0N44804wCwYJYIZIAWUDBAMT
MCIxDTALBgNVBAoTBElFVEYxETAPBgNVBAMTCExBTVBTIFdHMB4XDTIwMDIwMzA0
MzIxMFoXDTQwMDEyOTA0MzIxMFowIjENMAsGA1UEChMESUVURjERMA8GA1UEAxMI

warn encoding-base64 aws-lc/ssl/ssl_common_test.cc:1091:1

base64-like blob (72 bytes over 2 lines, compression ratio 1.04) (raw pass, confidence 0.60)

  static const char kKeyPEM[] = R"(-----BEGIN PRIVATE KEY-----
MDQCAQAwCwYJYIZIAWUDBAMTBCKAIAABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZ
GhscHR4f
-----END PRIVATE KEY-----

warn encoding-base64 aws-lc/ssl/ssl_encoding_test.cc:16:6

30 rows of base64-like lines, lines 16-45 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)

static const char kOpenSSLSession[] =
    "MIIFqgIBAQICAwMEAsAvBCAG5Q1ndq4Yfmbeo1zwLkNRKmCXGdNgWvGT3cskV0yQ"
    "kAQwJlrlzkAWBOWiLj/jJ76D7l+UXoizP2KI2C7I2FccqMmIfFmmkUy32nIJ0mZH"
    "IWoJoQYCBFRDO46iBAICASyjggR6MIIEdjCCA16gAwIBAgIIK9dUvsPWSlUwDQYJ"

warn encoding-base64 aws-lc/ssl/ssl_encoding_test.cc:52:6

7 rows of base64-like lines, lines 52-58 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)

static const char kCustomSession[] =
    "MIIBZAIBAQICAwMEAsAvBCAG5Q1ndq4Yfmbeo1zwLkNRKmCXGdNgWvGT3cskV0yQ"
    "kAQwJlrlzkAWBOWiLj/jJ76D7l+UXoizP2KI2C7I2FccqMmIfFmmkUy32nIJ0mZH"
    "IWoJoQYCBFRDO46iBAICASykAwQBAqUDAgEUqAcEBXdvcmxkqQUCAwGJwKqBpwSB"

warn encoding-base64 aws-lc/ssl/ssl_encoding_test.cc:63:6

95 rows of base64-like lines, lines 63-157 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)

static const char kBoringSSLSession[] =
    "MIIRwQIBAQICAwMEAsAvBCDdoGxGK26mR+8lM0uq6+k9xYuxPnwAjpcF9n0Yli9R"
    "kQQwbyshfWhdi5XQ1++7n2L1qqrcVlmHBPpr6yknT/u4pUrpQB5FZ7vqvNn8MdHf"
    "9rWgoQYCBFXgs7uiBAICHCCjggR6MIIEdjCCA16gAwIBAgIIf+yfD7Y6UicwDQYJ"

warn encoding-base64 aws-lc/ssl/ssl_encoding_test.cc:163:6

7 rows of base64-like lines, lines 163-169 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)

static const char kBadSessionExtraField[] =
    "MIIBdgIBAQICAwMEAsAvBCAG5Q1ndq4Yfmbeo1zwLkNRKmCXGdNgWvGT3cskV0yQ"
    "kAQwJlrlzkAWBOWiLj/jJ76D7l+UXoizP2KI2C7I2FccqMmIfFmmkUy32nIJ0mZH"
    "IWoJoQYCBFRDO46iBAICASykAwQBAqUDAgEUphAEDnd3dy5nb29nbGUuY29tqAcE"

warn encoding-base64 aws-lc/ssl/ssl_encoding_test.cc:175:6

7 rows of base64-like lines, lines 175-181 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)

static const char kBadSessionVersion[] =
    "MIIBdgIBAgICAwMEAsAvBCAG5Q1ndq4Yfmbeo1zwLkNRKmCXGdNgWvGT3cskV0yQ"
    "kAQwJlrlzkAWBOWiLj/jJ76D7l+UXoizP2KI2C7I2FccqMmIfFmmkUy32nIJ0mZH"
    "IWoJoQYCBFRDO46iBAICASykAwQBAqUDAgEUphAEDnd3dy5nb29nbGUuY29tqAcE"

warn encoding-base64 aws-lc/ssl/ssl_encoding_test.cc:187:6

7 rows of base64-like lines, lines 187-193 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)

static const char kBadSessionTrailingData[] =
    "MIIBdgIBAQICAwMEAsAvBCAG5Q1ndq4Yfmbeo1zwLkNRKmCXGdNgWvGT3cskV0yQ"
    "kAQwJlrlzkAWBOWiLj/jJ76D7l+UXoizP2KI2C7I2FccqMmIfFmmkUy32nIJ0mZH"
    "IWoJoQYCBFRDO46iBAICASykAwQBAqUDAgEUphAEDnd3dy5nb29nbGUuY29tqAcE"

warn embedded-nul-in-string aws-lc/ssl/ssl_handshake_test.cc:83:53

string literal contains an embedded NUL followed by 9 more bytes of source (token pass, confidence 0.85)

            SSL_select_next_proto(&result, &result_len,
                                  (const uint8_t *)"\0\2bb\3ccc", 8,
                                  (const uint8_t *)"\1a\2bb\3ccc", 9));
  EXPECT_EQ(OPENSSL_NPN_NO_OVERLAP,

warn embedded-nul-in-string aws-lc/ssl/ssl_handshake_test.cc:88:53

string literal contains an embedded NUL followed by 9 more bytes of source (token pass, confidence 0.85)

                                  (const uint8_t *)"\1a\2bb\3ccc", 9,
                                  (const uint8_t *)"\0\2bb\3ccc", 8));
  EXPECT_EQ(Bytes(""), Bytes(result, result_len));
}

warn encoding-base64 aws-lc/ssl/ssl_handshake_test.cc:977:1

base64-like blob (576 bytes over 9 lines, compression ratio 0.77) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/ssl/ssl_handshake_test.cc:993:1

base64-like blob (184 bytes over 3 lines, compression ratio 0.92) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/ssl/ssl_handshake_test.cc:1112:1

base64-like blob (624 bytes over 10 lines, compression ratio 0.73) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/ssl/ssl_handshake_test.cc:1133:1

base64-like blob (816 bytes over 13 lines, compression ratio 0.75) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/ssl/ssl_test.cc:2770:1

base64-like blob (664 bytes over 11 lines, compression ratio 0.72) (raw pass, confidence 0.60)

warn encoding-base64 aws-lc/ssl/ssl_test.cc:2785:1

base64-like blob (664 bytes over 11 lines, compression ratio 0.72) (raw pass, confidence 0.60)

warn embedded-nul-in-string aws-lc/tests/compiler_features_tests/memcmp_invalid_stripped_check.c:11:15

string literal contains an embedded NUL followed by 3 more bytes of source (token pass, confidence 0.85)

  // Below test case is equivalent to https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95189#c7
  char a[] = "\0abc";
  int res = memcmp(a, "\0\0\0\0", 4);
  printf("memcmp result %d\n", res);

info ~~warn~~ → info by review embedded-nul-in-string aws-lc/crypto/bio/bio_test.cc:532:41

string literal contains an embedded NUL followed by 5 more bytes of source (token pass, confidence 0.85)
```
  // Writes can include embedded NULs.
  ASSERT_EQ(BIO_write(bio.get(), "abcdef\0ghijk", 12), 12);
  check_bio_contents(Bytes("abcdef\0ghijk", 12));
  EXPECT_EQ(BIO_eof(bio.get()), 0);
```
likely benign LLM, confidence 0.95 Test string literal with an intentional embedded NUL passed to BIO_write.
Reasoning
The NUL is deliberate. The test comment says writes can include embedded NULs, and the byte count (12) matches the literal's full length. This is a standard test of BIO binary handling.
info ~~warn~~ → info by review embedded-nul-in-string aws-lc/crypto/bio/bio_test.cc:533:35

string literal contains an embedded NUL followed by 5 more bytes of source (token pass, confidence 0.85)
```
  ASSERT_EQ(BIO_write(bio.get(), "abcdef\0ghijk", 12), 12);
  check_bio_contents(Bytes("abcdef\0ghijk", 12));
  EXPECT_EQ(BIO_eof(bio.get()), 0);
```
likely benign LLM, confidence 0.95 Test literal with an embedded NUL used as expected BIO contents.
Reasoning
Same test as the neighbouring finding: the embedded NUL is intentional and the explicit length argument (12) makes the NUL part of the expected data. Nothing here is string-construction obfuscation.
info ~~warn~~ → info by review embedded-nul-in-string aws-lc/crypto/bio/bio_test.cc:540:31

string literal contains an embedded NUL followed by 5 more bytes of source (token pass, confidence 0.85)
```
  EXPECT_EQ(Bytes(buf, ret), Bytes("abcd"));
  check_bio_contents(Bytes("ef\0ghijk", 8));
  EXPECT_EQ(BIO_eof(bio.get()), 0);
```
likely benign LLM, confidence 0.95 Test expectation literal containing an embedded NUL for BIO reads.
Reasoning
The NUL is part of the expected-output test data, paired with explicit byte lengths. This is ordinary test-vector construction in a crypto library's BIO tests.
info ~~warn~~ → info by review embedded-nul-in-string aws-lc/crypto/bio/bio_test.cc:545:31

string literal contains an embedded NUL followed by 13 more bytes of source (token pass, confidence 0.85)
```
  ASSERT_EQ(BIO_write(bio.get(), "\nlmnopq", 7), 7);
  check_bio_contents(Bytes("ef\0ghijk\nlmnopq", 15));
  EXPECT_EQ(BIO_eof(bio.get()), 0);
```
likely benign LLM, confidence 0.95 Test literal with an embedded NUL used in BIO content checks.
Reasoning
The embedded NUL is intentional test data, matched against an explicit length of 15. The surrounding code is a set of BIO read/write assertions.
info ~~warn~~ → info by review embedded-nul-in-string aws-lc/crypto/bio/bio_test.cc:551:39

string literal contains an embedded NUL followed by 1 more bytes of source (token pass, confidence 0.85)
```
  ASSERT_GT(ret, 0);
  EXPECT_EQ(Bytes(buf, ret), Bytes("ef\0g", 4));
  check_bio_contents(Bytes("hijk\nlmnopq"));
  EXPECT_EQ(BIO_eof(bio.get()), 0);
```
likely benign LLM, confidence 0.95 Expected-output literal with an embedded NUL in a BIO read test.
Reasoning
The literal is an expected-value buffer in a BIO test, and the length argument makes the NUL explicit. Not an obfuscation pattern.
info ~~warn~~ → info by review embedded-nul-in-string aws-lc/crypto/bio/bio_test.cc:685:24

string literal contains an embedded NUL followed by 8 more bytes of source (token pass, confidence 0.85)
```
      // NUL bytes do not terminate gets.
      {std::string("abc\0def\nghi", 11), 256, std::string("abc\0def\n", 8)},

      // An output size of one means we cannot read any bytes. Only the trailing
```
likely benign LLM, confidence 0.96 Table test case with an embedded NUL for BIO gets behaviour.
Reasoning
The comment 'NUL bytes do not terminate gets' shows this is a table of gets test cases checking NUL handling. The std::string constructor with explicit length is correct and intended.
info ~~warn~~ → info by review embedded-nul-in-string aws-lc/crypto/bio/bio_test.cc:685:63

string literal contains an embedded NUL followed by 5 more bytes of source (token pass, confidence 0.85)
```
      // NUL bytes do not terminate gets.
      {std::string("abc\0def\nghi", 11), 256, std::string("abc\0def\n", 8)},

      // An output size of one means we cannot read any bytes. Only the trailing
```
likely benign LLM, confidence 0.96 Expected-output string with an embedded NUL in the BIO gets test table.
Reasoning
Same gets test table as the neighbouring finding. The NUL is an intentional input and expected-output value, not a hidden payload.
info identifier-low-length aws-lc/crypto/decrepit/ripemd/ripemd.c:1:1

909 of 1691 non-conventional identifiers are single-character (54%) (token pass, confidence 0.50)
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/dh_extra/dh_test.cc:1228:6

