Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
if s.startswith(GZIP_HEAD):
decompressor = zlib.decompressobj()
else:
decompressor = zlib.decompressobj(-zlib.MAX_WBITS)
likely benign
LLM, confidence 0.90
Decompression routine for JWE compressed payloads using zlib.
Reasoning
The module implements JWE DEF compression (RFC 7516). zlib decompressobj with raw deflate or gzip headers is the expected way to inflate a compressed JWE payload. It is standard library use inside a JOSE implementation, not a hidden dropper.
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
.
OKOawDo13gRp2ojaHV7LFpZcgV7T6DVZKTyKOMTYUmKoTCVJRgckCL9kiMT03JGe
ipsEdY3mx_etLbbWSrFr05kLzcSr4qKAq7YN7e9jwQRb23nfa6c9d-StnImGyFDb
Sv04uVuxIp5Zms1gNxKKK2Da14B8S4rzVRltdYwam_lDp5XnZAYpQdb76FdIKLaV
likely benign
LLM, confidence 0.92
Documentation example of a base64url-encoded JWE token.
Reasoning
This is an example compact JWE token in reStructuredText documentation. The base64url blob is a sample ciphertext or key-material placeholder, which is expected in docs for a JOSE library.
-
base64-like blob (94 bytes over 2 lines, compression ratio 1.05) (raw pass, confidence 0.60)
.
eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFt
cGxlLmNvbS9pc19yb290Ijp0cnVlfQ
.
likely benign
LLM, confidence 0.93
Documentation example of a base64url-encoded JWS payload.
Reasoning
The blob decodes to the familiar RFC 7515 example JSON payload ({"iss":"joe", ...}). It is a documentation example of a JWS payload, not obfuscated code.
-
base64-like blob (94 bytes over 2 lines, compression ratio 1.05) (raw pass, confidence 0.60)
"payload":
"eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGF
tcGxlLmNvbS9pc19yb290Ijp0cnVlfQ",
"signatures":[
likely benign
LLM, confidence 0.93
Documentation example JWS JSON-serialization payload.
Reasoning
Same RFC 7515 example payload appearing in a JSON serialization example in the docs. It is a standard test or doc vector.
-
base64-like blob (94 bytes over 2 lines, compression ratio 1.05) (raw pass, confidence 0.60)
"payload":
"eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGF
tcGxlLmNvbS9pc19yb290Ijp0cnVlfQ",
"protected":"eyJhbGciOiJFUzI1NiJ9",
likely benign
LLM, confidence 0.93
Documentation example JWS payload with protected header.
Reasoning
Repeats the RFC 7515 example payload in another documentation example, alongside a protected header. Expected doc content.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
_shared_key_e_at_alice
== b"\x9e\x56\xd9\x1d\x81\x71\x35\xd3\x72\x83\x42\x83\xbf\x84\x26\x9c"
+ b"\xfb\x31\x6e\xa3\xda\x80\x6a\x48\xf6\xda\xa7\x79\x8c\xfe\x90\xc4"
)
likely benign
LLM, confidence 0.95
Test vector shared-key bytes for ECDH-1PU key agreement.
Reasoning
In a test file, these are hard-coded byte-string test vectors for ECDH-1PU shared secrets. Hex escapes are the normal way to write binary constants in Python tests. The high-entropy look is expected for cryptographic test data.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
== b"\x9e\x56\xd9\x1d\x81\x71\x35\xd3\x72\x83\x42\x83\xbf\x84\x26\x9c"
+ b"\xfb\x31\x6e\xa3\xda\x80\x6a\x48\xf6\xda\xa7\x79\x8c\xfe\x90\xc4"
)
likely benign
LLM, confidence 0.95
Continuation of ECDH-1PU test vector bytes.
