Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
if s.startswith(GZIP_HEAD):
decompressor = zlib.decompressobj()
else:
decompressor = zlib.decompressobj(-zlib.MAX_WBITS)
likely benign
LLM, confidence 0.92
Implements optional DEFLATE decompression for JWE payloads per the JOSE zip header.
Reasoning
The code selects zlib gzip or raw deflate for JWE 'zip' header compression, which is the RFC 7516 DEF algorithm. The decompression operates on the caller's own JWE payload and is a standard, expected use of zlib in a JOSE library.
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
.
OKOawDo13gRp2ojaHV7LFpZcgV7T6DVZKTyKOMTYUmKoTCVJRgckCL9kiMT03JGe
ipsEdY3mx_etLbbWSrFr05kLzcSr4qKAq7YN7e9jwQRb23nfa6c9d-StnImGyFDb
Sv04uVuxIp5Zms1gNxKKK2Da14B8S4rzVRltdYwam_lDp5XnZAYpQdb76FdIKLaV
likely benign
LLM, confidence 0.93
Documentation example of a base64url-encoded JWE token.
Reasoning
The raw pass flagged a base64url-looking string inside an RST documentation block. It is a compact-serialization example token in the JWE docs, and documentation examples like this are expected.
-
base64-like blob (94 bytes over 2 lines, compression ratio 1.05) (raw pass, confidence 0.60)
.
eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFt
cGxlLmNvbS9pc19yb290Ijp0cnVlfQ
.
likely benign
LLM, confidence 0.94
Documentation example of a base64url-encoded JWS payload.
Reasoning
This is a base64url-encoded JWS payload example in the JWS documentation, decoding to a short JSON claim set. The raw-pass base64 heuristic is a false positive on a doc example.
-
base64-like blob (94 bytes over 2 lines, compression ratio 1.05) (raw pass, confidence 0.60)
"payload":
"eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGF
tcGxlLmNvbS9pc19yb290Ijp0cnVlfQ",
"signatures":[
likely benign
LLM, confidence 0.94
Documentation example of a base64url payload in a JWS JSON serialization.
Reasoning
This is the same documented JWS payload example, shown in a JSON serialization example. It is a doc sample, not an obfuscated payload.
-
base64-like blob (94 bytes over 2 lines, compression ratio 1.05) (raw pass, confidence 0.60)
"payload":
"eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGF
tcGxlLmNvbS9pc19yb290Ijp0cnVlfQ",
"protected":"eyJhbGciOiJFUzI1NiJ9",
likely benign
LLM, confidence 0.94
Documentation example of a base64url payload in a JWS JSON serialization.
Reasoning
The same documented JWS payload appears again in a flattened or general JSON serialization example. It is a repeated doc sample with no executable or hidden behaviour.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
_shared_key_e_at_alice
== b"\x9e\x56\xd9\x1d\x81\x71\x35\xd3\x72\x83\x42\x83\xbf\x84\x26\x9c"
+ b"\xfb\x31\x6e\xa3\xda\x80\x6a\x48\xf6\xda\xa7\x79\x8c\xfe\x90\xc4"
)
likely benign
LLM, confidence 0.95
Known-answer test vector bytes for an ECDH-1PU shared key in a unit test.
Reasoning
The hex escapes are byte literals for expected ECDH-1PU shared-key test vectors, compared with assert. Cryptographic test vectors are expected to be high-entropy binary data.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
== b"\x9e\x56\xd9\x1d\x81\x71\x35\xd3\x72\x83\x42\x83\xbf\x84\x26\x9c"
+ b"\xfb\x31\x6e\xa3\xda\x80\x6a\x48\xf6\xda\xa7\x79\x8c\xfe\x90\xc4"
)
likely benign
LLM, confidence 0.95
Continuation of the ECDH-1PU test-vector bytes in a unit test assertion.
