tinyvec 1.13.3

Source: https://github.com/Lokathor/tinyvec
Tag scanned: v1.13.3
Compared with: v1.13.2 (0 signals introduced since)
Files: 31 scanned, 4 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 3 info
Scan time: 4.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 21:18

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review path-command-shadow fuzz/README.md:4:1

[embedded bash] redirect writes to `cargo` — filename matches a system command (PATH hijack setup) (ast pass, confidence 0.88)
```
> cargo install honggfuzz
> cargo hfuzz run arrayish
```
dismissed LLM, confidence 0.93 Markdown docs showing how to install and run honggfuzz with cargo, misparsed as a redirect into a file named cargo.
Reasoning
The file is a markdown README. The flagged 'redirect' is the markdown blockquote marker '>' in front of an ordinary cargo command (cargo install honggfuzz / cargo hfuzz run). The scanner read the blockquote marker as a shell redirect and the word 'cargo' as a filename. No file is written and no PATH is modified. This is a parser false positive on documentation.
info ~~critical~~ → info by review path-command-shadow fuzz/README.md:5:1

[embedded bash] redirect writes to `cargo` — filename matches a system command (PATH hijack setup) (ast pass, confidence 0.88)
```
> cargo install honggfuzz
> cargo hfuzz run arrayish
```
dismissed LLM, confidence 0.93 Duplicate of the same blockquoted cargo honggfuzz instructions in the fuzz README, misread as a PATH-hijack redirect.
Reasoning
Same snippet and same cause as fuzz/README.md:4:1. The '>' is a markdown blockquote prefix on a cargo command in a fuzzing README, not a shell redirect. Nothing is written to a path named cargo.
info ~~critical~~ → info by review path-command-shadow fuzz/README.md:10:1

[embedded bash] redirect writes to `cargo` — filename matches a system command (PATH hijack setup) (ast pass, confidence 0.88)
```
> cargo hfuzz run-debug arrayish hfuzz_workspace/arrayish/*.fuzz
```
dismissed LLM, confidence 0.93 Blockquoted cargo hfuzz run-debug example in the fuzz README, flagged as a PATH-hijack redirect.
Reasoning
The line is a blockquoted 'cargo hfuzz run-debug arrayish ...' command in documentation. The '>' is a markdown quote marker and the scanner's redirect detection is wrong. It is a legitimate fuzzing usage example.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/Lokathor/tinyvec tinyvec && cd tinyvec
git checkout v1.13.3
disclude scan --severity info --diff v1.13.2 .