Reasoning
Continuation of the same test vector constant in a test assertion. Binary test data written as escapes is ordinary.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
_shared_key_s_at_alice
== b"\xe3\xca\x34\x74\x38\x4c\x9f\x62\xb3\x0b\xfd\x4c\x68\x8b\x3e\x7d"
+ b"\x41\x10\xa1\xb4\xba\xdc\x3c\xc5\x4e\xf7\xb8\x12\x41\xef\xd5\x0d"
)
likely benign
LLM, confidence 0.95
Test vector shared-key bytes for the sender static key.
Reasoning
Another hard-coded cryptographic test vector in an ECDH-1PU test assertion. This is expected test data.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
== b"\xe3\xca\x34\x74\x38\x4c\x9f\x62\xb3\x0b\xfd\x4c\x68\x8b\x3e\x7d"
+ b"\x41\x10\xa1\xb4\xba\xdc\x3c\xc5\x4e\xf7\xb8\x12\x41\xef\xd5\x0d"
)
likely benign
LLM, confidence 0.95
Continuation of the sender static key test vector.
Reasoning
Continuation of the same test vector constant. Expected in a crypto test.
-
4 rows of escape runs, lines 92-95 (first: 16 consecutive `\xNN` escapes (entropy 3.9 bits/byte)) (raw pass, confidence 0.65)
_shared_key_at_alice
== b"\x9e\x56\xd9\x1d\x81\x71\x35\xd3\x72\x83\x42\x83\xbf\x84\x26\x9c"
+ b"\xfb\x31\x6e\xa3\xda\x80\x6a\x48\xf6\xda\xa7\x79\x8c\xfe\x90\xc4"
+ b"\xe3\xca\x34\x74\x38\x4c\x9f\x62\xb3\x0b\xfd\x4c\x68\x8b\x3e\x7d"
likely benign
LLM, confidence 0.95
Multi-row test vector bytes for ECDH-1PU derived key checks.
Reasoning
A multi-line block of the same test vector constants used for asserting derived key material. Benign test fixture.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
_dk_at_alice
== b"\x6c\xaf\x13\x72\x3d\x14\x85\x0a\xd4\xb4\x2c\xd6\xdd\xe9\x35\xbf"
+ b"\xfd\x2f\xff\x00\xa9\xba\x70\xde\x05\xc2\x03\xa5\xe1\x72\x2c\xa7"
)
likely benign
LLM, confidence 0.95
Test vector bytes for a derived key in ECDH-1PU tests.
Reasoning
Test vector for derived key material in an ECDH-1PU test. Hard-coded binary fixtures are normal in cryptographic test suites.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
== b"\x6c\xaf\x13\x72\x3d\x14\x85\x0a\xd4\xb4\x2c\xd6\xdd\xe9\x35\xbf"
+ b"\xfd\x2f\xff\x00\xa9\xba\x70\xde\x05\xc2\x03\xa5\xe1\x72\x2c\xa7"
)
assert (
likely benign
LLM, confidence 0.95
Continuation of derived-key test vector bytes.
Reasoning
Continuation of the derived-key test vector. Benign.
-
concatenated bytes literal contains 64 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
cek = (
b"\xff\xfe\xfd\xfc\xfb\xfa\xf9\xf8\xf7\xf6\xf5\xf4\xf3\xf2\xf1\xf0"
b"\xef\xee\xed\xec\xeb\xea\xe9\xe8\xe7\xe6\xe5\xe4\xe3\xe2\xe1\xe0"
b"\xdf\xde\xdd\xdc\xdb\xda\xd9\xd8\xd7\xd6\xd5\xd4\xd3\xd2\xd1\xd0"
likely benign
LLM, confidence 0.93
Sequential-byte content encryption key constant in a test.
Reasoning
The bytes run sequentially from 0xff downward, which is a deliberate known-answer test content-encryption key. It is a constant test fixture, not a hidden payload.