Reasoning
This is the continuation of the same test-vector byte literal used in an equality assertion. It is standard cryptographic test data.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
_shared_key_s_at_alice
== b"\xe3\xca\x34\x74\x38\x4c\x9f\x62\xb3\x0b\xfd\x4c\x68\x8b\x3e\x7d"
+ b"\x41\x10\xa1\xb4\xba\xdc\x3c\xc5\x4e\xf7\xb8\x12\x41\xef\xd5\x0d"
)
likely benign
LLM, confidence 0.95
Expected static shared-key test vector bytes in an ECDH-1PU test.
Reasoning
The byte literal is an expected derived key value for the sender-static shared key in a test. It is test fixture data compared against computed output.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
== b"\xe3\xca\x34\x74\x38\x4c\x9f\x62\xb3\x0b\xfd\x4c\x68\x8b\x3e\x7d"
+ b"\x41\x10\xa1\xb4\xba\xdc\x3c\xc5\x4e\xf7\xb8\x12\x41\xef\xd5\x0d"
)
likely benign
LLM, confidence 0.95
Continuation of the static shared-key test vector bytes in an assertion.
Reasoning
This is the continuation of the static shared-key test vector in an assertion. It is ordinary test data.
-
4 rows of escape runs, lines 92-95 (first: 16 consecutive `\xNN` escapes (entropy 3.9 bits/byte)) (raw pass, confidence 0.65)
_shared_key_at_alice
== b"\x9e\x56\xd9\x1d\x81\x71\x35\xd3\x72\x83\x42\x83\xbf\x84\x26\x9c"
+ b"\xfb\x31\x6e\xa3\xda\x80\x6a\x48\xf6\xda\xa7\x79\x8c\xfe\x90\xc4"
+ b"\xe3\xca\x34\x74\x38\x4c\x9f\x62\xb3\x0b\xfd\x4c\x68\x8b\x3e\x7d"
likely benign
LLM, confidence 0.95
Multi-row expected key bytes used as a test vector in ECDH-1PU tests.
Reasoning
Multiple rows of hex-escaped bytes form a combined expected key in a test file. This is repeated known-answer test data, consistent with cryptographic test vectors.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
_dk_at_alice
== b"\x6c\xaf\x13\x72\x3d\x14\x85\x0a\xd4\xb4\x2c\xd6\xdd\xe9\x35\xbf"
+ b"\xfd\x2f\xff\x00\xa9\xba\x70\xde\x05\xc2\x03\xa5\xe1\x72\x2c\xa7"
)
likely benign
LLM, confidence 0.94
Expected derived-key test vector bytes in an ECDH-1PU test.
Reasoning
The hex-escaped bytes are expected derived-key test vectors compared by assertion in a unit test. This is standard test fixture content.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
== b"\x6c\xaf\x13\x72\x3d\x14\x85\x0a\xd4\xb4\x2c\xd6\xdd\xe9\x35\xbf"
+ b"\xfd\x2f\xff\x00\xa9\xba\x70\xde\x05\xc2\x03\xa5\xe1\x72\x2c\xa7"
)
assert (
likely benign
LLM, confidence 0.94
Continuation of the derived-key test vector bytes in an assertion.
Reasoning
This continues the derived-key test vector inside an equality assertion. It is test data, not hidden code.
-
concatenated bytes literal contains 64 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
cek = (
b"\xff\xfe\xfd\xfc\xfb\xfa\xf9\xf8\xf7\xf6\xf5\xf4\xf3\xf2\xf1\xf0"
b"\xef\xee\xed\xec\xeb\xea\xe9\xe8\xe7\xe6\xe5\xe4\xe3\xe2\xe1\xe0"
b"\xdf\xde\xdd\xdc\xdb\xda\xd9\xd8\xd7\xd6\xd5\xd4\xd3\xd2\xd1\xd0"
likely benign
LLM, confidence 0.93
Fixed test content-encryption-key bytes in a unit test.
Reasoning
The concatenated bytes are a sequential 0xff down to 0xf0 pattern used as a fixed content-encryption key in a test. It is a deterministic test fixture, not a real payload or obfuscated dropper.