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
    "-----BEGIN DH PARAMETERS-----\n"
    "MEYCQQDqvLe5oX3p+Dw8T7NWG7nlWVFK58Ev74xvxYH72DC4kqfPEFPvNnCpFoRB\n"
    "RdxOz7DZ6JO/GxobSRyAAI766+GDAgEC\n"
    "-----END DH PARAMETERS-----";
```
likely benign LLM, confidence 0.97 PEM-armoured DH parameters used as a test fixture.
Reasoning
This is a PEM-encoded DH parameter test vector: the BEGIN/END armour and base64 body are the standard format. The base64 finding reflects the expected encoding of a key-format fixture.
info ~~warn~~ → info by review encoding-escape-soup aws-lc/crypto/digest_extra/digest_test.cc:186:17

144 consecutive `\xNN` escapes (entropy 6.6 bits/byte) (raw pass, confidence 0.80)
```
    {sha3_224, "\xe6\x5d\xe9\x1f\xdc\xb7\x60\x6f\x14\xdb\xcf\xc9\x4c\x9c\x94\xa5\x72\x40\xa6\xb2\xc3\x1e\xd4\x10\x34\x6c\x4d\xc0\x11\x52\x65\x59\xe4\x42\x96\xfc\x98\x8c\xc5\x89\xde\x2d\xc7\x13\xd0\xe8\x24\x92\xd4\x99\x1b\xd8\xc4\xc5\xe6\xc7\x4c\x75\x3f\xc0\x93\x45\x22\x5e\x1d\xb8\xd5\x65\xf0\xce\x26\xf5\xf5\xd9\xf4\x04
```
likely benign LLM, confidence 0.97 SHA3 known-answer test vector stored as \x escapes.
Reasoning
This is a SHA3-224 known-answer test vector written as a byte-escape string. Long hex-escape runs are the normal format for digest test data and carry no executable content.
info ~~warn~~ → info by review encoding-escape-soup aws-lc/crypto/digest_extra/digest_test.cc:200:17

136 consecutive `\xNN` escapes (entropy 6.5 bits/byte) (raw pass, confidence 0.80)
```
    {sha3_256, "\x56\xea\x14\xd7\xfc\xb0\xdb\x74\x8f\xf6\x49\xaa\xa5\xd0\xaf\xdc\x23\x57\x52\x8a\x9a\xad\x60\x76\xd7\x3b\x28\x05\xb5\x3d\x89\xe7\x36\x81\xab\xfa\xd2\x6b\xee\x6c\x0f\x3d\x20\x21\x52\x95\xf3\x54\xf5\x38\xae\x80\x99\x0d\x22\x81\xbe\x6d\xe0\xf6\x91\x9a\xa9\xeb\x04\x8c\x26\xb5\x24\xf4\xd9\x1c\xa8\x7b\x54\xc0
```
likely benign LLM, confidence 0.97 SHA3-256 known-answer test vector stored as \x escapes.
Reasoning
A SHA3-256 known-answer test vector in escape form, in the same table as the other digest vectors. Expected test data, not obfuscation.
info ~~warn~~ → info by review encoding-escape-soup aws-lc/crypto/digest_extra/digest_test.cc:214:17

104 consecutive `\xNN` escapes (entropy 6.4 bits/byte) (raw pass, confidence 0.80)
```
    {sha3_384, "\x92\xc4\x1d\x34\xbd\x24\x9c\x18\x2a\xd4\xe1\x8e\x3b\x85\x67\x70\x76\x6f\x17\x57\x20\x96\x75\x02\x0d\x4c\x1c\xf7\xb6\xf7\x68\x6c\x8c\x14\x72\x67\x8c\x7c\x41\x25\x14\xe6\x3e\xb9\xf5\xae\xe9\xf5\xc9\xd5\xcb\x8d\x87\x48\xab\x7a\x54\x65\x05\x9d\x9c\xbb\xb8\xa5\x62\x11\xff\x32\xd4\xaa\xa2\x3a\x23\xc8\x6e\xad
```
likely benign LLM, confidence 0.97 SHA3-384 known-answer test vector stored as \x escapes.
Reasoning
A SHA3-384 known-answer digest vector in a test table. High-entropy output values are expected for hash test data.
info ~~warn~~ → info by review encoding-escape-soup aws-lc/crypto/digest_extra/digest_test.cc:227:17

72 consecutive `\xNN` escapes (entropy 5.8 bits/byte) (raw pass, confidence 0.80)
```
    {sha3_512, "\x0c\xe9\xf8\xc3\xa9\x90\xc2\x68\xf3\x4e\xfd\x9b\xef\xdb\x0f\x7c\x4e\xf8\x46\x6c\xfd\xb0\x11\x71\xf8\xde\x70\xdc\x5f\xef\xa9\x2a\xcb\xe9\x3d\x29\xe2\xac\x1a\x5c\x29\x79\x12\x9f\x1a\xb0\x8c\x0e\x77\xde\x79\x24\xdd\xf6\x8a\x20\x9c\xdf\xa0\xad\xc6\x2f\x85\xc1\x86\x37\xd9\xc6\xb3\x3f\x4f\xf8",
```
likely benign LLM, confidence 0.97 SHA3-512 known-answer test vector stored as \x escapes.
Reasoning
A SHA3-512 known-answer digest vector in the test table. The escape-soup and entropy readings come from the random-looking hash bytes, not from any hidden code.
info ~~warn~~ → info by review encoding-hex aws-lc/crypto/digest_extra/digest_test.cc:243:17

5 rows of escape runs, lines 243-247 (first: 16 consecutive `\xNN` escapes (entropy 3.9 bits/byte)) (raw pass, confidence 0.65)
```
    {shake128, "\x84\xe9\x50\x05\x18\x76\x05\x0d\xc8\x51\xfb\xd9\x9e\x62\x47\xb8", 16, "8599bd89f63a848c49ca593ec37a12c6"},
    {shake128, "\xf1\x67\x51\x1e\xc8\x86\x49\x79\x30\x22\x37\xab\xea\x4c\xf7\xef", 17, "20f8938daa54b260860a104f8556278bac"},
```
likely benign LLM, confidence 0.95 SHAKE128 test vectors written as hex escape byte strings in a digest unit test.
Reasoning
These are known-answer test vectors for SHAKE128 digests written as C byte-string escapes. Hex escape runs of random-looking bytes are the normal way to encode binary test inputs in a crypto test file.
info ~~warn~~ → info by review encoding-escape-soup aws-lc/crypto/digest_extra/digest_test.cc:253:17

5 rows of escape runs, lines 253-257 (first: 32 consecutive `\xNN` escapes (entropy 4.9 bits/byte)) (raw pass, confidence 0.80)
```
    // NOTE: the |repeat| field in this struct denotes output length for XOF digests.
    {shake256, "\xdc\x88\x6d\xf3\xf6\x9c\x49\x51\x3d\xe3\x62\x7e\x94\x81\xdb\x58\x71\xe8\xee\x88\xeb\x9f\x99\x61\x15\x41\x93\x0a\x8b\xc8\x85\xe0", 16, "00648afbc5e651649db1fd82936b00db"},
```
likely benign LLM, confidence 0.95 SHAKE256 test vectors encoded as escaped bytes in a digest test file.
Reasoning
Same pattern as the other digest test: SHAKE256 known-answer vectors with explicit byte escapes, documented by the NOTE comment about output length. Standard cryptographic test data.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/dsa/dsa_test.cc:297:1

base64-like blob (132 bytes over 3 lines, compression ratio 1.02) (raw pass, confidence 0.60)
```
-----BEGIN DSA PRIVATE KEY-----
MGECAQACFQHH+MnFXh4NNlZiV/zUVb5a5ib3kwIVAOP8ZOKvDwabKzEr/moq3y1z
E3vJAhUAl/2Ylx9fWbzHdh1URsc/c6IM/TECAQECFCsjU4AZRcuks45g1NMOUeCB
Epvg
```
likely benign LLM, confidence 0.95 Embedded PEM DSA private key test fixture.
Reasoning
This is a PEM-encoded DSA private key used as a test fixture in a crypto library's test suite. Base64 bodies of keys are expected there.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/dsa/dsa_test.cc:318:1

base64-like blob (1136 bytes over 18 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
-----BEGIN DSA PRIVATE KEY-----
MIIDTgIBAAKCAQEAyH68EuravtF+7PTFBtWJkwjmp0YJmh8e2Cdpu8ci3dZf87rk
GwXzfqYkAEkW5H4Hp0cxdICKFiqfxjSaiEauOrNV+nXWZS634hZ9H47I8HnAVS0p
5MmSmPJ7NNUowymMpyB6M6hfqHl/1pZd7avbTmnzb2SZ0kw0WLWJo6vMekepYWv9
```
likely benign LLM, confidence 0.95 Embedded PEM DSA key test fixture of larger size.
Reasoning
A larger PEM DSA key block in a test file for the DSA implementation; ordinary test data for a crypto library.
info ~~warn~~ → info by review dynamic-import aws-lc/crypto/dynamic_loading_test.c:61:17

`dlopen` called with a non-literal path (ast pass, confidence 0.75)
```
  const char* path = ctx;
  void *lc_so = dlopen(path, RTLD_NOW);
  fp_lc_tl_func_t lc_tl_shutdown = dlsym(lc_so, "AWSLC_thread_local_shutdown");
```
likely benign LLM, confidence 0.85 dlopen with a path taken from a variable in a dynamic loading test.
Reasoning
The dlopen path comes from a context variable in a dynamic loading test that checks AWS-LC can be loaded as a shared object. Runtime-chosen library paths are expected here and the call is not obfuscated or hidden.
info ~~warn~~ → info by review implicit-int-function aws-lc/crypto/ec_extra/ec_brainpool.c:64:1

5 functions in this file lack an explicit return type (pre-ANSI K&R style; e.g. DEFINE_CURVE_DATA, DEFINE_CURVE_DATA, DEFINE_CURVE_DATA, DEFINE_CURVE_DATA, DEFINE_CURVE_DATA) (ast pass, confidence 0.85)
```
DEFINE_CURVE_DATA(EC_GROUP, EC_group_brainpoolP224r1) {
  out->curve_name = NID_brainpoolP224r1;
  out->comment = "brainpoolP224r1";
```
likely benign LLM, confidence 0.90 Macro-generated Brainpool curve definitions misdetected as implicit-int functions.
Reasoning
The flagged functions are macro invocations (DEFINE_CURVE_DATA) that the parser misread as K&R function definitions. Brainpool curve parameter definitions are routine in this file.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_kem_test.cc:26:6

17 rows of base64-like lines, lines 26-42 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
    "-----BEGIN PUBLIC KEY-----\n"
    "MIIDMjALBglghkgBZQMEBAEDggMhADmVgV5ZfRBDVc8pqlMzyTJRhp1bzb5IcST2\n"
    "Ari2pmwWxHYWSK12XPXYAGtRXpBafwrAdrDGLvoygVPnylcBaZ8TBfHmvG+QsOSb\n"
    "aTUSts6ZKouAFt38GmYsfj+WGcvYad13GvMIlszVkYrGy3dGbF53mZbWf/mqvJdQ\n"
```
likely benign LLM, confidence 0.95 PEM public key test fixture for a KEM test.
Reasoning
These are PEM public key strings in a KEM test file, with base64 lines expected in test fixtures.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_kem_test.cc:50:6

25 rows of base64-like lines, lines 50-74 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
    "-----BEGIN PUBLIC KEY-----\n"
    "MIIEsjALBglghkgBZQMEBAIDggShACmKoQ1CPI3aBp0CvFnmzfA6CWuLPaTKubgM\n"
    "pKFJB2cszvHsT68jSgvFt+nUc/KzEzs7JqHRdctnp4BZGWmcAvdlMbmcX4kYBwS7\n"
    "TKRTXFuJcmecZgoHxeUUuHAJyGLrj1FXaV77P8QKne9rgcHMAqJJrk8JStDZvTSF\n"
```
likely benign LLM, confidence 0.95 PEM public key test fixture for a KEM test.
Reasoning
A PEM public key fixture in a KEM test; base64 content is the expected format.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_kem_test.cc:82:6