-
5 rows of escape runs, lines 209-215 (first: 16 consecutive `\xNN` escapes (entropy 4.0 bits/byte)) (raw pass, confidence 0.65)
cek = (
b"\xff\xfe\xfd\xfc\xfb\xfa\xf9\xf8\xf7\xf6\xf5\xf4\xf3\xf2\xf1\xf0"
b"\xef\xee\xed\xec\xeb\xea\xe9\xe8\xe7\xe6\xe5\xe4\xe3\xe2\xe1\xe0"
b"\xdf\xde\xdd\xdc\xdb\xda\xd9\xd8\xd7\xd6\xd5\xd4\xd3\xd2\xd1\xd0"
likely benign
LLM, confidence 0.97
Hardcoded cryptographic test vector bytes in a JOSE ECDH-1PU unit test.
Reasoning
Raw byte-escape runs in a test file that defines known-answer test vectors (CEK, shared keys, fixed info) for ECDH-1PU JOSE tests. Sequential bytes like ff fe fd are deliberate test data, not obfuscation.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
_shared_key_e_at_alice_for_bob
== b"\x32\x81\x08\x96\xe0\xfe\x4d\x57\x0e\xd1\xac\xfc\xed\xf6\x71\x17"
+ b"\xdc\x19\x4e\xd5\xda\xac\x21\xd8\xff\x7a\xf3\x24\x46\x94\x89\x7f"
)
likely benign
LLM, confidence 0.97
Known-answer shared key constant in an ECDH-1PU test.
Reasoning
Expected shared-key test vector bytes in a cryptography test suite; the escape run is a literal byte constant used for assertions.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
== b"\x32\x81\x08\x96\xe0\xfe\x4d\x57\x0e\xd1\xac\xfc\xed\xf6\x71\x17"
+ b"\xdc\x19\x4e\xd5\xda\xac\x21\xd8\xff\x7a\xf3\x24\x46\x94\x89\x7f"
)
likely benign
LLM, confidence 0.97
Continuation of a known-answer shared key constant in an ECDH-1PU test.
Reasoning
Continuation of the same expected test vector constant; benign test data.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
_shared_key_s_at_alice_for_bob
== b"\x21\x57\x61\x2c\x90\x48\xed\xfa\xe7\x7c\xb2\xe4\x23\x71\x40\x60"
+ b"\x59\x67\xc0\x5c\x7f\x77\xa4\x8e\xea\xf2\xcf\x29\xa5\x73\x7c\x4a"
)
likely benign
LLM, confidence 0.97
Known-answer shared key constant for the sender static key in an ECDH-1PU test.
Reasoning
Static test vector for shared key derivation comparison in a crypto test file; expected value, not executed payload.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
== b"\x21\x57\x61\x2c\x90\x48\xed\xfa\xe7\x7c\xb2\xe4\x23\x71\x40\x60"
+ b"\x59\x67\xc0\x5c\x7f\x77\xa4\x8e\xea\xf2\xcf\x29\xa5\x73\x7c\x4a"
)
likely benign
LLM, confidence 0.97
Continuation of a static shared key test vector in an ECDH-1PU test.
Reasoning
Continuation of the same static key test vector; benign.
-
4 rows of escape runs, lines 267-270 (first: 16 consecutive `\xNN` escapes (entropy 4.0 bits/byte)) (raw pass, confidence 0.65)
_shared_key_at_alice_for_bob
== b"\x32\x81\x08\x96\xe0\xfe\x4d\x57\x0e\xd1\xac\xfc\xed\xf6\x71\x17"
+ b"\xdc\x19\x4e\xd5\xda\xac\x21\xd8\xff\x7a\xf3\x24\x46\x94\x89\x7f"
+ b"\x21\x57\x61\x2c\x90\x48\xed\xfa\xe7\x7c\xb2\xe4\x23\x71\x40\x60"
likely benign
LLM, confidence 0.97
Known-answer combined key material constant in an ECDH-1PU test.
Reasoning
Combined expected key material for a test assertion in a JOSE cryptography test; standard known-answer data.