-
5 rows of escape runs, lines 209-215 (first: 16 consecutive `\xNN` escapes (entropy 4.0 bits/byte)) (raw pass, confidence 0.65)
cek = (
b"\xff\xfe\xfd\xfc\xfb\xfa\xf9\xf8\xf7\xf6\xf5\xf4\xf3\xf2\xf1\xf0"
b"\xef\xee\xed\xec\xeb\xea\xe9\xe8\xe7\xe6\xe5\xe4\xe3\xe2\xe1\xe0"
b"\xdf\xde\xdd\xdc\xdb\xda\xd9\xd8\xd7\xd6\xd5\xd4\xd3\xd2\xd1\xd0"
likely benign
LLM, confidence 0.97
Hex byte literals for ECDH-1PU JOSE test vectors in a unit test.
Reasoning
Raw byte-escape runs in a test file holding known-answer cryptographic test vectors (CEK, shared keys, fixed info). Sequential 0xff..0xe0 pattern is a deterministic test fixture, not obfuscation.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
_shared_key_e_at_alice_for_bob
== b"\x32\x81\x08\x96\xe0\xfe\x4d\x57\x0e\xd1\xac\xfc\xed\xf6\x71\x17"
+ b"\xdc\x19\x4e\xd5\xda\xac\x21\xd8\xff\x7a\xf3\x24\x46\x94\x89\x7f"
)
likely benign
LLM, confidence 0.97
Expected shared-key bytes literal used in an ECDH-1PU assertion.
Reasoning
Known-answer test vector bytes for a derived shared key in a jose cryptography test suite; high entropy is expected for key material fixtures.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
== b"\x32\x81\x08\x96\xe0\xfe\x4d\x57\x0e\xd1\xac\xfc\xed\xf6\x71\x17"
+ b"\xdc\x19\x4e\xd5\xda\xac\x21\xd8\xff\x7a\xf3\x24\x46\x94\x89\x7f"
)
likely benign
LLM, confidence 0.97
Second half of expected shared-key bytes in a test assertion.
Reasoning
Continuation of the same test vector comparison; legitimate test fixture data.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
_shared_key_s_at_alice_for_bob
== b"\x21\x57\x61\x2c\x90\x48\xed\xfa\xe7\x7c\xb2\xe4\x23\x71\x40\x60"
+ b"\x59\x67\xc0\x5c\x7f\x77\xa4\x8e\xea\xf2\xcf\x29\xa5\x73\x7c\x4a"
)
likely benign
LLM, confidence 0.97
Expected shared-key bytes literal in an ECDH-1PU test.
Reasoning
Known-answer test vector for a second shared key in a cryptography test; benign fixture.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
== b"\x21\x57\x61\x2c\x90\x48\xed\xfa\xe7\x7c\xb2\xe4\x23\x71\x40\x60"
+ b"\x59\x67\xc0\x5c\x7f\x77\xa4\x8e\xea\xf2\xcf\x29\xa5\x73\x7c\x4a"
)
likely benign
LLM, confidence 0.97
Second half of the expected shared-key bytes in a test.
Reasoning
Continuation of the same test vector; benign.
-
4 rows of escape runs, lines 267-270 (first: 16 consecutive `\xNN` escapes (entropy 4.0 bits/byte)) (raw pass, confidence 0.65)
_shared_key_at_alice_for_bob
== b"\x32\x81\x08\x96\xe0\xfe\x4d\x57\x0e\xd1\xac\xfc\xed\xf6\x71\x17"
+ b"\xdc\x19\x4e\xd5\xda\xac\x21\xd8\xff\x7a\xf3\x24\x46\x94\x89\x7f"
+ b"\x21\x57\x61\x2c\x90\x48\xed\xfa\xe7\x7c\xb2\xe4\x23\x71\x40\x60"
likely benign
LLM, confidence 0.97
Multi-row expected key-material byte literal in a test.
Reasoning
Concatenated known-answer test vector for a combined key derivation input in a crypto test file; benign.