33 rows of base64-like lines, lines 82-114 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
    "-----BEGIN PUBLIC KEY-----\n"
    "MIIGMjALBglghkgBZQMEBAMDggYhAEuUwpRQERGRgjs1FMmsHqPZglzLhjk6LfsE\n"
    "ZU+iGS03v60cSXxlAu7lyoCnO/zguvWlSohYWkATl6PSMvQmp6+wgrwhpEMXCQ6q\n"
    "x1ksLqiKZTxEkeoZOTEzX1LpiaPEzFbZxVNzLVfEcPtBq3WbZdLQREU4L82cTjRK\n"
```
likely benign LLM, confidence 0.95 PEM public key test fixture for a KEM test.
Reasoning
A PEM public key fixture in the KEM test file, consistent with other test vectors in the same file.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_kem_test.cc:123:6

base64-like blob (52 bytes, compression ratio 1.21) (raw pass, confidence 0.60)
```
    "MFQCAQAwCwYJYIZIAWUDBAQBBEKAQAABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZ\n"
    "GhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj8=\n"
    "-----END PRIVATE KEY-----\n";
```
likely benign LLM, confidence 0.95 PEM private key test fixture with structured test bytes.
Reasoning
A PEM private key fixture whose body is a DER structure plus sequential byte values, typical of a test vector.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_kem_test.cc:130:6

base64-like blob (52 bytes, compression ratio 1.21) (raw pass, confidence 0.60)
```
    "MFQCAQAwCwYJYIZIAWUDBAQCBEKAQAABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZ\n"
    "GhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj8=\n"
    "-----END PRIVATE KEY-----\n";
```
likely benign LLM, confidence 0.95 PEM private key test fixture in a KEM test.
Reasoning
A PEM private key fixture of the same structure as the neighboring test vectors.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_kem_test.cc:137:6

base64-like blob (52 bytes, compression ratio 1.21) (raw pass, confidence 0.60)
```
    "MFQCAQAwCwYJYIZIAWUDBAQDBEKAQAABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZ\n"
    "GhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj8=\n"
    "-----END PRIVATE KEY-----\n";
```
likely benign LLM, confidence 0.95 PEM private key test fixture in a KEM test.
Reasoning
A PEM private key fixture of the same structure as the other KEM test vectors.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_kem_test.cc:143:6

base64-like blob (64 bytes, compression ratio 1.05) (raw pass, confidence 0.60)
```
    "-----BEGIN PRIVATE KEY-----\n"
    "MFMCAQAwCwYJYIZIAWUDBAQBBEGAPwABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZ\n"
    "GhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pg==\n"
    "-----END PRIVATE KEY-----\n";
```
likely benign LLM, confidence 0.92 A PEM-encoded PKCS#8 private key used as a test vector for KEM handling in aws-lc.
Reasoning
The blob sits inside a PEM PRIVATE KEY block in a crypto library's test file. The payload is a structured PKCS#8 header followed by a sequential byte pattern, which is typical of a hand-written or generated test vector rather than an encoded dropper. Raw-pass base64 hits have a high false-positive rate.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_kem_test.cc:144:6

base64-like blob (52 bytes, compression ratio 1.21) (raw pass, confidence 0.60)
```
    "MFMCAQAwCwYJYIZIAWUDBAQBBEGAPwABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZ\n"
    "GhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pg==\n"
    "-----END PRIVATE KEY-----\n";
```
likely benign LLM, confidence 0.92 Continuation of the PEM-encoded PKCS#8 test key in the KEM test file.
Reasoning
This is the tail of the same PEM test vector, with the same structure and sequential bytes. It is test data inside a crypto library's test suite and has no execution or network behaviour.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_kem_test.cc:149:6

35 rows of base64-like lines, lines 149-183 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
    "-----BEGIN PRIVATE KEY-----\n"
    "MIIGeAIBADALBglghkgBZQMEBAEEggZkBIIGYHBVT9Q2NE8nhbGzsbrBhLZnkAMz\n"
    "bCbxWn3oeMSCXGvgPzxKSA91t0hqrTHToAUYYj/SB6tSjdYnIUlYNa4AYsNnt0px\n"
    "uvEKrQ6KKQIHa+MTSL6xXMwJV83rtK/yJnVrvGAbZWireErLrrNHAvD4aiYgIRiy\n"
```
likely benign LLM, confidence 0.92 A larger PEM PRIVATE KEY test vector, 35 rows of base64.
Reasoning
A multi-row PEM private key test vector in a cryptographic test file. Long base64 runs are expected for key material in tests, and the raw-pass blob heuristic fires on any such text.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_kem_test.cc:189:6

50 rows of base64-like lines, lines 189-238 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
    "MIIJeAIBADALBglghkgBZQMEBAIEgglkBIIJYCfSp38zdW9hII7xE6voJZWHPUq8\n"
    "cw5bXWeVKb9qTOtjg0JyMahhL0FVBRWsulLkjq2LlCgzu+aGXRPRSnnSxcPgfwoF\n"
    "bY3nqt/KugWMSTyAs3yrjFYnU7s7prbsgpf4heqnVA1TABWoRAblWxNmtXfiNs5Y\n"
    "om2KHrWkTVQjI8IWfZv0pH+YVpnKBbrkO43sYX8COAo4kK/UuMfsft4mVToCXzzl\n"
```
likely benign LLM, confidence 0.92 A PEM private key test vector spanning 50 rows of base64.
Reasoning
Another PEM-encoded private key test vector in aws-lc's KEM tests. It is key-shaped test data, not obfuscated code or a payload.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_kem_test.cc:243:6

67 rows of base64-like lines, lines 243-309 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
    "-----BEGIN PRIVATE KEY-----\n"
    "MIIMeAIBADALBglghkgBZQMEBAMEggxkBIIMYPd7f2sVxz/izFRrZ/t3TKGbQs1G\n"
    "Pqn7uYTKR3p3tscQh8vwUavkc2qQcsbocMgxHFWWP1AKPHsbjypYVY9JxiUntsWU\n"
    "teess7z1lyc6V0NRfRUSCL1Kph51umewvVlKmUkZYnrAqATUieFxM2vDOfRmZwbl\n"
```
likely benign LLM, confidence 0.92 A large PEM PRIVATE KEY test vector in the KEM test file.
Reasoning
A 67-row PEM private key block in a cryptographic test file. The structure is consistent with a generated known-answer test vector.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_kem_test.cc:319:6

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
    "-----BEGIN PRIVATE KEY-----\n"
    "MFQCAQAwCwYJYIZIAWUDBAQBBEKAQNE4hxN6KQyTF+Qj9UlXv4frRjHiNEt99Dv+\n"
    "fyqv3I4AQmR+rSd2QVr8iGPjcTCQ24hWPJ3BxaOnQs7avyfq7ps=\n"
    "-----END PRIVATE KEY-----\n";
```
likely benign LLM, confidence 0.92 A PEM PRIVATE KEY test vector in the KEM test file.
Reasoning
A PEM private key test vector in aws-lc's KEM tests. Base64 key material in test code is expected and carries no execution behaviour.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_kem_test.cc:320:6

base64-like blob (52 bytes, compression ratio 1.21) (raw pass, confidence 0.60)
```
    "MFQCAQAwCwYJYIZIAWUDBAQBBEKAQNE4hxN6KQyTF+Qj9UlXv4frRjHiNEt99Dv+\n"
    "fyqv3I4AQmR+rSd2QVr8iGPjcTCQ24hWPJ3BxaOnQs7avyfq7ps=\n"
    "-----END PRIVATE KEY-----\n";
```
likely benign LLM, confidence 0.92 Tail of a PEM private key test vector in the KEM test file.
Reasoning
This is the tail of the PEM test vector at line 319, a standard key-material test fixture in a crypto library.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_kem_test.cc:325:6

34 rows of base64-like lines, lines 325-359 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
    "-----BEGIN PRIVATE KEY-----\n"
    "MIIGeAIBADALBglghkgBZQMEBAEEggZkBIIGYIyUffSBTttqRkjxuhPrnQsAwc0E\n"
    "eEfpiZ2MV6fTfCsGwBjrHaM1NeiYTOhVai65wNFMV2zUQQYHtg5nyhERk4a8sC5X\n"
    "Mbxlv4J1B6omZjQApwhmgOIoa0W7f/wGk+jibqBsJ8sXMYSCui2szQiRtWqIb9LV\n"
```
likely benign LLM, confidence 0.92 A PEM PRIVATE KEY test fixture spanning 34 rows of base64.
Reasoning
A PEM private key test fixture of 34 rows in a cryptographic library's tests. This is expected test data, not a dropper or hidden payload.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_kem_test.cc:364:6

17 rows of base64-like lines, lines 364-380 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
    "-----BEGIN PUBLIC KEY-----\n"
    "MIIDMjALBglghkgBZQMEBAEDggMhABC0xcv2T7+iOdhyR9GpG6qbCr2RVwykEti2\n"
    "LPZiNd2DH5nsmrkVqzkCrDjQmvr1am+VzM7Dm4QRjTAnh5pSmfw7PVAoc8WLEf1Q\n"
    "HHyqERoUfYlLGIRQOP5HB/vXDOnpuJgkPlfzJ3bmDA3ZBl0bkt1SBPSklcrHKtzs\n"
```
likely benign LLM, confidence 0.92 A PEM PUBLIC KEY test vector in the KEM test file.
Reasoning
A PEM PUBLIC KEY block in a cryptographic test file. Public key test vectors are ordinary test data and the raw-pass heuristic flags them only because of their base64 form.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_kem_test.cc:386:6

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
    "-----BEGIN PRIVATE KEY-----\n"
    "MFQCAQAwCwYJYIZIAWUDBAQCBEKAQEaoG9U4IT/3ICeEUsmqUomFES14K0pvYTdA\n"
    "LQoFvUzjPo/ghsug5JTZ3g1UrXSl2rXr3BFCDJgpEStfanCeVv0=\n"
    "-----END PRIVATE KEY-----\n";
```
likely benign LLM, confidence 0.92 A PEM PRIVATE KEY test vector in the KEM test file.
Reasoning
A PEM private key test vector in aws-lc's KEM tests. The base64 is key material used as a fixture and is not executed or decoded for malicious purposes.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_kem_test.cc:387:6

base64-like blob (52 bytes, compression ratio 1.21) (raw pass, confidence 0.60)
```
    "MFQCAQAwCwYJYIZIAWUDBAQCBEKAQEaoG9U4IT/3ICeEUsmqUomFES14K0pvYTdA\n"
    "LQoFvUzjPo/ghsug5JTZ3g1UrXSl2rXr3BFCDJgpEStfanCeVv0=\n"
    "-----END PRIVATE KEY-----\n";
```
likely benign LLM, confidence 0.92 Tail of a PEM private key test vector in the KEM test file.
Reasoning
The tail of the PEM test vector at line 386, a standard cryptographic test fixture with no executable or network behaviour.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_kem_test.cc:392:6

51 rows of base64-like lines, lines 392-442 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
    "-----BEGIN PRIVATE KEY-----\n"
    "MIIJeAIBADALBglghkgBZQMEBAIEgglkBIIJYFWygtXJdIs5OE9mj4sqUEgFppME\n"
    "Xy+FiJXgegyoucGae2I6MqkHboxrT6rxdilBxcgyIygkLNIEUCtZNkxUTNGiXr3E\n"
    "oPacK8B3F/oUWRpmMDcrUmooevOyW58mmIC7hygTb3W2rLRcD/zbPZzXzyi8rOpK\n"
```
likely benign LLM, confidence 0.92 A PEM PRIVATE KEY test vector spanning 51 rows of base64.
Reasoning
A 51-row PEM private key block in a cryptographic test file. The shape matches generated known-answer test data for key encapsulation tests.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_kem_test.cc:447:6

25 rows of base64-like lines, lines 447-471 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
    "-----BEGIN PUBLIC KEY-----\n"
    "MIIEsjALBglghkgBZQMEBAIDggShAKGhKH9RDLSXPlqpkU2js4wCo+CFlr72UnnA\n"
    "N4e4lQmIy7knU1nWvURys55GYm9iZlD2clCij2H4E1XliJtZWnd0EIZ4X26yQpuJ\n"
    "BM13i9VazemaRnCpYnb3DnpzbrdqQ0wkxOX7OybZfZmyrteyNDt6WwhHp2pYw83c\n"
```
likely benign LLM, confidence 0.97 Test fixture containing a PEM public key split across C string literals.
Reasoning
The snippet is a PEM-encoded public key embedded as a C string literal in a test file. Base64 blobs of key material are expected in crypto tests and carry no obfuscation or malicious intent; the raw pass has a high false-positive rate for this pattern.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_pqdsa_test.cc:954:2