-
16 consecutive `\xNN` escapes (entropy 3.6 bits/byte) (raw pass, confidence 0.65)
_fixed_info_at_alice_for_bob
== b"\x00\x00\x00\x0f\x45\x43\x44\x48\x2d\x31\x50\x55\x2b\x41\x31\x32"
+ b"\x38\x4b\x57\x00\x00\x00\x05\x41\x6c\x69\x63\x65\x00\x00\x00\x0f"
+ b"\x42\x6f\x62\x20\x61\x6e\x64\x20\x43\x68\x61\x72\x6c\x69\x65\x00"
likely benign
LLM, confidence 0.97
Fixed-info KDF input test vector containing readable algorithm and party identifiers.
Reasoning
ASCII-encoded fixed info (ECDH-1PU+A128KW, Alice, Bob and Charlie) per the concatKDF format; clearly a structured test vector.
-
16 consecutive `\xNN` escapes (entropy 3.8 bits/byte) (raw pass, confidence 0.65)
+ b"\x38\x4b\x57\x00\x00\x00\x05\x41\x6c\x69\x63\x65\x00\x00\x00\x0f"
+ b"\x42\x6f\x62\x20\x61\x6e\x64\x20\x43\x68\x61\x72\x6c\x69\x65\x00"
+ b"\x00\x00\x80\x00\x00\x00\x20\x1c\xb6\xf8\x7d\x39\x66\xf2\xca\x46"
+ b"\x9a\x28\xf7\x47\x23\xac\xda\x02\x78\x0e\x91\xcc\xe2\x18\x55\x47"
likely benign
LLM, confidence 0.97
Continuation of KDF fixed-info test vector in an ECDH-1PU test.
Reasoning
Continuation of the fixed-info KDF test vector; benign test data.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
+ b"\x00\x00\x80\x00\x00\x00\x20\x1c\xb6\xf8\x7d\x39\x66\xf2\xca\x46"
+ b"\x9a\x28\xf7\x47\x23\xac\xda\x02\x78\x0e\x91\xcc\xe2\x18\x55\x47"
+ b"\x07\x45\xfe\x11\x9b\xdd\x64"
)
likely benign
LLM, confidence 0.97
Final lines of KDF fixed-info test vector in an ECDH-1PU test.
Reasoning
Continuation of the fixed-info test vector; benign.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
_dk_at_alice_for_bob
== b"\xdf\x4c\x37\xa0\x66\x83\x06\xa1\x1e\x3d\x6b\x00\x74\xb5\xd8\xdf"
)
likely benign
LLM, confidence 0.97
Expected derived key test vector in an ECDH-1PU test.
Reasoning
Expected derived key constant for assertion in a crypto test; no execution or obfuscation.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
dk_at_alice_for_bob
== b"\xdf\x4c\x37\xa0\x66\x83\x06\xa1\x1e\x3d\x6b\x00\x74\xb5\xd8\xdf"
)
likely benign
LLM, confidence 0.97
Expected derived key test vector in a second ECDH-1PU test.
Reasoning
Same expected derived key constant used in another test; benign test data.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
_shared_key_e_at_alice_for_charlie
== b"\x89\xdc\xfe\x4c\x37\xc1\xdc\x02\x71\xf3\x46\xb5\xb3\xb1\x9c\x3b"
+ b"\x70\x5c\xa2\xa7\x2f\x9a\x23\x77\x85\xc3\x44\x06\xfc\xb7\x5f\x10"
)
likely benign
LLM, confidence 0.97
Known-answer shared key constant for a third-party scenario in an ECDH-1PU test.
Reasoning
Known-answer key material for a Charlie-party scenario in a JOSE crypto test; benign.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
== b"\x89\xdc\xfe\x4c\x37\xc1\xdc\x02\x71\xf3\x46\xb5\xb3\xb1\x9c\x3b"
+ b"\x70\x5c\xa2\xa7\x2f\x9a\x23\x77\x85\xc3\x44\x06\xfc\xb7\x5f\x10"
)
likely benign
LLM, confidence 0.97
Continuation of a known-answer shared key constant in an ECDH-1PU test.