-
16 consecutive `\xNN` escapes (entropy 3.6 bits/byte) (raw pass, confidence 0.65)
_fixed_info_at_alice_for_bob
== b"\x00\x00\x00\x0f\x45\x43\x44\x48\x2d\x31\x50\x55\x2b\x41\x31\x32"
+ b"\x38\x4b\x57\x00\x00\x00\x05\x41\x6c\x69\x63\x65\x00\x00\x00\x0f"
+ b"\x42\x6f\x62\x20\x61\x6e\x64\x20\x43\x68\x61\x72\x6c\x69\x65\x00"
likely benign
LLM, confidence 0.97
Fixed-info encoding bytes for a KDF test vector.
Reasoning
Fixed-info structure bytes (ASCII 'ECDH-1PU+A128KW', 'Alice', 'Bob and Charlie') visible in the literal, confirming a standard KDF test vector.
-
16 consecutive `\xNN` escapes (entropy 3.8 bits/byte) (raw pass, confidence 0.65)
+ b"\x38\x4b\x57\x00\x00\x00\x05\x41\x6c\x69\x63\x65\x00\x00\x00\x0f"
+ b"\x42\x6f\x62\x20\x61\x6e\x64\x20\x43\x68\x61\x72\x6c\x69\x65\x00"
+ b"\x00\x00\x80\x00\x00\x00\x20\x1c\xb6\xf8\x7d\x39\x66\xf2\xca\x46"
+ b"\x9a\x28\xf7\x47\x23\xac\xda\x02\x78\x0e\x91\xcc\xe2\x18\x55\x47"
likely benign
LLM, confidence 0.97
Continuation of fixed-info bytes in a KDF test.
Reasoning
Continuation of the KDF fixed-info test vector; benign.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
+ b"\x00\x00\x80\x00\x00\x00\x20\x1c\xb6\xf8\x7d\x39\x66\xf2\xca\x46"
+ b"\x9a\x28\xf7\x47\x23\xac\xda\x02\x78\x0e\x91\xcc\xe2\x18\x55\x47"
+ b"\x07\x45\xfe\x11\x9b\xdd\x64"
)
likely benign
LLM, confidence 0.97
Trailing fixed-info bytes in a test vector.
Reasoning
Final rows of the KDF test vector; benign test fixture.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
_dk_at_alice_for_bob
== b"\xdf\x4c\x37\xa0\x66\x83\x06\xa1\x1e\x3d\x6b\x00\x74\xb5\xd8\xdf"
)
likely benign
LLM, confidence 0.97
Expected derived key bytes in an ECDH-1PU test.
Reasoning
Expected derived-key bytes for an assertion in a crypto test; benign fixture.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
dk_at_alice_for_bob
== b"\xdf\x4c\x37\xa0\x66\x83\x06\xa1\x1e\x3d\x6b\x00\x74\xb5\xd8\xdf"
)
likely benign
LLM, confidence 0.97
Expected derived key bytes in a second test.
Reasoning
Repeated expected derived-key vector in another test; benign.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
_shared_key_e_at_alice_for_charlie
== b"\x89\xdc\xfe\x4c\x37\xc1\xdc\x02\x71\xf3\x46\xb5\xb3\xb1\x9c\x3b"
+ b"\x70\x5c\xa2\xa7\x2f\x9a\x23\x77\x85\xc3\x44\x06\xfc\xb7\x5f\x10"
)
likely benign
LLM, confidence 0.97
Expected shared-key bytes for an Alice-Charlie test case.
Reasoning
Known-answer shared-key vector for a second recipient pairing in a test; benign.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
== b"\x89\xdc\xfe\x4c\x37\xc1\xdc\x02\x71\xf3\x46\xb5\xb3\xb1\x9c\x3b"
+ b"\x70\x5c\xa2\xa7\x2f\x9a\x23\x77\x85\xc3\x44\x06\xfc\xb7\x5f\x10"
)
likely benign
LLM, confidence 0.97
Continuation of expected shared-key bytes in a test.