28 rows of base64-like lines, lines 954-981 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
"-----BEGIN PUBLIC KEY-----\n"
"MIIFMjALBglghkgBZQMEAxEDggUhANeytHJUquDbReeTDUqY0sl9jxOX0Xidr6Fw\n"
"JLMW6b7JT8mUbULxm3mnQTu6oz5xSctC7VEVaTrAQfrLmIretf4OHYYxGEmVtZLD\n"
"l9IpTi4U+QqkFLo4JomaxD9MzKy8JumoMrlRGNXLQzy++WYLABOOCBf2HnYsonTD\n"
```
likely benign LLM, confidence 0.97 PEM public key test vector for post-quantum DSA in a test file.
Reasoning
A PEM public key test vector in a cryptographic library's test suite; base64 rows are the normal encoding of key material and the file is a known test fixture.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_pqdsa_test.cc:988:2

40 rows of base64-like lines, lines 988-1028 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
"-----BEGIN PUBLIC KEY-----\n"
"MIIHsjALBglghkgBZQMEAxIDggehAEhoPZGXjjHrPd24sEc0gtK4il9iWUn9j1il\n"
"YeaWvUwn0Fs427Lt8B5mTv2Bvh6ok2iM5oqi1RxZWPi7xutOie5n0sAyCVTVchLK\n"
"xyKf8dbq8DkovVFRH42I2EdzbH3icw1ZeOVBBxMWCXiGdxG/VTmgv8TDUMK+Vyuv\n"
```
likely benign LLM, confidence 0.97 PEM public key test vector for PQDSA in a test file.
Reasoning
Same pattern: a PEM public key constant in PQDSA test code, consistent with expected test vectors rather than hidden payloads.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_pqdsa_test.cc:1036:2

54 rows of base64-like lines, lines 1036-1089 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
"-----BEGIN PUBLIC KEY-----\n"
"MIIKMjALBglghkgBZQMEAxMDggohAJeSvOwvJDBoaoL8zzwvX/Zl53HXq0G5AljP\n"
"p+kOyXEkpzsyO5uiGrZNdnxDP1pSHv/hj4bkahiJUsRGfgSLcp5/xNEV5+SNoYlt\n"
"X+EZsQ3N3vYssweVQHS0IzblKDbeYdqUH4036misgQb6vhkHBnmvYAhTcSD3B5O4\n"
```
likely benign LLM, confidence 0.97 Large PEM public key test vector in PQDSA tests.
Reasoning
A large PEM public key literal in a cryptographic test file; base64 key encoding is expected and the content is structured ASN.1 DER.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_pqdsa_test.cc:1119:2

54 rows of base64-like lines, lines 1119-1173 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
"-----BEGIN PRIVATE KEY-----\n"
"MIIKPgIBADALBglghkgBZQMEAxEEggoqMIIKJgQgAAECAwQFBgcICQoLDA0ODxAR\n"
"EhMUFRYXGBkaGxwdHh8EggoA17K0clSq4NtF55MNSpjSyX2PE5fReJ2voXAksxbp\n"
"vsk5zg9/d/jbVkTc2jZr/kc0vZX0Nf+aYTqlSqQcLGlMBDKaB7H6u0j1KjCfEaGJ\n"
```
likely benign LLM, confidence 0.97 PEM private key test vector in PQDSA tests.
Reasoning
A PEM private key test vector with a recognizable PKCS#8 structure and a counting byte sequence (AAECAwQ...), typical of deterministic test data in a crypto library.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_pqdsa_test.cc:1180:2

84 rows of base64-like lines, lines 1180-1264 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
"-----BEGIN PRIVATE KEY-----\n"
"MIIP/gIBADALBglghkgBZQMEAxIEgg/qMIIP5gQgAAECAwQFBgcICQoLDA0ODxAR\n"
"EhMUFRYXGBkaGxwdHh8Egg/ASGg9kZeOMes93biwRzSC0riKX2JZSf2PWKVh5pa9\n"
"TCfYU/ppuBmQI+jNZ43Z+r+QR2Rv/QyzzH95WAWnHnDSNxsFY+PNM0YUnIyevPI7\n"
```
likely benign LLM, confidence 0.97 PEM private key test vector in PQDSA tests.
Reasoning
PEM private key constant in a crypto library test file with structured ASN.1 and sequential test bytes; expected for known-answer tests.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_pqdsa_test.cc:1272:2

99 rows of base64-like lines, lines 1272-1374 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
"-----BEGIN PRIVATE KEY-----\n"
"MIITXgIBADALBglghkgBZQMEAxMEghNKMIITRgQgAAECAwQFBgcICQoLDA0ODxAR\n"
"EhMUFRYXGBkaGxwdHh8EghMgl5K87C8kMGhqgvzPPC9f9mXncderQbkCWM+n6Q7J\n"
"cSTY6e5OkKFsYC9eybw4UX3DDjKdWrJ2c72F9MmwMA93Y4mIZ1C1fCTbP8AS5h7e\n"
```
likely benign LLM, confidence 0.97 PEM private key test vector in PQDSA tests.
Reasoning
PEM private key literal in a cryptographic test suite, consistent with standard key-encoding test vectors.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_pqdsa_test.cc:1382:2

52 rows of base64-like lines, lines 1382-1436 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
"-----BEGIN PRIVATE KEY-----\n"
"MIIKPgIBADALBglghkgBZQMEAxEEggoqMIIKJgQgAAECAwQFBgcICQoLDA0ODxAR\n"
"EhMUFRYXGBkaGxwdHh8EggoAUQyb/R3XN09Oiucd1YKBEGqTQS7Y+jV/dLu0Zh7L\n"
"GSHTp1/JO4jvDmqbhRvs7BmZm+gQaMhZ1t8RXGCMFQEXDrbAVcIvYlWSSXbYlaX1\n"
```
likely benign LLM, confidence 0.97 PEM private key test vector in PQDSA tests.
Reasoning
PEM private key test vector in a crypto library test file; the base64 is standard key encoding with no execution or decoding logic.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/evp_extra/p_pqdsa_test.cc:1443:2

53 rows of base64-like lines, lines 1443-1496 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
"-----BEGIN PRIVATE KEY-----\n"
"MIIKGAIBADALBglghkgBZQMEAxEEggoEBIIKANeytHJUquDbReeTDUqY0sl9jxOX\n"
"0Xidr6FwJLMW6b7JOc4Pf3f421ZE3No2a/5HNL2V9DX/mmE6pUqkHCxpTAQzmgex\n"
"+rtI9SownxGhiY+EjiMi/+Yj7IENs77jNoWFSogmnaMg1RIL/P6JoY4w9xFNg6pA\n"
```
likely benign LLM, confidence 0.97 PEM private key test vector in PQDSA tests.
Reasoning
PEM private key constant in test code of a cryptographic library; expected test data, not obfuscation.
info identifier-low-length aws-lc/crypto/fipsmodule/bn/add.c:1:1

179 of 438 non-conventional identifiers are single-character (41%) (token pass, confidence 0.50)
info ~~warn~~ → info by review identifier-confusable-collision aws-lc/crypto/fipsmodule/bn/div.c:18:16