Reasoning
Continuation of the Charlie-scenario test vector; benign.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
_shared_key_s_at_alice_for_charlie
== b"\x78\xfe\x63\xfc\x66\x1c\xf8\xd1\x8f\x92\xa8\x42\x2a\x64\x18\xe4"
+ b"\xed\x5e\x20\xa9\x16\x81\x85\xfd\xee\xdc\xa1\xc3\xd8\xe6\xa6\x1c"
)
likely benign
LLM, confidence 0.97
Expected shared-key test vector bytes written as hex escapes in a JOSE test.
Reasoning
Hex escapes in a test file are literal byte-string expected values for ECDH-1PU shared key comparison; this is a cryptographic test vector, not obfuscation.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
== b"\x78\xfe\x63\xfc\x66\x1c\xf8\xd1\x8f\x92\xa8\x42\x2a\x64\x18\xe4"
+ b"\xed\x5e\x20\xa9\x16\x81\x85\xfd\xee\xdc\xa1\xc3\xd8\xe6\xa6\x1c"
)
likely benign
LLM, confidence 0.97
Second half of an expected shared-key byte literal in a JOSE test.
Reasoning
Continuation of the same expected-value byte literal in a crypto test; raw-pass escape noise from a legitimate test vector.
-
4 rows of escape runs, lines 340-343 (first: 16 consecutive `\xNN` escapes (entropy 3.9 bits/byte)) (raw pass, confidence 0.65)
_shared_key_at_alice_for_charlie
== b"\x89\xdc\xfe\x4c\x37\xc1\xdc\x02\x71\xf3\x46\xb5\xb3\xb1\x9c\x3b"
+ b"\x70\x5c\xa2\xa7\x2f\x9a\x23\x77\x85\xc3\x44\x06\xfc\xb7\x5f\x10"
+ b"\x78\xfe\x63\xfc\x66\x1c\xf8\xd1\x8f\x92\xa8\x42\x2a\x64\x18\xe4"
likely benign
LLM, confidence 0.97
Multi-row expected key bytes used in ECDH-1PU test assertions.
Reasoning
Multi-line byte constant of cryptographic test vectors compared against derived keys; ordinary test data.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
_dk_at_alice_for_charlie
== b"\x57\xd8\x12\x6f\x1b\x7e\xc4\xcc\xb0\x58\x4d\xac\x03\xcb\x27\xcc"
)
likely benign
LLM, confidence 0.96
Expected derived key bytes in an ECDH-1PU test.
Reasoning
Short expected derived-key byte literal in a crypto unit test; legitimate test data.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
dk_at_alice_for_charlie
== b"\x57\xd8\x12\x6f\x1b\x7e\xc4\xcc\xb0\x58\x4d\xac\x03\xcb\x27\xcc"
)
likely benign
LLM, confidence 0.96
Expected derived key bytes in a second ECDH-1PU test.
Reasoning
Same expected derived-key literal repeated in another test assertion; benign.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
data = {
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
likely benign
LLM, confidence 0.97
Base64url-encoded JWE protected header fixture in a test.
Reasoning
Base64url JWE protected header split across string concatenation in a test fixture; decodes to ordinary JSON header fields (alg, enc, epk) and is standard JOSE test data.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
+ "RnFVQUZhMzlkeUJjIn19",
likely benign
LLM, confidence 0.97
Continuation of a base64url JWE protected header test fixture.
Reasoning
Continuation of the same base64url JWE header test fixture; normal test data.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
+ "RnFVQUZhMzlkeUJjIn19",
"unprotected": {"jku": "https://provider.test/jwks"},
likely benign
LLM, confidence 0.97
Final segment of a base64url JWE protected header test fixture.
Reasoning
Final part of the JWE header test fixture; standard encoded JOSE data in tests.
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
"crv": "P-521",
"x": "1JDMOjnMgASo01PVHRcyCDtE6CLgKuwXLXLbdLGxpdubLuHYBa0KAepyimnxCWsX",
"y": "w7BSC8Xb3XgMMfE7IFCJpoOmx1Sf3T3_3OZ4CrF6_iCFAw4VOdFYR42OnbKMFG--",
"d": "lCkpFBaVwHzfHtkJEV3PzxefObOPnMgUjNZSLryqC5AkERgXT3-DZLEi6eBzq5gk",
likely benign
LLM, confidence 0.96
Test P-521 JWK parameters including coordinates and private scalar.