Reasoning
Continuation of the Alice-Charlie test vector; benign.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
_shared_key_s_at_alice_for_charlie
== b"\x78\xfe\x63\xfc\x66\x1c\xf8\xd1\x8f\x92\xa8\x42\x2a\x64\x18\xe4"
+ b"\xed\x5e\x20\xa9\x16\x81\x85\xfd\xee\xdc\xa1\xc3\xd8\xe6\xa6\x1c"
)
likely benign
LLM, confidence 0.97
Byte-literal test vector for an expected ECDH-1PU shared key in a jose test file.
Reasoning
Raw-pass hex escapes inside a test asserting derived shared key bytes; these are known-answer test vectors from the ECDH-1PU spec, a legitimate pattern in crypto test suites.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
== b"\x78\xfe\x63\xfc\x66\x1c\xf8\xd1\x8f\x92\xa8\x42\x2a\x64\x18\xe4"
+ b"\xed\x5e\x20\xa9\x16\x81\x85\xfd\xee\xdc\xa1\xc3\xd8\xe6\xa6\x1c"
)
likely benign
LLM, confidence 0.97
Second half of the expected shared key test vector.
Reasoning
Continuation of the same known-answer byte literal for cryptographic test vectors; high-entropy bytes are expected for key material test data.
-
4 rows of escape runs, lines 340-343 (first: 16 consecutive `\xNN` escapes (entropy 3.9 bits/byte)) (raw pass, confidence 0.65)
_shared_key_at_alice_for_charlie
== b"\x89\xdc\xfe\x4c\x37\xc1\xdc\x02\x71\xf3\x46\xb5\xb3\xb1\x9c\x3b"
+ b"\x70\x5c\xa2\xa7\x2f\x9a\x23\x77\x85\xc3\x44\x06\xfc\xb7\x5f\x10"
+ b"\x78\xfe\x63\xfc\x66\x1c\xf8\xd1\x8f\x92\xa8\x42\x2a\x64\x18\xe4"
likely benign
LLM, confidence 0.97
Multi-line expected key bytes in a JOSE ECDH test.
Reasoning
Multi-row escape run is a concatenated expected-value test vector for key derivation output, consistent with cryptographic test fixtures in a library.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
_dk_at_alice_for_charlie
== b"\x57\xd8\x12\x6f\x1b\x7e\xc4\xcc\xb0\x58\x4d\xac\x03\xcb\x27\xcc"
)
likely benign
LLM, confidence 0.97
Expected derived key bytes asserted in an ECDH-1PU test.
Reasoning
Expected derived-key byte constant used to assert cryptographic output in a unit test; benign test vector.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
dk_at_alice_for_charlie
== b"\x57\xd8\x12\x6f\x1b\x7e\xc4\xcc\xb0\x58\x4d\xac\x03\xcb\x27\xcc"
)
likely benign
LLM, confidence 0.97
Expected derived key bytes asserted in a second ECDH-1PU test.
Reasoning
Duplicate of the same expected derived-key test vector used in another assertion; benign.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
data = {
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
likely benign
LLM, confidence 0.96
Split base64 JWE protected header in a test vector.
Reasoning
Base64url-encoded JWE protected header in a test fixture, decoding to ordinary JSON header fields (alg, enc, apu, epk). Standard JOSE test data with low compression-based concern.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
+ "RnFVQUZhMzlkeUJjIn19",
likely benign
LLM, confidence 0.96
Continuation of a JWE protected header test fixture.
Reasoning
Continuation of the same base64url JWE protected header test fixture; benign.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
+ "RnFVQUZhMzlkeUJjIn19",
"unprotected": {"jku": "https://provider.test/jwks"},
likely benign
LLM, confidence 0.96
Final segment of a JWE protected header test fixture.
Reasoning
Final segment of the base64url JWE protected header test fixture; benign.
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
"crv": "P-521",
"x": "1JDMOjnMgASo01PVHRcyCDtE6CLgKuwXLXLbdLGxpdubLuHYBa0KAepyimnxCWsX",
"y": "w7BSC8Xb3XgMMfE7IFCJpoOmx1Sf3T3_3OZ4CrF6_iCFAw4VOdFYR42OnbKMFG--",
"d": "lCkpFBaVwHzfHtkJEV3PzxefObOPnMgUjNZSLryqC5AkERgXT3-DZLEi6eBzq5gk",
likely benign
LLM, confidence 0.96
EC P-521 JWK coordinates in a test case.