two identifiers collapse to visual skeleton `d|` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
                                            BN_ULONG d) {
  BN_ULONG dh, dl, q, ret = 0, th, tl, t;
  int i, count = 2;
```
likely benign LLM, confidence 0.90 Token pass flagged short identifiers in BN division code as confusable.
Reasoning
The two identifiers are the parameter d and a local dl or dh-style name whose skeleton collapses under confusable mapping; in a bignum division routine this is a naming artifact of short identifiers (dh/dl/d) rather than a deliberate homoglyph, and the snippet shows ordinary ASCII names in a well-known crypto library.
info identifier-low-length aws-lc/crypto/fipsmodule/bn/div_extra.c:1:1

50 of 108 non-conventional identifiers are single-character (46%) (token pass, confidence 0.50)
info ~~warn~~ → info by review implicit-int-function aws-lc/crypto/fipsmodule/cipher/e_aes.c:722:1

26 functions in this file lack an explicit return type (pre-ANSI K&R style; e.g. DEFINE_METHOD_FUNCTION, DEFINE_METHOD_FUNCTION, DEFINE_LOCAL_DATA, DEFINE_METHOD_FUNCTION, DEFINE_METHOD_FUNCTION, DEFINE_METHOD_FUNCTION) (ast pass, confidence 0.85)
```
DEFINE_METHOD_FUNCTION(EVP_CIPHER, EVP_aes_128_cbc) {
  memset(out, 0, sizeof(EVP_CIPHER));
```
likely benign LLM, confidence 0.85 AST pass flagged macro-generated AES cipher method definitions as implicit-int functions.
Reasoning
The DEFINE_METHOD_FUNCTION and DEFINE_LOCAL_DATA macros expand to definitions whose return types are supplied by the macro, so the implicit-int report is a false positive from macro-based definitions in AWS-LC, not K&R style code.
info ~~warn~~ → info by review implicit-int-function aws-lc/crypto/fipsmodule/cipher/e_aesccm.c:393:1

6 functions in this file lack an explicit return type (pre-ANSI K&R style; e.g. DEFINE_METHOD_FUNCTION, DEFINE_METHOD_FUNCTION, DEFINE_METHOD_FUNCTION, DEFINE_METHOD_FUNCTION, DEFINE_METHOD_FUNCTION, DEFINE_METHOD_FUNCTION) (ast pass, confidence 0.85)
```
DEFINE_METHOD_FUNCTION(EVP_AEAD, EVP_aead_aes_128_ccm_bluetooth) {
  memset(out, 0, sizeof(EVP_AEAD));
```
likely benign LLM, confidence 0.97 Macro-defined AEAD method initializer in AWS-LC's AES-CCM cipher file.
Reasoning
The DEFINE_METHOD_FUNCTION macro expands to a function definition with an implicit int return type in this codebase's macro style. The snippet shows ordinary method-table initialization (memset of an EVP_AEAD struct). This is a legacy-style macro pattern in a well-known cryptographic library, not obfuscation.
info ~~warn~~ → info by review implicit-int-function aws-lc/crypto/fipsmodule/digest/digests.c:34:1

16 functions in this file lack an explicit return type (pre-ANSI K&R style; e.g. DEFINE_METHOD_FUNCTION, DEFINE_METHOD_FUNCTION, DEFINE_METHOD_FUNCTION, DEFINE_METHOD_FUNCTION, DEFINE_METHOD_FUNCTION, DEFINE_METHOD_FUNCTION) (ast pass, confidence 0.85)
```
DEFINE_METHOD_FUNCTION(EVP_MD, EVP_md5) {
  out->type = NID_md5;
  out->md_size = MD5_DIGEST_LENGTH;
```
likely benign LLM, confidence 0.97 Digest method table definitions (MD5 etc.) in AWS-LC using a macro wrapper.
Reasoning
Implicit-int warning arises from the DEFINE_METHOD_FUNCTION macro used for standard digest method definitions (md5 shown, setting type and md_size). Ordinary library code; the signal is a stylistic artifact of macros.
info ~~warn~~ → info by review implicit-int-function aws-lc/crypto/fipsmodule/ec/ec.c:60:1

5 functions in this file lack an explicit return type (pre-ANSI K&R style; e.g. DEFINE_METHOD_FUNCTION, DEFINE_METHOD_FUNCTION, DEFINE_METHOD_FUNCTION, DEFINE_METHOD_FUNCTION, DEFINE_METHOD_FUNCTION) (ast pass, confidence 0.85)
```
DEFINE_METHOD_FUNCTION(EC_GROUP, EC_group_p224) {
  out->curve_name = NID_secp224r1;
  out->comment = "NIST P-224";
```
likely benign LLM, confidence 0.97 EC group constructor macros for standard NIST curves in AWS-LC.
Reasoning
DEFINE_METHOD_FUNCTION for EC groups setting curve_name and comment fields is standard library initialization. Implicit-int is an artifact of the macro, not malicious.
info ~~warn~~ → info by review implicit-int-function aws-lc/crypto/fipsmodule/kem/kem.c:58:1

6 functions in this file lack an explicit return type (pre-ANSI K&R style; e.g. DEFINE_LOCAL_DATA, DEFINE_LOCAL_DATA, DEFINE_LOCAL_DATA, DEFINE_LOCAL_DATA, DEFINE_LOCAL_DATA, DEFINE_LOCAL_DATA) (ast pass, confidence 0.85)
```
DEFINE_LOCAL_DATA(KEM_METHOD, kem_ml_kem_1024_method) {
  out->keygen_deterministic = ml_kem_1024_keygen_deterministic;
  out->encaps_deterministic = ml_kem_1024_encaps_deterministic;
```
likely benign LLM, confidence 0.96 ML-KEM-1024 KEM method struct definition in AWS-LC.
Reasoning
DEFINE_LOCAL_DATA macro defines a KEM method table pointing to ML-KEM functions. Benign macro-generated declaration pattern consistent with the rest of the library.
info identifier-low-length aws-lc/crypto/fipsmodule/md5/md5.c:1:1

386 of 694 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)
info ~~warn~~ → info by review whitespace-anomaly aws-lc/crypto/fipsmodule/ml_kem/mlkem/native/aarch64/src/aarch64_zetas.c:26:1

55/171 lines (32%) have decorative internal whitespace layout (≥2 runs of ≥4 spaces between code tokens) (token pass, confidence 0.70)
```
        -1600, -15749, -749,  -7373,  -40,   -394,   -687, -6762, 630,  6201,
        -1432, -14095, 848,   8347,   0,     0,      1062, 10453, 296,  2914,
        -882,  -8682,  0,     0,      -1410, -13879, 1339, 13180, 1476, 14529,
        0,     0,      193,   1900,   -283,  -2786,  56,   551,   0,    0,
```
likely benign LLM, confidence 0.93 Aligned table of NTT twiddle constants for ML-KEM on AArch64.
Reasoning
Whitespace alignment in a numeric constants table (NTT zetas) is ordinary column-aligned formatting of generated cryptographic constant data. No obfuscation intent; the signal is purely cosmetic.
info ~~warn~~ → info by review whitespace-anomaly aws-lc/crypto/fipsmodule/ml_kem/mlkem/native/x86_64/src/consts.c:24:1

30/94 lines (32%) have decorative internal whitespace layout (≥2 runs of ≥4 spaces between code tokens) (token pass, confidence 0.70)
```
MLK_ALIGN MLK_INTERNAL_DATA_DEFINITION const int16_t mlk_qdata[624] = {
    3854,   3340,   2826,   2312,   1798,   1284,   770,    256,    3854,
    3340,   2826,   2312,   1798,   1284,   770,    256,    7,      0,
    6,      0,      5,      0,      4,      0,      3,      0,      2,
```
likely benign LLM, confidence 0.93 Precomputed constant table for ML-KEM on x86_64.
Reasoning
Column-aligned numeric constant array (mlk_qdata) for ML-KEM on x86_64 is conventional formatting of precomputed tables, not hidden payload.
info ~~warn~~ → info by review embedded-nul-in-string aws-lc/crypto/fipsmodule/pbkdf/pbkdf_test.cc:77:38

string literal contains an embedded NUL followed by 4 more bytes of source (token pass, confidence 0.85)
```
  ASSERT_TRUE(PKCS5_PBKDF2_HMAC("pass\0word", 9, (const uint8_t *)"sa\0lt", 5,
                                4096, EVP_sha1(), sizeof(kKey3), key));
  EXPECT_EQ(Bytes(kKey3), Bytes(key, sizeof(kKey3)));
```
likely benign LLM, confidence 0.90 PBKDF2 test vector with an intentional embedded NUL in the password string.
Reasoning
Embedded NULs in PBKDF2 test vectors are deliberate, matching the RFC 6070/test-vector convention where the password contains a NUL byte and length is passed explicitly. Legitimate test data.
info ~~warn~~ → info by review embedded-nul-in-string aws-lc/crypto/fipsmodule/pbkdf/pbkdf_test.cc:77:70

string literal contains an embedded NUL followed by 2 more bytes of source (token pass, confidence 0.85)
```
  ASSERT_TRUE(PKCS5_PBKDF2_HMAC("pass\0word", 9, (const uint8_t *)"sa\0lt", 5,
                                4096, EVP_sha1(), sizeof(kKey3), key));
  EXPECT_EQ(Bytes(kKey3), Bytes(key, sizeof(kKey3)));
```
likely benign LLM, confidence 0.90 PBKDF2 test vector with an intentional embedded NUL in the salt.
Reasoning
Same deliberate embedded NUL in the salt of a PBKDF2 known-answer test with explicit length 5; a standard way to test binary-safe inputs.
info ~~warn~~ → info by review implicit-int-function aws-lc/crypto/fipsmodule/pqdsa/pqdsa.c:264:1

6 functions in this file lack an explicit return type (pre-ANSI K&R style; e.g. DEFINE_LOCAL_DATA, DEFINE_LOCAL_DATA, DEFINE_LOCAL_DATA, DEFINE_LOCAL_DATA, DEFINE_LOCAL_DATA, DEFINE_LOCAL_DATA) (ast pass, confidence 0.85)
```
DEFINE_LOCAL_DATA(PQDSA_METHOD, sig_ml_dsa_44_method) {
  out->pqdsa_keygen = ml_dsa_44_keypair;
  out->pqdsa_keygen_internal = ml_dsa_44_keypair_internal;
```
likely benign LLM, confidence 0.97 ML-DSA-44 signature method table definition in AWS-LC.
Reasoning
DEFINE_LOCAL_DATA macro populating a PQDSA method table with ML-DSA functions is standard library structure, with the implicit-int signal coming from the macro.
info identifier-low-length aws-lc/crypto/fipsmodule/sha/keccak1600.c:1:1

442 of 977 non-conventional identifiers are single-character (45%) (token pass, confidence 0.50)
info identifier-low-length aws-lc/crypto/fipsmodule/sha/sha1-altivec.c:1:1

517 of 1007 non-conventional identifiers are single-character (51%) (token pass, confidence 0.50)
info identifier-low-length aws-lc/crypto/fipsmodule/sha/sha1.c:1:1

842 of 1246 non-conventional identifiers are single-character (68%) (token pass, confidence 0.50)

info unicode-mixed-script aws-lc/crypto/hrss/hrss.c:1828:24

identifier `𝑥z` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)

  // The use of z̅ is that, when working mod (𝑥^701 - 1), vz[0] = <v,
  // z̅>, vz[1] = <v, 𝑥z̅>, …. (Where <a, b> is the inner product: the sum
  // of the point-wise products.) Although we calculated the inverse mod
  // Φ(N), we can work mod (𝑥^N - 1) and reduce mod Φ(N) at the end.

info unicode-mixed-script aws-lc/crypto/hrss/hrss.c:1836:52

identifier `𝑥z` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)
```
  //
  // Thus we can consider what the pattern of z̅, 𝑥z̅, 𝑥^2z̅, … looks like:
  //
  // def reverse(xs):
```

info unicode-mixed-script aws-lc/crypto/hrss/hrss.c:2187:17

identifier `tΦ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

  //   t = (−b(1)/N) mod Q
  //   c' = b + tΦ(N) + lift(m) mod Q
  //
  // When polynomials are transmitted, the final coefficient is omitted and

info unicode-mixed-script aws-lc/crypto/hrss/hrss.c:2198:43

identifier `tΦ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

  // coefficient. Therefore b(1) = -c[N-1]×N. The value of |t|, above, then is
  // just recovering |c[N-1]|, and adding tΦ(N) is simply undoing the reduction.
  // Therefore b + tΦ(N) + lift(m) = c by construction and we don't need to
  // recover |c| at all so long as we do the checks in

info unicode-mixed-script aws-lc/crypto/hrss/hrss.c:2199:20

identifier `tΦ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

  // just recovering |c[N-1]|, and adding tΦ(N) is simply undoing the reduction.
  // Therefore b + tΦ(N) + lift(m) = c by construction and we don't need to
  // recover |c| at all so long as we do the checks in
  // |poly3_from_poly_checked|.

info identifier-low-length aws-lc/crypto/md4/md4.c:1:1

237 of 528 non-conventional identifiers are single-character (45%) (token pass, confidence 0.50)
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/pem/pem_test.cc:101:6

5 rows of base64-like lines, lines 101-105 (first: base64-like blob (64 bytes, compression ratio 1.08)) (raw pass, confidence 0.60)
```
const char* kPemRsaPrivateKey = "-----BEGIN ENCRYPTED PRIVATE KEY-----\n"
    "MIHsMFcGCSqGSIb3DQEFDTBKMCkGCSqGSIb3DQEFDDAcBAhz3vU103jx3wICCAAw\n"
    "DAYIKoZIhvcNAgkFADAdBglghkgBZQMEASoEEA6vMhRLgHZuHFa+eiecYCgEgZDB\n"
    "E8EOzjGQuu4D0TVAjOa3Peb9/MzQz3t09m5pvNBFKrEl96gefpZdni5qQk34ukj9\n"
```
likely benign LLM, confidence 0.90 Test fixture containing an encrypted PEM private key in base64.
Reasoning
Base64 lines in this file are an encrypted PEM private key used as a test fixture for PEM parsing. Encrypted key test data is expected in a PEM test file; the raw-pass base64 heuristic is a known false positive here.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/pem/pem_test.cc:190:6

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
    "/////zBbBCD/////AAAAAQAAAAAAAAAAAAAAAP///////////////AQgWsY12Ko6"
    "k+ez671VdpiGvGUdBrDMU7D2O848PifSYEsDFQDEnTYIhucEk2pmeOETnSa3gZ9+"
    "kARBBGsX0fLhLEJH+Lzm5WOkQPJ3A32BLeszoPShOUXYmMKWT+NC4v4af5uO5+tK"
    "fA+eFivOM1drMV7Oy7ZAaDe/UfUCIQD/////AAAAAP//////////vOb6racXnoTz"
```
likely benign LLM, confidence 0.93 Base64 body of an EC parameters PEM test vector.
Reasoning
Raw-pass base64 hit inside a PEM EC PARAMETERS test vector in a crypto library's unit test. Base64 of DER key material is the expected content of such a fixture, and the file is a test suite, not a dropper.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/pem/pem_test.cc:191:6

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
    "k+ez671VdpiGvGUdBrDMU7D2O848PifSYEsDFQDEnTYIhucEk2pmeOETnSa3gZ9+"
    "kARBBGsX0fLhLEJH+Lzm5WOkQPJ3A32BLeszoPShOUXYmMKWT+NC4v4af5uO5+tK"
    "fA+eFivOM1drMV7Oy7ZAaDe/UfUCIQD/////AAAAAP//////////vOb6racXnoTz"
    "ucrC/GMlUQIBAQ==\n"
```
likely benign LLM, confidence 0.93 Continuation of the EC parameters PEM test vector.
Reasoning
Continuation of the same PEM EC PARAMETERS test vector; raw base64 lines in a crypto test fixture with no execution or decoding of hidden payloads.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/pem/pem_test.cc:192:6

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
    "kARBBGsX0fLhLEJH+Lzm5WOkQPJ3A32BLeszoPShOUXYmMKWT+NC4v4af5uO5+tK"
    "fA+eFivOM1drMV7Oy7ZAaDe/UfUCIQD/////AAAAAP//////////vOb6racXnoTz"
    "ucrC/GMlUQIBAQ==\n"
    "-----END EC PARAMETERS-----\n";
```
likely benign LLM, confidence 0.93 Tail of the EC parameters PEM test vector.
Reasoning
Final lines of the same PEM test vector, followed by a normal END marker. Expected encoded test data in a crypto library.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/pem/pem_test.cc:342:6