Reasoning
P-521 EC key coordinates and private scalar in a test dictionary for key-parsing tests; expected JWK material, not hidden payloads.
-
base64-like blob (87 bytes, compression ratio 1.05) (raw pass, confidence 0.60)
"x": "Cd6rinJdgS4WJj6iaNyXiVhpMbhZLmPykmrnFhIad04B3ulf5pURb5v9mx21c_Cv8Q1RBOptwleLg5Qjq2J1qa4",
"y": "hXo9p1EjW6W4opAQdmfNgyxztkNxYwn9L4FVTLX51KNEsW0aqueLm96adRmf0HoGIbNhIdcIlXOKlRUHqgunDkM",
}
likely benign
LLM, confidence 0.96
Public point coordinates of a P-521 test key.
Reasoning
Public point coordinates for a P-521 test key with an explanatory comment; ordinary test data.
-
base64-like blob (75 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
"crv": "X25519",
"x": "lVHcPx4R9bExaoxXZY9tAq7SNW9pJKCoVQxURLtkAs3Dg5ZRxcjhf0JUyg2lod5OGDptJ7wowwY",
}
)
likely benign
LLM, confidence 0.97
X25519 public key coordinate used in an invalid-curve negative test.
Reasoning
X25519 public key coordinate in a deliberately invalid-curve test case with a clarifying comment; benign test data.
-
base64-like blob (75 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
"crv": "X448",
"x": "lVHcPx4R9bExaoxXZY9tAq7SNW9pJKCoVQxURLtkAs3Dg5ZRxcjhf0JUyg2lod5OGDptJ7wowwY",
}
)
likely benign
LLM, confidence 0.95
A base64url-encoded X448 public key coordinate used as a JWK test fixture in a jose ECDH-1PU test.
Reasoning
The flagged string is an X448 public key coordinate in a JWK test fixture, sitting inside a test that checks an elliptic-curve point is on the curve. It is test data, not an encoded payload or dropper. The raw pass has a high false-positive rate for base64-like strings, and this one is a legitimate cryptographic test vector.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
data = {
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
likely benign
LLM, confidence 0.97
Base64url-encoded JWE protected header fixture in test_jwe.py.
Reasoning
Base64url JWE protected header fixture in a JOSE test file, identical to the ecdh test vector; benign.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
+ "RnFVQUZhMzlkeUJjIn19",
dismissed
LLM, confidence 0.93
Split base64url string of a JWE protected header in a JOSE test vector.
Reasoning
This is a base64 fragment of a JWE protected header in a unit test. It decodes to a readable JSON header (alg ECDH-1PU+A128KW, enc A256CBC-HS512, an ephemeral OKP key). Base64 is the normal encoding for JOSE headers, and the raw pass has a high false-positive rate for this kind of blob.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
+ "RnFVQUZhMzlkeUJjIn19",
"unprotected": {"jku": "https://provider.test/jwks"},
dismissed
LLM, confidence 0.93
Continuation of the base64url JWE protected header in a test fixture.
Reasoning
Continuation line of the same JWE protected-header test vector. It decodes to ordinary JOSE header fields and carries no payload or execution logic.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
data = {
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
dismissed
LLM, confidence 0.93
Repeated JWE protected-header base64 blob in a test data dictionary.
Reasoning
The same JWE protected-header test vector appears again inside a test data dictionary. It is a standard encoded header, not obfuscation.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
+ "RnFVQUZhMzlkeUJjIn19",
dismissed
LLM, confidence 0.93
Continuation of the JWE protected-header test fixture in a test data dictionary.
Reasoning
Another line of the same JWE header test fixture. Its content is a legitimate base64url-encoded JOSE header.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
+ "RnFVQUZhMzlkeUJjIn19",
"unprotected": {"jku": "https://provider.test/jwks"},
dismissed
LLM, confidence 0.93
Final lines of the JWE test fixture, including a jku header value for a test provider.