Reasoning
P-521 EC public/private coordinates in a JWK test fixture, with a comment indicating point validation; expected test key material.
-
base64-like blob (87 bytes, compression ratio 1.05) (raw pass, confidence 0.60)
"x": "Cd6rinJdgS4WJj6iaNyXiVhpMbhZLmPykmrnFhIad04B3ulf5pURb5v9mx21c_Cv8Q1RBOptwleLg5Qjq2J1qa4",
"y": "hXo9p1EjW6W4opAQdmfNgyxztkNxYwn9L4FVTLX51KNEsW0aqueLm96adRmf0HoGIbNhIdcIlXOKlRUHqgunDkM",
}
likely benign
LLM, confidence 0.96
Test EC point coordinates for curve validation.
Reasoning
EC point coordinates used to test on-curve validation for P-521, explicitly commented; benign test data.
-
base64-like blob (75 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
"crv": "X25519",
"x": "lVHcPx4R9bExaoxXZY9tAq7SNW9pJKCoVQxURLtkAs3Dg5ZRxcjhf0JUyg2lod5OGDptJ7wowwY",
}
)
likely benign
LLM, confidence 0.96
X25519 public key used in a curve-mismatch test.
Reasoning
X25519 public key value in a negative test for wrong-curve points, commented as intentional; benign.
-
base64-like blob (75 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
"crv": "X448",
"x": "lVHcPx4R9bExaoxXZY9tAq7SNW9pJKCoVQxURLtkAs3Dg5ZRxcjhf0JUyg2lod5OGDptJ7wowwY",
}
)
likely benign
LLM, confidence 0.96
X448 public key used in a curve validation test.
Reasoning
X448 public key test vector with explicit comment confirming curve membership; benign test data.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
data = {
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
likely benign
LLM, confidence 0.96
Base64url JWE protected header test fixture in test_jwe.py.
Reasoning
Base64url JWE protected header test fixture identical to the ecdh_1pu one, decoding to ordinary JOSE header fields; benign.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
+ "RnFVQUZhMzlkeUJjIn19",
likely benign
LLM, confidence 0.95
A split base64 JWE protected header in a JOSE library test file.
Reasoning
The raw pass flags a base64 fragment in a JWE test vector. The concatenated string decodes to a JOSE protected header (ECDH-1PU+A128KW, A256CBC-HS512, an OKP/X25519 ephemeral key). This is a standard test fixture for a JOSE library, and the file is under tests/. Raw base64 matches have a high false-positive rate, and nothing here is executed or hidden.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
+ "RnFVQUZhMzlkeUJjIn19",
"unprotected": {"jku": "https://provider.test/jwks"},
likely benign
LLM, confidence 0.95
Continuation of the base64 JWE protected header test fixture.
Reasoning
This is a continuation of the same base64-encoded JWE protected header test vector, decoding to ECDH key-agreement parameters and an X25519 ephemeral public key. It is expected data in a cryptography test suite.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
data = {
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
likely benign
LLM, confidence 0.95
Base64 JWE protected header inside a test data dictionary.
Reasoning
The same JWE protected header test vector appears inside a test data dictionary. It is a fixed, well-formed JOSE header with no executable or obfuscated payload.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
+ "RnFVQUZhMzlkeUJjIn19",
likely benign
LLM, confidence 0.95
Continuation of the base64 JWE protected header test fixture.
Reasoning
A continuation of the same JWE protected header test fixture. The encoded content is a standard ECDH-1PU header with an X25519 ephemeral key, consistent with test data for a JOSE library.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
+ "RnFVQUZhMzlkeUJjIn19",
"unprotected": {"jku": "https://provider.test/jwks"},
likely benign
LLM, confidence 0.95
Final fragment of the base64 JWE test header, with a reserved .test jku URL.
