reqwest 0.13.5

Source: https://github.com/seanmonstar/reqwest
Tag scanned: v0.13.5
Compared with: v0.13.4 (0 signals introduced since)
Files: 80 scanned, 9 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 2 info
Scan time: 2.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 21:18

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review encoding-base64 src/tls.rs:867:13

base64-like blob (592 bytes over 10 lines, compression ratio 0.76) (raw pass, confidence 0.60)
```
            -----BEGIN CERTIFICATE-----
            MIIBtjCCAVugAwIBAgITBmyf1XSXNmY/Owua2eiedgPySjAKBggqhkjOPQQDAjA5
            MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6b24g
            Um9vdCBDQSAzMB4XDTE1MDUyNjAwMDAwMFoXDTQwMDUyNjAwMDAwMFowOTELMAkG
```
likely benign LLM, confidence 0.97 Embedded PEM certificate (Amazon Root CA) in a Rust TLS source file.
Reasoning
The snippet is a PEM-encoded X.509 certificate (BEGIN CERTIFICATE header, Amazon Root CA content, base64 lines). This is standard embedded trust-anchor data in a TLS module, a legitimate pattern. The raw pass flags any base64 blob, so this is a known false-positive class.
info ~~warn~~ → info by review encoding-base64 src/tls.rs:880:13

base64-like blob (672 bytes over 11 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
            -----BEGIN CERTIFICATE-----
            MIIB8jCCAXigAwIBAgITBmyf18G7EEwpQ+Vxe3ssyBrBDjAKBggqhkjOPQQDAzA5
            MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6b24g
            Um9vdCBDQSA0MB4XDTE1MDUyNjAwMDAwMFoXDTQwMDUyNjAwMDAwMFowOTELMAkG
```
likely benign LLM, confidence 0.97 Embedded PEM certificate (Amazon Root CA) in a Rust TLS source file.
Reasoning
Same pattern: a PEM certificate block (Amazon Root CA 4 style) with standard base64 DER content and X.509 structure visible. Raw-pass base64 heuristic on legitimate certificate data in a TLS module; no execution or concealment indicated.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/seanmonstar/reqwest reqwest && cd reqwest
git checkout v0.13.5
disclude scan --severity info --diff v0.13.4 .