Reasoning
Final continuation lines of the same JWE header test fixture, followed by an unprotected jku header pointing to a .test domain. This is ordinary test data.
-
base64-like blob (236 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
{
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1IjoiUVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9LUCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFBRnFVQUZhMzlkeUJjIn19",
"unprotected": {
dismissed
LLM, confidence 0.94
Single-line base64url JWE protected header in a test case.
Reasoning
A single-line base64url JWE protected header inside a test case dictionary. It decodes to standard JOSE header fields, so the encoding is expected for this library's tests.
-
base64-like blob (236 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
{
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1IjoiUVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9LUCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFBRnFVQUZhMzlkeUJjIn19",
"unprotected": {
dismissed
LLM, confidence 0.94
Reused base64url JWE protected header in a test case.
Reasoning
Same single-line JWE protected header test vector, reused across test cases. Legitimate encoded test data.
-
base64-like blob (236 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
{
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1IjoiUVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9LUCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFBRnFVQUZhMzlkeUJjIn19",
"unprotected": {
dismissed
LLM, confidence 0.94
Reused base64url JWE protected header in a test case.
Reasoning
Same JWE protected header test vector as the other test cases in this file. It is an expected encoded header.
-
base64-like blob (236 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
assert parsed_msg == {
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1IjoiUVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9LUCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFBRnFVQUZhMzlkeUJjIn19",
dismissed
LLM, confidence 0.94
Base64url JWE protected header used in a parsed-message equality assertion.
Reasoning
The JWE protected header is compared against an expected parsed message in an assertion. This is a normal round-trip test check.
-
base64-like blob (236 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
{
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1IjoiUVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9LUCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFBRnFVQUZhMzlkeUJjIn19",
"unprotected": {
dismissed
LLM, confidence 0.94
Reused base64url JWE protected header in a test fixture.
Reasoning
Same JWE protected header test vector, used as a fixture value. Legitimate encoded test data.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
data = {
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
dismissed
LLM, confidence 0.93
Split base64url JWE protected header in a test data dictionary.
Reasoning
First lines of a split base64url JWE protected header inside a test data dictionary. It matches the other test vectors in this file and is not malicious.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
+ "RnFVQUZhMzlkeUJjIn19",
dismissed
LLM, confidence 0.95
Split base64url-encoded JWE protected header used as a test vector in the jose library's test suite.
Reasoning
This is a raw-pass base64 blob flagged by length and compression ratio. The snippet is a split string literal forming a base64url-encoded JWE protected header (decodes to JSON with alg ECDH-1PU+A128KW, enc A256CBC-HS512, epk, etc.). The file is a jose library test suite, so this is a legitimate test vector. Raw findings have high false-positive rates and this is expected encoded test data.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
+ "RnFVQUZhMzlkeUJjIn19",
"unprotected": {"jku": "https://provider.test/jwks"},
dismissed
LLM, confidence 0.95
Continuation of a base64url-encoded JWE header test fixture in the jose test suite.
Reasoning
Continuation of the same concatenated base64url JWE header test vector, including the epk key and an unprotected jku header pointing to a test URL. Legitimate fixture data in a JOSE library test file; no execution or obfuscation intent.
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
case2 = (
"eyJhbGciOiJIUzI1NiIsImludmFsaWQiOiIxIiwiY3JpdCI6WyJpbnZhbGlkIl19."
"aGVsbG8.ifW_D1AQWzggrpd8npcnmpiwMD9dp5FTX66lCkYFENM"
)
dismissed
LLM, confidence 0.95
Hand-built malformed JWS token used as a negative test case in the jose library tests.
Reasoning
Raw-pass base64 flag on a JWS compact-serialization test case: header decodes to a JSON object with an invalid/crit test field, payload 'aGVsbG8' is 'hello', and the signature is a fixed string. This is a deliberately malformed token used to test rejection logic in a JWS library. Benign test data.
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
disclude.io