6 rows of base64-like lines, lines 342-347 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
    "-----BEGIN DH PARAMETERS-----\n"
    "MIIBCAKCAQEA7E6kBrYiyvmKAMzQ7i8WvwVk9Y/+f8S7sCTN712KkK3cqd1jhJDY"
    "JbrYeNV3kUIKhPxWHhObHKpD1R84UpL+s2b55+iMd6GmL7OYmNIT/FccKhTcveab"
    "VBmZT86BZKYyf45hUF9FOuUM9xPzuK3Vd8oJQvfYMCd7LPC0taAEljQLR4Edf8E6"
```
likely benign LLM, confidence 0.93 DH parameters PEM test vector in base64.
Reasoning
Several rows of base64 forming a DH PARAMETERS PEM block in a test file. This is standard test data for PEM parsing and is not obfuscation.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/pkcs7/pkcs7_test.cc:705:6

21 rows of base64-like lines, lines 705-725 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
    "-----BEGIN PKCS7-----\n"
    "MIID+wYJKoZIhvcNAQcCoIID7DCCA+gCAQExADALBgkqhkiG9w0BBwGgggPQMIID\n"
    "zDCCArSgAwIBAgIIWesoywKxoNQwDQYJKoZIhvcNAQELBQAwSTELMAkGA1UEBhMC\n"
    "VVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRlcm5l\n"
```
likely benign LLM, confidence 0.94 Embedded PKCS7 PEM test certificate bundle.
Reasoning
PKCS7 PEM test fixture containing an ASN.1 structure with recognizable certificate content. Raw base64 in a crypto test suite is expected.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/pkcs7/pkcs7_test.cc:733:6

19 rows of base64-like lines, lines 733-751 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
    "-----BEGIN PKCS7-----\n"
    "MIIDhQYJKoZIhvcNAQcCoIIDdjCCA3ICAQExADALBgkqhkiG9w0BBwGgAKGCA1gw\n"
    "ggNUMIICvTANBgkqhkiG9w0BAQUFADBOMQswCQYDVQQGEwJVUzEQMA4GA1UEChMH\n"
    "RXF1aWZheDEtMCsGA1UECxMkRXF1aWZheCBTZWN1cmUgQ2VydGlmaWNhdGUgQXV0\n"
```
likely benign LLM, confidence 0.94 PKCS7 PEM test fixture with certificate data.
Reasoning
Another PKCS7 PEM fixture with DER-structured base64 and standard certificate content, typical of PKCS7 parser tests.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/pkcs7/pkcs7_test.cc:1067:1

base64-like blob (572 bytes over 9 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
-----BEGIN X509 CRL-----
MIIBpzCBkAIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE
CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ
Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoA4wDDAKBgNV
```
likely benign LLM, confidence 0.94 X509 CRL PEM test vector.
Reasoning
X509 CRL PEM test vector in base64, with ASN.1 headers consistent with a real CRL. Expected in a certificate-handling test file.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/pkcs7/pkcs7_test.cc:1080:1

base64-like blob (600 bytes over 10 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
-----BEGIN X509 CRL-----
MIIBvjCBpwIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE
CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ
Qm9yaW5nU1NMFw0xNjA5MjYxNTEyNDRaFw0xNjEwMjYxNTEyNDRaMBUwEwICEAAX
```
likely benign LLM, confidence 0.94 Second X509 CRL PEM test vector.
Reasoning
Second X509 CRL PEM fixture with standard DER base64. Test data, not an encoded payload.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/pkcs7/pkcs7_test.cc:1136:1

base64-like blob (1856 bytes over 29 lines, compression ratio 0.75) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIFazCCA1OgAwIBAgIURVkPzF/4dwy7419Qk75uhIuyf0EwDQYJKoZIhvcNAQEL
BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMTA5MjExOTIyMTJaFw0yMjA5
```
likely benign LLM, confidence 0.94 Certificate PEM test fixture.
Reasoning
Certificate PEM fixture in base64 within a PKCS7 test file. Expected content for certificate parsing tests.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/pkcs7/pkcs7_test.cc:1170:1

base64-like blob (3164 bytes over 50 lines, compression ratio 0.76) (raw pass, confidence 0.60)
```
-----BEGIN PRIVATE KEY-----
MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQC1+MOn+BopcEVR
4QMvjXdAxGkWFllXyQFDToL+qOiPRU1yN7C8KCtkbOAFttJIO4O/i0iZ7KqYbnmB
6YUA/ONAcakocnrdoESgRJcVMeAxDk/11OtMF5yIfeOOO/TUeVNmAUaT63gFbKy/
```
likely benign LLM, confidence 0.92 PKCS8 private key PEM test vector.
Reasoning
Large PRIVATE KEY PEM block in a crypto library test file. Test key material is normal in such suites; the snippet shows a standard PKCS8 structure and no execution logic.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/pkcs7/pkcs7_test.cc:2374:1

base64-like blob (3060 bytes over 48 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
-----BEGIN PKCS7-----
MIII8QYJKoZIhvcNAQcCoIII4jCCCN4CAQExDzANBglghkgBZQMEAgMFADAcBgkq
hkiG9w0BBwGgDwQNc2lnbmVkIGRhdGENCqCCBTwwggU4MIIDIKADAgECAgkAhs29
IYxE13cwDQYJKoZIhvcNAQELBQAwKDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
```
likely benign LLM, confidence 0.94 PKCS7 signed-data PEM test vector.
Reasoning
PKCS7 signed-data PEM test vector with standard certificate and DER structure, in a crypto test file.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/pkcs7/pkcs7_test.cc:2510:1

base64-like blob (1172 bytes over 19 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
      R"(-----BEGIN PKCS7-----
MIIDawYJKoZIhvcNAQcDoIIDXDCCA1gCAQAxggEQMIIBDAIBADB1MHAxEDAOBgNV
BAoMB2V4YW1wbGUxFzAVBgNVBAMMDlRBUk1BQyBST09UIENBMSIwIAYJKoZIhvcN
AQkBFhNzb21lb25lQGV4YW1wbGUub3JnMQswCQYDVQQGEwJVUzESMBAGA1UEBwwJ
```
likely benign LLM, confidence 0.94 PKCS7 PEM test vector in a raw string literal.
Reasoning
PKCS7 PEM test vector embedded in a raw string literal in a test source. Base64 of ASN.1 structures is expected here.
info ~~warn~~ → info by review encoding-hex aws-lc/crypto/rsa_extra/rsa_test.cc:38:6

17 rows of escape runs, lines 38-54 (first: 18 consecutive `\xNN` escapes (entropy 3.8 bits/byte)) (raw pass, confidence 0.65)
```
static const uint8_t kKey1[] =
    "\x30\x82\x01\x38\x02\x01\x00\x02\x41\x00\xaa\x36\xab\xce\x88\xac\xfd\xff"
    "\x55\x52\x3c\x7f\xc4\x52\x3f\x90\xef\xa0\x0d\xf3\x77\x4a\x25\x9f\x2e\x62"
    "\xb4\xc5\xd9\x9c\xb5\xad\xb3\x00\xa0\x28\x5e\x53\x01\x93\x0e\x0c\x70\xfb"
```
dismissed LLM, confidence 0.95 Hex-escaped DER RSA test key in the AWS-LC test suite.
Reasoning
Raw-pass hex escapes in a C++ test file encode a DER-structured RSA private key (0x30 0x82 SEQUENCE header, version INTEGER). This is standard cryptographic test vector data in a known library, not obfuscated code.
info ~~warn~~ → info by review encoding-hex aws-lc/crypto/rsa_extra/rsa_test.cc:59:6

33 rows of escape runs, lines 59-91 (first: 18 consecutive `\xNN` escapes (entropy 3.7 bits/byte)) (raw pass, confidence 0.65)
```
static const uint8_t kFIPSKey[] =
    "\x30\x82\x02\x5c\x02\x01\x00\x02\x81\x81\x00\xa1\x71\x90\x77\x86\x8a\xc7"
    "\xb8\xfc\x2a\x45\x82\x6d\xee\xeb\x35\x3a\x18\x3f\xb6\xb0\x1e\xb1\xd3\x09"
    "\x6b\x05\x4d\xec\x1c\x37\x6f\x09\x31\x32\xda\x21\x8a\x49\x0e\x16\x28\xed"
```
dismissed LLM, confidence 0.95 Hex-escaped DER RSA key (FIPS test fixture) in the AWS-LC test suite.
Reasoning
The escaped bytes start with a DER SEQUENCE and INTEGER structure, consistent with an RSA key used as a FIPS test fixture in a crypto library's unit tests. Literal byte arrays like this are expected there.
info ~~warn~~ → info by review encoding-hex aws-lc/crypto/rsa_extra/rsa_test.cc:95:6

7 rows of escape runs, lines 95-101 (first: 18 consecutive `\xNN` escapes (entropy 3.9 bits/byte)) (raw pass, confidence 0.65)
```
static const uint8_t kFIPSPublicKey[] =
    "\x30\x81\x89\x02\x81\x81\x00\xa1\x71\x90\x77\x86\x8a\xc7\xb8\xfc\x2a\x45"
    "\x82\x6d\xee\xeb\x35\x3a\x18\x3f\xb6\xb0\x1e\xb1\xd3\x09\x6b\x05\x4d\xec"
    "\x1c\x37\x6f\x09\x31\x32\xda\x21\x8a\x49\x0e\x16\x28\xed\x9a\x30\xf3\x14"
```
dismissed LLM, confidence 0.95 Hex-escaped DER RSA public key used as a test fixture.
Reasoning
The bytes are a DER public key structure (0x30 0x81 0x89 SEQUENCE with modulus INTEGER), matching the FIPS key fixture. It is test data within a crypto library's test file.
info ~~warn~~ → info by review encoding-hex aws-lc/crypto/rsa_extra/rsa_test.cc:107:6

18 consecutive `\xNN` escapes (entropy 4.2 bits/byte) (raw pass, confidence 0.65)
```
static const uint8_t kOAEPCiphertext1[] =
    "\x1b\x8f\x05\xf9\xca\x1a\x79\x52\x6e\x53\xf3\xcc\x51\x4f\xdb\x89\x2b\xfb"
    "\x91\x93\x23\x1e\x78\xb9\x92\xe6\x8d\x50\xa4\x80\xcb\x52\x33\x89\x5c\x74"
    "\x95\x8d\x5d\x02\xab\x8c\x0f\xd0\x40\xeb\x58\x44\xb0\x05\xc3\x9e\xd8\x27"
```
dismissed LLM, confidence 0.95 Hex-escaped OAEP ciphertext test vector.
Reasoning
The escape run is a continuation of an OAEP ciphertext test vector in a crypto library's RSA test file. Random-looking high-entropy bytes are expected for ciphertext test vectors.
info ~~warn~~ → info by review encoding-hex aws-lc/crypto/rsa_extra/rsa_test.cc:108:6

18 consecutive `\xNN` escapes (entropy 4.2 bits/byte) (raw pass, confidence 0.65)
```
    "\x1b\x8f\x05\xf9\xca\x1a\x79\x52\x6e\x53\xf3\xcc\x51\x4f\xdb\x89\x2b\xfb"
    "\x91\x93\x23\x1e\x78\xb9\x92\xe6\x8d\x50\xa4\x80\xcb\x52\x33\x89\x5c\x74"
    "\x95\x8d\x5d\x02\xab\x8c\x0f\xd0\x40\xeb\x58\x44\xb0\x05\xc3\x9e\xd8\x27"
    "\x4a\x9d\xbf\xa8\x06\x71\x40\x94\x39\xd2";
```
dismissed LLM, confidence 0.95 Continuation of a hex-escaped OAEP ciphertext test vector.
Reasoning
Continuation of the same OAEP ciphertext test vector array. The high-entropy bytes are the expected ciphertext content, not a payload.
info ~~warn~~ → info by review encoding-hex aws-lc/crypto/rsa_extra/rsa_test.cc:109:6