Reasoning
Final fragment of the same JWE protected header test vector, including the jku header pointing to a .test domain. The .test TLD is reserved, so this is a placeholder URL in a test, not a live endpoint.
-
base64-like blob (236 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
{
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1IjoiUVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9LUCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFBRnFVQUZhMzlkeUJjIn19",
"unprotected": {
likely benign
LLM, confidence 0.95
Full base64 JWE protected header as a single test-fixture string.
Reasoning
The full JWE protected header appears as a single string in a test dictionary, a legitimate fixture. It decodes to a well-formed JOSE header, and the raw-pass base64 signal is a false positive on structured test data.
-
base64-like blob (236 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
{
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1IjoiUVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9LUCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFBRnFVQUZhMzlkeUJjIn19",
"unprotected": {
likely benign
LLM, confidence 0.95
Repeated base64 JWE protected header test fixture.
Reasoning
Same JWE protected header fixture repeated in another test case. Repetition across test functions is normal for a crypto library test suite.
-
base64-like blob (236 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
{
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1IjoiUVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9LUCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFBRnFVQUZhMzlkeUJjIn19",
"unprotected": {
likely benign
LLM, confidence 0.95
Repeated base64 JWE protected header test fixture.
Reasoning
Same JWE protected header test fixture used in another test. It decodes to standard ECDH-1PU parameters and is not a payload or dropper.
-
base64-like blob (236 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
assert parsed_msg == {
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1IjoiUVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9LUCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFBRnFVQUZhMzlkeUJjIn19",
likely benign
LLM, confidence 0.95
Expected JWE protected header value in a test assertion.
Reasoning
The JWE header appears as the expected value in an assertion comparing parsed output. This is a verification fixture, a common and legitimate test pattern.
-
base64-like blob (236 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
{
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1IjoiUVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9LUCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFBRnFVQUZhMzlkeUJjIn19",
"unprotected": {
likely benign
LLM, confidence 0.95
Repeated base64 JWE protected header test fixture.
Reasoning
Another instance of the same JWE protected header test vector in a test case. There is no decoding, execution, or hidden behavior in the snippet.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
data = {
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
likely benign
LLM, confidence 0.95
Split base64 JWE protected header in a test data dictionary.
Reasoning
The JWE header is split across concatenated lines in a test data dictionary, the same fixture seen elsewhere in the file. The pattern is consistent with a test vector and not with concealed malicious content.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
+ "RnFVQUZhMzlkeUJjIn19",
dismissed
LLM, confidence 0.95
Base64url-encoded JWE protected header split across string concatenation in a jose test vector.
Reasoning
Raw pass base64 heuristic on a split string literal inside a JOSE library test file. The blob decodes to a JWE protected header (alg ECDH-1PU+A128KW, enc A256CBC-HS512, epk OKP X25519), which is a legitimate test vector. Raw pass has a high false-positive rate and base64 of JSON headers is expected in this context.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
+ "RnFVQUZhMzlkeUJjIn19",
"unprotected": {"jku": "https://provider.test/jwks"},
dismissed
LLM, confidence 0.95
Continuation of the base64url JWE header test fixture, including an unprotected jku field.
Reasoning
Continuation of the same JWE test vector: base64url header fragments with a jku URL in the unprotected header. This is test fixture data for a JOSE library, consistent with legitimate encryption/key-agreement testing, and shows no obfuscation or malicious intent.
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
case2 = (
"eyJhbGciOiJIUzI1NiIsImludmFsaWQiOiIxIiwiY3JpdCI6WyJpbnZhbGlkIl19."
"aGVsbG8.ifW_D1AQWzggrpd8npcnmpiwMD9dp5FTX66lCkYFENM"
)
dismissed
LLM, confidence 0.94
JWS compact token test case with a deliberately invalid header used to test parser rejection.
Reasoning
Raw pass base64 match on a JWS compact-serialization test case. The header decodes to a JSON object with an invalid/crit test field, and the payload is 'hello'. This is a deliberate malformed-token test case in a JWS library's test suite, not obfuscation.
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
disclude.io