18 consecutive `\xNN` escapes (entropy 4.2 bits/byte) (raw pass, confidence 0.65)
```
    "\x91\x93\x23\x1e\x78\xb9\x92\xe6\x8d\x50\xa4\x80\xcb\x52\x33\x89\x5c\x74"
    "\x95\x8d\x5d\x02\xab\x8c\x0f\xd0\x40\xeb\x58\x44\xb0\x05\xc3\x9e\xd8\x27"
    "\x4a\x9d\xbf\xa8\x06\x71\x40\x94\x39\xd2";
```
dismissed LLM, confidence 0.95 Final segment of a hex-escaped OAEP ciphertext test vector.
Reasoning
Final lines of the same OAEP ciphertext test vector array in a crypto test file. This is ordinary test data with no execution or decoding logic.
info ~~warn~~ → info by review encoding-hex aws-lc/crypto/rsa_extra/rsa_test.cc:114:6

14 rows of escape runs, lines 114-127 (first: 18 consecutive `\xNN` escapes (entropy 3.9 bits/byte)) (raw pass, confidence 0.65)
```
static const uint8_t kKey2[] =
    "\x30\x81\xfb\x02\x01\x00\x02\x33\x00\xa3\x07\x9a\x90\xdf\x0d\xfd\x72\xac"
    "\x09\x0c\xcc\x2a\x78\xb8\x74\x13\x13\x3e\x40\x75\x9c\x98\xfa\xf8\x20\x4f"
    "\x35\x8a\x0b\x26\x3c\x67\x70\xe7\x83\xa9\x3b\x69\x71\xb7\x37\x79\xd2\x71"
```
dismissed LLM, confidence 0.95 Hex-escaped DER RSA key test vector.
Reasoning
The bytes begin with a DER SEQUENCE and version INTEGER, consistent with an RSA private key test vector. Static byte arrays of this kind are normal in a crypto library's test suite.
info ~~warn~~ → info by review encoding-hex aws-lc/crypto/rsa_extra/rsa_test.cc:133:6

18 consecutive `\xNN` escapes (entropy 4.2 bits/byte) (raw pass, confidence 0.65)
```
static const uint8_t kOAEPCiphertext2[] =
    "\x14\xbd\xdd\x28\xc9\x83\x35\x19\x23\x80\xe8\xe5\x49\xb1\x58\x2a\x8b\x40"
    "\xb4\x48\x6d\x03\xa6\xa5\x31\x1f\x1f\xd5\xf0\xa1\x80\xe4\x17\x53\x03\x29"
    "\xa9\x34\x90\x74\xb1\x52\x13\x54\x29\x08\x24\x52\x62\x51";
```
dismissed LLM, confidence 0.95 Hex-escaped OAEP ciphertext test vector.
Reasoning
A hex-escaped OAEP ciphertext test vector in an RSA unit test file. No decoding or execution happens here, only a data literal.
info ~~warn~~ → info by review encoding-hex aws-lc/crypto/rsa_extra/rsa_test.cc:134:6

18 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
    "\x14\xbd\xdd\x28\xc9\x83\x35\x19\x23\x80\xe8\xe5\x49\xb1\x58\x2a\x8b\x40"
    "\xb4\x48\x6d\x03\xa6\xa5\x31\x1f\x1f\xd5\xf0\xa1\x80\xe4\x17\x53\x03\x29"
    "\xa9\x34\x90\x74\xb1\x52\x13\x54\x29\x08\x24\x52\x62\x51";
```
dismissed LLM, confidence 0.95 Continuation of a hex-escaped OAEP ciphertext test vector.
Reasoning
Continuation of the second OAEP ciphertext test vector array in a crypto library's test file. It is static test data.
info ~~warn~~ → info by review encoding-hex aws-lc/crypto/rsa_extra/rsa_test.cc:139:6

33 rows of escape runs, lines 139-171 (first: 18 consecutive `\xNN` escapes (entropy 3.6 bits/byte)) (raw pass, confidence 0.65)
```
static const uint8_t kKey3[] =
    "\x30\x82\x02\x5b\x02\x01\x00\x02\x81\x81\x00\xbb\xf8\x2f\x09\x06\x82\xce"
    "\x9c\x23\x38\xac\x2b\x9d\xa8\x71\xf7\x36\x8d\x07\xee\xd4\x10\x43\xa4\x40"
    "\xd6\xb6\xf0\x74\x54\xf5\x1f\xb8\xdf\xba\xaf\x03\x5c\x02\xab\x61\xea\x48"
```
dismissed LLM, confidence 0.95 Hex-escaped DER RSA key test vector.
Reasoning
A DER-encoded RSA private key structure (SEQUENCE, version INTEGER, modulus) in a crypto library's RSA test file. This is an expected test fixture, and the raw-pass escape-run signal is a false positive here.
info ~~warn~~ → info by review encoding-hex aws-lc/crypto/rsa_extra/rsa_test.cc:177:6

7 rows of escape runs, lines 177-183 (first: 18 consecutive `\xNN` escapes (entropy 4.2 bits/byte)) (raw pass, confidence 0.65)
```
static const uint8_t kOAEPCiphertext3[] =
    "\xb8\x24\x6b\x56\xa6\xed\x58\x81\xae\xb5\x85\xd9\xa2\x5b\x2a\xd7\x90\xc4"
    "\x17\xe0\x80\x68\x1b\xf1\xac\x2b\xc3\xde\xb6\x9d\x8b\xce\xf0\xc4\x36\x6f"
    "\xec\x40\x0a\xf0\x52\xa7\x2e\x9b\x0e\xff\xb5\xb3\xf2\xf1\x92\xdb\xea\xca"
```
dismissed LLM, confidence 0.95 Hex-escaped OAEP ciphertext test vector.
Reasoning
A hex-escaped OAEP ciphertext test vector in an RSA unit test. The high-entropy content is expected for ciphertext data, and there is no executable behavior.
info ~~warn~~ → info by review encoding-hex aws-lc/crypto/rsa_extra/rsa_test.cc:187:6

66 rows of escape runs, lines 187-252 (first: 18 consecutive `\xNN` escapes (entropy 3.6 bits/byte)) (raw pass, confidence 0.65)
```
static const uint8_t kTwoPrimeKey[] =
    "\x30\x82\x04\xa1\x02\x01\x00\x02\x82\x01\x01\x00\x93\x3a\x4f\xc9\x6a\x0a"
    "\x6b\x28\x04\xfa\xb7\x05\x56\xdf\xa0\xaa\x4f\xaa\xab\x94\xa0\xa9\x25\xef"
    "\xc5\x96\xd2\xd4\x66\x16\x62\x2c\x13\x7b\x91\xd0\x36\x0a\x10\x11\x6d\x7a"
```
likely benign LLM, confidence 0.95 Test fixture embedding a DER-encoded RSA key as hex-escaped bytes in an AWS-LC unit test.
Reasoning
This is a C string literal holding a DER-encoded RSA private key used as test vector data; hex escapes are the normal way to embed binary test fixtures in C tests. Raw pass has high false-positive rate and the context is a crypto library test file.
info ~~warn~~ → info by review identifier-confusable-collision aws-lc/crypto/trust_token/pmbtoken.c:295:37

two identifiers collapse to visual skeleton `pubo_precomp` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
                                   &method->h_precomp, &key->y0, NULL, NULL) ||
      !ec_init_precomp(group, &key->pub0_precomp, &pub[0]) ||
      !ec_point_mul_scalar_precomp(group, &pub[1], &method->g_precomp, &key->x1,
                                   &method->h_precomp, &key->y1, NULL, NULL) ||
```
dismissed LLM, confidence 0.93 Local variable names in the PMBTokens implementation flagged as visually confusable after skeletonization.
Reasoning
Identifiers like pub0_precomp and pub[0] differ only by visual confusables in a skeleton comparison; this is a token-pass heuristic triggered by normal short names in cryptographic code, not a real identifier-spoofing attack in an otherwise ordinary C file.
info ~~warn~~ → info by review identifier-confusable-collision aws-lc/crypto/trust_token/pmbtoken.c:521:5

two identifiers collapse to visual skeleton `idx_Koo` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
    idx_Kb1,
    idx_Ko0,
    idx_Ko1,
    num_idx,
```
dismissed LLM, confidence 0.90 Enum indices idx_Ko0 and idx_Ko1 flagged as confusable with each other.
Reasoning
idx_Ko0 and idx_Ko1 are enum constants used as array indices in the PMBTokens implementation; the collision is an artifact of digit-letter similarity in short names, which is common in cryptographic code with indexed constants.
info ~~warn~~ → info by review identifier-confusable-collision aws-lc/crypto/trust_token/pmbtoken.c:522:5

two identifiers collapse to visual skeleton `idx_Ko|` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
    idx_Ko0,
    idx_Ko1,
    num_idx,
  };
```
dismissed LLM, confidence 0.90 Enum index idx_Ko1 flagged as confusable with idx_Ko0.
Reasoning
Same pattern as the adjacent finding: enum index names differing by a digit are flagged by the skeleton heuristic. Benign naming in ordinary crypto source.
info ~~warn~~ → info by review identifier-confusable-collision aws-lc/crypto/trust_token/pmbtoken.c:552:21

two identifiers collapse to visual skeleton `minus_co` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
  EC_SCALAR k0, k1, minus_co, uo, vo;
  if (// k0, k1 <- Zp
      !ec_random_nonzero_scalar(group, &k0, kDefaultAdditionalData) ||
```
dismissed LLM, confidence 0.90 Variable minus_co flagged as confusable in the PMBTokens scalar computation.
Reasoning
minus_co and co-style names are legitimate scalar variables in the protocol math; the flag is a confusable heuristic artifact, not a deliberate spoof.
info ~~warn~~ → info by review identifier-confusable-collision aws-lc/crypto/trust_token/pmbtoken.c:552:31

two identifiers collapse to visual skeleton `uo` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
  EC_SCALAR k0, k1, minus_co, uo, vo;
  if (// k0, k1 <- Zp
      !ec_random_nonzero_scalar(group, &k0, kDefaultAdditionalData) ||
```
dismissed LLM, confidence 0.90 Short variable uo flagged as confusable in the PMBTokens scalar declaration.
Reasoning
uo is a short mathematical variable name in the same declaration; confusable collision is incidental to short identifiers.
info ~~warn~~ → info by review identifier-confusable-collision aws-lc/crypto/trust_token/pmbtoken.c:552:35

two identifiers collapse to visual skeleton `vo` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
  EC_SCALAR k0, k1, minus_co, uo, vo;
  if (// k0, k1 <- Zp
      !ec_random_nonzero_scalar(group, &k0, kDefaultAdditionalData) ||
```
dismissed LLM, confidence 0.90 Short variable vo flagged as confusable in the PMBTokens scalar declaration.
Reasoning
vo is a short mathematical variable name in the same declaration; the flag is a heuristic false positive.
info ~~warn~~ → info by review identifier-confusable-collision aws-lc/crypto/trust_token/pmbtoken.c:640:13

two identifiers collapse to visual skeleton `co` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
  // Select c, u, v in constant-time.
  EC_SCALAR co, c0, c1, u0, u1, v0, v1;
  ec_scalar_neg(group, &co, &minus_co);
  ec_scalar_select(group, &c0, mask, &co, &cb);
```
dismissed LLM, confidence 0.90 Short scalar variable co flagged as confusable in constant-time selection code.
Reasoning
co is a short scalar name used throughout the constant-time selection code; the confusable flag is incidental and not evidence of malicious identifier spoofing.

info encoding-base64 aws-lc/crypto/x509/x509_compat_test.cc:18:1

base64-like blob (184 bytes over 3 lines, compression ratio 0.92) (in comment) (raw pass, confidence 0.36)

info encoding-base64 aws-lc/crypto/x509/x509_compat_test.cc:27:1

base64-like blob (184 bytes over 3 lines, compression ratio 0.91) (in comment) (raw pass, confidence 0.36)

info encoding-base64 aws-lc/crypto/x509/x509_compat_test.cc:35:1

base64-like blob (184 bytes over 3 lines, compression ratio 0.92) (in comment) (raw pass, confidence 0.36)

info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/x509/x509_compat_test.cc:269:1

base64-like blob (840 bytes over 14 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIICcDCCAhWgAwIBAgIUJ4z3FxZHVsBYMmzdZQkQa0S7DqcwCgYIKoZIzj0EAwIw
YDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xFjAUBgNVBAoMDUFX
UyBMaWJjcnlwdG8xEDAOBgNVBAsMB0dvb2QgQ0ExEjAQBgNVBAMMCVJvb3QgQ0Eg
```
likely benign LLM, confidence 0.93 Embedded PEM certificate in an X.509 compatibility test.
Reasoning
PEM-armored certificate in a compatibility test file; base64 of DER certificate data is expected content for X.509 tests.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/x509/x509_compat_test.cc:339:1

base64-like blob (956 bytes over 15 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIICyDCCAm2gAwIBAgIUeOrYi7ZRJCQF7SSvj9Uf4kO79hwwCgYIKoZIzj0EAwIw
YDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xFjAUBgNVBAoMDUFX
UyBMaWJjcnlwdG8xEDAOBgNVBAsMB0dvb2QgQ0ExEjAQBgNVBAMMCVJvb3QgQ0Eg
```
likely benign LLM, confidence 0.93 Embedded PEM certificate in an X.509 compatibility test.
Reasoning
Another PEM certificate test fixture in the same X.509 compatibility test file; expected content.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/x509/x509_compat_test.cc:534:1

base64-like blob (816 bytes over 13 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIICXzCCAgWgAwIBAgIC+scwCgYIKoZIzj0EAwIwYDELMAkGA1UEBhMCVVMxEzAR
BgNVBAgMCldhc2hpbmd0b24xFjAUBgNVBAoMDUFXUyBMaWJjcnlwdG8xEDAOBgNV
BAsMB0dvb2QgQ0ExEjAQBgNVBAMMCVJvb3QgQ0EgMTAgFw0xNTAxMDEwMDAwMDBa
```
likely benign LLM, confidence 0.93 Embedded PEM certificate in an X.509 compatibility test.
Reasoning
PEM certificate fixture for X.509 testing; base64 DER is the normal representation.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/x509/x509_compat_test.cc:661:1

base64-like blob (836 bytes over 14 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIICbjCCAhSgAwIBAgIUPOCXz7TBFSiqqCF2IzutCDEYpU8wCgYIKoZIzj0EAwIw
YjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xFjAUBgNVBAoMDUFX
UyBMaWJjcnlwdG8xEDAOBgNVBAsMB0dvb2QgQ0ExFDASBgNVBAMMC0ludCBOQyBD
```
likely benign LLM, confidence 0.93 Embedded PEM intermediate certificate in an X.509 compatibility test.
Reasoning
PEM certificate fixture for an intermediate CA in a test file; normal test data.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/x509/x509_compat_test.cc:726:1

base64-like blob (832 bytes over 13 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIICazCCAhKgAwIBAgIUMxliFKmKAnSgulWtc8mkfoPOGH4wCgYIKoZIzj0EAwIw
YjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xFjAUBgNVBAoMDUFX
UyBMaWJjcnlwdG8xEDAOBgNVBAsMB0dvb2QgQ0ExFDASBgNVBAMMC0ludCBOQyBD
```
likely benign LLM, confidence 0.93 Embedded PEM certificate in an X.509 compatibility test.
Reasoning
PEM certificate fixture in the X.509 compatibility test; base64 encoding of DER is expected.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/x509/x509_compat_test.cc:789:1

base64-like blob (840 bytes over 14 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIICcTCCAhegAwIBAgIUehUYwNk5ttmOmimH2GqtzluQzEkwCgYIKoZIzj0EAwIw
YjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xFjAUBgNVBAoMDUFX
UyBMaWJjcnlwdG8xEDAOBgNVBAsMB0dvb2QgQ0ExFDASBgNVBAMMC0ludCBOQyBD
```
likely benign LLM, confidence 0.97 Embedded PEM test certificate in AWS-LC x509 compatibility test.
Reasoning
Raw-pass base64 finding on a PEM certificate block embedded in a C++ test file. The text is standard PEM X.509 certificate encoding (BEGIN CERTIFICATE header, DER base64 with recognizable ASN.1 prefixes and subject strings like 'AWS LibCrypto', 'Good CA'). Test fixtures of certificates are expected in a crypto library's compat tests; no execution or obfuscation is involved.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/x509/x509_compat_test.cc:916:1

base64-like blob (852 bytes over 14 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIICezCCAiKgAwIBAgIUUGmaoJWZL6bmsXKTiFZkvTOYg5IwCgYIKoZIzj0EAwIw
YjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xFjAUBgNVBAoMDUFX
UyBMaWJjcnlwdG8xEDAOBgNVBAsMB0dvb2QgQ0ExFDASBgNVBAMMC0ludCBOQyBD
```
likely benign LLM, confidence 0.97 Embedded PEM test certificate fixture in AWS-LC compat test.
Reasoning
Same pattern as the other findings: a PEM certificate fixture with standard ASN.1/base64 structure and readable subject names in a crypto library's test file. Raw-pass base64 heuristic firing on legitimate key/cert material is a known false-positive mode.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/x509/x509_compat_test.cc:978:1

base64-like blob (852 bytes over 14 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIICejCCAiGgAwIBAgIUFaUdWjcEZ9sM/xT+Xkhr/rvTE2wwCgYIKoZIzj0EAwIw
YjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xFjAUBgNVBAoMDUFX
UyBMaWJjcnlwdG8xEDAOBgNVBAsMB0dvb2QgQ0ExFDASBgNVBAMMC0ludCBOQyBD
```
likely benign LLM, confidence 0.97 Embedded PEM test certificate fixture in AWS-LC compat test.
Reasoning
PEM certificate block with standard DER-encoded base64 content in a test file of a cryptographic library. Expected test data, not obfuscated payload.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/x509/x509_compat_test.cc:1040:1

base64-like blob (856 bytes over 14 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIICfjCCAiWgAwIBAgIUdWJcMLAOwhnArl3xMnAJnH8O29EwCgYIKoZIzj0EAwIw
YjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xFjAUBgNVBAoMDUFX
UyBMaWJjcnlwdG8xEDAOBgNVBAsMB0dvb2QgQ0ExFDASBgNVBAMMC0ludCBOQyBD
```
likely benign LLM, confidence 0.97 Embedded PEM test certificate fixture in AWS-LC compat test.
Reasoning
PEM certificate fixture with typical X.509 base64 structure and readable subject strings; consistent with a certificate-chain test in a crypto library.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/x509/x509_compat_test.cc:1164:1

base64-like blob (860 bytes over 14 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIICgTCCAiegAwIBAgIUJyLrnDf1ZyuhIgIexGoXoZd3N0YwCgYIKoZIzj0EAwIw
bTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xFjAUBgNVBAoMDUFX
UyBMaWJjcnlwdG8xDzANBgNVBAsMBkJhZCBDQTEgMB4GA1UEAwwXSW50IE5DIENB
```
likely benign LLM, confidence 0.97 Embedded PEM test certificate fixture (bad-CA negative case) in AWS-LC compat test.
Reasoning
PEM certificate fixture (a 'Bad CA' variant used for negative tests) with standard base64-encoded DER. Legitimate test data for certificate validation paths.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/x509/x509_compat_test.cc:1288:1

base64-like blob (876 bytes over 14 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIICjTCCAjOgAwIBAgIUQ85oeYTx12D/svXFcD6FVZ6s0kYwCgYIKoZIzj0EAwIw
bTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xFjAUBgNVBAoMDUFX
UyBMaWJjcnlwdG8xDzANBgNVBAsMBkJhZCBDQTEgMB4GA1UEAwwXSW50IE5DIENB
```
likely benign LLM, confidence 0.97 Embedded PEM test certificate fixture (bad-CA negative case) in AWS-LC compat test.
Reasoning
PEM certificate fixture for a negative test case in a crypto library; standard X.509 DER base64 with readable subject fields. Not executable or obfuscated.
info ~~warn~~ → info by review encoding-base64 aws-lc/crypto/x509/x509_compat_test.cc:1547:1

base64-like blob (840 bytes over 14 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIICcDCCAhagAwIBAgIUSNu3E7HssOiTs61FkbhbgoYPs/swCgYIKoZIzj0EAwIw
YjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xFjAUBgNVBAoMDUFX
UyBMaWJjcnlwdG8xEDAOBgNVBAsMB0dvb2QgQ0ExFDASBgNVBAMMC0ludCBOQyBD
```
likely benign LLM, confidence 0.97 Embedded PEM test certificate fixture in AWS-LC compat test.
Reasoning
PEM certificate fixture in a test file with standard ASN.1 base64 structure. Benign test data typical of X.509 library test suites.

info encoding-base64 aws-lc/crypto/x509/x509_test.cc:1083:4

13 rows of base64-like lines, lines 1083-1095 (first: base64-like blob (64 bytes, compression ratio 1.17) (in comment)) (raw pass, confidence 0.36)

// -----BEGIN RSA PRIVATE KEY-----
// MIICWwIBAAKBgQDbRn2TLhInBki8Bighq37EtqJd/h5SRYh6NkelCA2SQlvCgcC+
// l3mYQPtPbRT9KxOLwqUuZ9jUCZ7WIji3Sgt0cyvCNPHRk+WW2XR781ifbGE8wLBB
// 1NkrKyQjd1scO711Xc4gVM+hY4cdHiTE8x0aUIuqthRD7ZendWL0FMhS1wIDAQAB

info encoding-base64 aws-lc/crypto/x509/x509_test.cc:1117:4

13 rows of base64-like lines, lines 1117-1129 (first: base64-like blob (64 bytes, compression ratio 1.17) (in comment)) (raw pass, confidence 0.36)

// -----BEGIN RSA PRIVATE KEY-----
// MIICXAIBAAKBgQDpDn8RDOZa5oaDcPZRBy4CeBH1siSSOO4mYgLHlPE+oXdqwI/V
// Imi2XeJM2uCFETXCknJJjYG0iJdrt/yyRFvZTQZw+QzGj+mz36NqhGxDWb6dstB2
// m8PX+plZw7jl81MDvUnWs8yiQ/6twgu5AbhWKZQDJKcNKCEpqa6UW0r5nwIDAQAB

info unicode-mixed-script aws-lc/ssl/handshake.cc:354:49

identifier `xωaωa` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

                                      enum ssl_grease_index_t index) {
  // This generates a random value of the form 0xωaωa, for all 0 ≤ ω < 16.
  uint16_t ret = hs->grease_seed[index];
  ret = (ret & 0xf0) | 0x0a;

info identifier-low-length aws-lc/third_party/jitterentropy/jitterentropy-library/src/jitterentropy-sha3.c:1:1

519 of 943 non-conventional identifiers are single-character (55%) (token pass, confidence 0.50)

info high-complexity builder/fips_probe.rs:118:14

compression ratio 0.799 is >2σ above file mean 0.689 (raw pass, confidence 0.50)

        return Err(format!(
            "FIPS verification requires a Clang-, GCC-, or MSVC-compatible compiler; \
             {} is not supported. Set CC to a supported compiler.",
            compiler.path().display(),

info high-complexity builder/main.rs:1378:14

compression ratio 0.827 is >2σ above file mean 0.682 (raw pass, confidence 0.50)

        emit_warning(
            "If bindgen is unable to locate a header file, use the \
            BINDGEN_EXTRA_CLANG_ARGS environment variable to specify additional include paths.",
        );

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o aws-lc-sys-0.47.0.crate 'https://static.crates.io/crates/aws%2Dlc%2Dsys/aws%2Dlc%2Dsys-0%2E47%2E0.crate'
printf '%s  %s\n' 8bfbe32ac36b3c428696ce315464181bc4029d689fd58e3f2a4e58c252242f52 aws-lc-sys-0.47.0.crate | shasum -a 256 -c -
mkdir pkg && tar -xzf aws-lc-sys-0.47.0.crate -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg