Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
if s.startswith(GZIP_HEAD):
decompressor = zlib.decompressobj()
else:
decompressor = zlib.decompressobj(-zlib.MAX_WBITS)
likely benign
LLM, confidence 0.88
JWE decompression routine that inflates the payload according to the zip header.
Reasoning
The code selects gzip or raw deflate based on the JWE 'zip' header and decompresses the ciphertext plaintext. That is the standard RFC 7516 DEF compression step in a JOSE library, not a hidden payload dropper. The decompression is driven by the protocol, not by embedded code.
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
.
OKOawDo13gRp2ojaHV7LFpZcgV7T6DVZKTyKOMTYUmKoTCVJRgckCL9kiMT03JGe
ipsEdY3mx_etLbbWSrFr05kLzcSr4qKAq7YN7e9jwQRb23nfa6c9d-StnImGyFDb
Sv04uVuxIp5Zms1gNxKKK2Da14B8S4rzVRltdYwam_lDp5XnZAYpQdb76FdIKLaV
likely benign
LLM, confidence 0.93
Documentation example of a JWE token rendered as base64url text.
Reasoning
The raw pass flagged a base64url block inside reStructuredText documentation of a JWE compact serialization example. Documentation examples of tokens are expected, and the content is not executed or decoded by any code here.
-
base64-like blob (94 bytes over 2 lines, compression ratio 1.05) (raw pass, confidence 0.60)
.
eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFt
cGxlLmNvbS9pc19yb290Ijp0cnVlfQ
.
likely benign
LLM, confidence 0.93
Documentation example of a JWS compact token with base64url-encoded JSON.
Reasoning
This is a documented JWS example, a base64url-encoded JSON header and payload in a docs file. It is a standard illustration of the format, and the raw-pass flag on base64-like text is a known false-positive pattern.
-
base64-like blob (94 bytes over 2 lines, compression ratio 1.05) (raw pass, confidence 0.60)
"payload":
"eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGF
tcGxlLmNvbS9pc19yb290Ijp0cnVlfQ",
"signatures":[
likely benign
LLM, confidence 0.93
Documentation example of a JWS JSON serialization with a base64url payload.
Reasoning
This is the JSON serialization example in the JWS docs, showing a base64url payload field. It is illustrative text in a documentation file, not an obfuscated or hidden payload.
-
base64-like blob (94 bytes over 2 lines, compression ratio 1.05) (raw pass, confidence 0.60)
"payload":
"eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGF
tcGxlLmNvbS9pc19yb290Ijp0cnVlfQ",
"protected":"eyJhbGciOiJFUzI1NiJ9",
likely benign
LLM, confidence 0.93
Documentation example of a JWS general JSON serialization.
Reasoning
Same as the other JWS docs examples: a base64url payload and protected header shown in an rst example of a signed JSON structure. It is documentation and carries no executable or hidden content.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
_shared_key_e_at_alice
== b"\x9e\x56\xd9\x1d\x81\x71\x35\xd3\x72\x83\x42\x83\xbf\x84\x26\x9c"
+ b"\xfb\x31\x6e\xa3\xda\x80\x6a\x48\xf6\xda\xa7\x79\x8c\xfe\x90\xc4"
)
likely benign
LLM, confidence 0.92
Test assertion comparing derived ECDH-1PU shared-key bytes against a fixed test vector.
Reasoning
The byte literal is a set of hard-coded shared-key test vector bytes used to assert ECDH-1PU key derivation. Hex escapes are the normal way to write binary test constants, and the bytes look like cryptographic output.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
== b"\x9e\x56\xd9\x1d\x81\x71\x35\xd3\x72\x83\x42\x83\xbf\x84\x26\x9c"
+ b"\xfb\x31\x6e\xa3\xda\x80\x6a\x48\xf6\xda\xa7\x79\x8c\xfe\x90\xc4"
)
likely benign
LLM, confidence 0.92
Continuation of a test vector byte constant in an ECDH-1PU assertion.
Reasoning
Continuation of the same hard-coded test vector used in an equality assertion for key derivation. This is ordinary test data in a cryptography library's test suite.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
_shared_key_s_at_alice
== b"\xe3\xca\x34\x74\x38\x4c\x9f\x62\xb3\x0b\xfd\x4c\x68\x8b\x3e\x7d"
+ b"\x41\x10\xa1\xb4\xba\xdc\x3c\xc5\x4e\xf7\xb8\x12\x41\xef\xd5\x0d"
)
likely benign
LLM, confidence 0.92
Test assertion with a fixed binary test vector for a derived key.
Reasoning
Another fixed test vector for the sender static key in ECDH-1PU, compared with an expected value. Hex-escaped binary constants are expected in tests of this kind.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
== b"\xe3\xca\x34\x74\x38\x4c\x9f\x62\xb3\x0b\xfd\x4c\x68\x8b\x3e\x7d"
+ b"\x41\x10\xa1\xb4\xba\xdc\x3c\xc5\x4e\xf7\xb8\x12\x41\xef\xd5\x0d"
)
likely benign
LLM, confidence 0.92
Continuation of a binary test vector in an ECDH-1PU assertion.
Reasoning
Continuation of the preceding fixed test vector in the ECDH-1PU test. It is test data, not hidden code.
-
4 rows of escape runs, lines 92-95 (first: 16 consecutive `\xNN` escapes (entropy 3.9 bits/byte)) (raw pass, confidence 0.65)
_shared_key_at_alice
== b"\x9e\x56\xd9\x1d\x81\x71\x35\xd3\x72\x83\x42\x83\xbf\x84\x26\x9c"
+ b"\xfb\x31\x6e\xa3\xda\x80\x6a\x48\xf6\xda\xa7\x79\x8c\xfe\x90\xc4"
+ b"\xe3\xca\x34\x74\x38\x4c\x9f\x62\xb3\x0b\xfd\x4c\x68\x8b\x3e\x7d"
likely benign
LLM, confidence 0.92
Multi-line fixed test vector assembled from byte literals for a key-derivation assertion.
Reasoning
A multi-line concatenation of fixed byte test vectors compared against derived key material in a cryptography test. The escape pattern is typical of binary expected values in tests.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
_dk_at_alice
== b"\x6c\xaf\x13\x72\x3d\x14\x85\x0a\xd4\xb4\x2c\xd6\xdd\xe9\x35\xbf"
+ b"\xfd\x2f\xff\x00\xa9\xba\x70\xde\x05\xc2\x03\xa5\xe1\x72\x2c\xa7"
)
likely benign
LLM, confidence 0.92
Test assertion with a fixed binary key vector.
Reasoning
Fixed binary test vector for a derived key in the ECDH-1PU test suite. It is compared against computed output and carries no executable logic.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
== b"\x6c\xaf\x13\x72\x3d\x14\x85\x0a\xd4\xb4\x2c\xd6\xdd\xe9\x35\xbf"
+ b"\xfd\x2f\xff\x00\xa9\xba\x70\xde\x05\xc2\x03\xa5\xe1\x72\x2c\xa7"
)
assert (
likely benign
LLM, confidence 0.92
Continuation of a binary key test vector in an ECDH-1PU assertion.
Reasoning
Continuation of the fixed key vector in the same assertion. This is ordinary cryptographic test data.
-
concatenated bytes literal contains 64 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
cek = (
b"\xff\xfe\xfd\xfc\xfb\xfa\xf9\xf8\xf7\xf6\xf5\xf4\xf3\xf2\xf1\xf0"
b"\xef\xee\xed\xec\xeb\xea\xe9\xe8\xe7\xe6\xe5\xe4\xe3\xe2\xe1\xe0"
b"\xdf\xde\xdd\xdc\xdb\xda\xd9\xd8\xd7\xd6\xd5\xd4\xd3\xd2\xd1\xd0"
likely benign
LLM, confidence 0.90
Test fixture defining a content-encryption key as a sequential byte literal.
Reasoning
The bytes are a sequential 0xff down to 0xe0 pattern used as a content-encryption key in a test. The regular counting sequence is a classic test fixture, not a hidden payload, and it is used as an input constant for the cipher under test.
-
5 rows of escape runs, lines 209-215 (first: 16 consecutive `\xNN` escapes (entropy 4.0 bits/byte)) (raw pass, confidence 0.65)
cek = (
b"\xff\xfe\xfd\xfc\xfb\xfa\xf9\xf8\xf7\xf6\xf5\xf4\xf3\xf2\xf1\xf0"
b"\xef\xee\xed\xec\xeb\xea\xe9\xe8\xe7\xe6\xe5\xe4\xe3\xe2\xe1\xe0"
b"\xdf\xde\xdd\xdc\xdb\xda\xd9\xd8\xd7\xd6\xd5\xd4\xd3\xd2\xd1\xd0"
dismissed
LLM, confidence 0.97
Test vector byte literals for ECDH-1PU key derivation in a cryptography library test.
Reasoning
Hex byte literals in a jose ECDH-1PU test file are known-answer test vectors (CEK, keys, fixed info). Raw pass escape-run heuristic is a false positive on test data.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
_shared_key_e_at_alice_for_bob
== b"\x32\x81\x08\x96\xe0\xfe\x4d\x57\x0e\xd1\xac\xfc\xed\xf6\x71\x17"
+ b"\xdc\x19\x4e\xd5\xda\xac\x21\xd8\xff\x7a\xf3\x24\x46\x94\x89\x7f"
)
dismissed
LLM, confidence 0.97
Expected shared-secret bytes in an ECDH-1PU unit test.
Reasoning
Known-answer test vector bytes for shared key derivation in a JOSE test suite; expected cryptographic constants, not obfuscation.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
== b"\x32\x81\x08\x96\xe0\xfe\x4d\x57\x0e\xd1\xac\xfc\xed\xf6\x71\x17"
+ b"\xdc\x19\x4e\xd5\xda\xac\x21\xd8\xff\x7a\xf3\x24\x46\x94\x89\x7f"
)
dismissed
LLM, confidence 0.97
Continuation of expected key bytes in an ECDH-1PU test.
Reasoning
Continuation of the same test vector literal; benign test data.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
_shared_key_s_at_alice_for_bob
== b"\x21\x57\x61\x2c\x90\x48\xed\xfa\xe7\x7c\xb2\xe4\x23\x71\x40\x60"
+ b"\x59\x67\xc0\x5c\x7f\x77\xa4\x8e\xea\xf2\xcf\x29\xa5\x73\x7c\x4a"
)
dismissed
LLM, confidence 0.97
Expected shared-secret bytes for a second party in an ECDH-1PU test.
Reasoning
Known-answer test vector for a second shared key in a JOSE test; benign.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
== b"\x21\x57\x61\x2c\x90\x48\xed\xfa\xe7\x7c\xb2\xe4\x23\x71\x40\x60"
+ b"\x59\x67\xc0\x5c\x7f\x77\xa4\x8e\xea\xf2\xcf\x29\xa5\x73\x7c\x4a"
)
dismissed
LLM, confidence 0.97
Continuation of expected key bytes in an ECDH-1PU test.
Reasoning
Continuation of the same test vector literal; benign.
-
4 rows of escape runs, lines 267-270 (first: 16 consecutive `\xNN` escapes (entropy 4.0 bits/byte)) (raw pass, confidence 0.65)
_shared_key_at_alice_for_bob
== b"\x32\x81\x08\x96\xe0\xfe\x4d\x57\x0e\xd1\xac\xfc\xed\xf6\x71\x17"
+ b"\xdc\x19\x4e\xd5\xda\xac\x21\xd8\xff\x7a\xf3\x24\x46\x94\x89\x7f"
+ b"\x21\x57\x61\x2c\x90\x48\xed\xfa\xe7\x7c\xb2\xe4\x23\x71\x40\x60"
dismissed
LLM, confidence 0.97
Expected key material bytes concatenated in an ECDH-1PU test.
Reasoning
Concatenated known-answer test vectors for key derivation in a cryptographic test suite; benign.
-
16 consecutive `\xNN` escapes (entropy 3.6 bits/byte) (raw pass, confidence 0.65)
_fixed_info_at_alice_for_bob
== b"\x00\x00\x00\x0f\x45\x43\x44\x48\x2d\x31\x50\x55\x2b\x41\x31\x32"
+ b"\x38\x4b\x57\x00\x00\x00\x05\x41\x6c\x69\x63\x65\x00\x00\x00\x0f"
+ b"\x42\x6f\x62\x20\x61\x6e\x64\x20\x43\x68\x61\x72\x6c\x69\x65\x00"
dismissed
LLM, confidence 0.97
Fixed-info KDF input bytes in an ECDH-1PU test vector.
Reasoning
ASCII-like fixed info bytes (ECDH-1PU+A128KW, Alice, Bob and Charlie) are the standard KDF input in a test vector; benign.
-
16 consecutive `\xNN` escapes (entropy 3.8 bits/byte) (raw pass, confidence 0.65)
+ b"\x38\x4b\x57\x00\x00\x00\x05\x41\x6c\x69\x63\x65\x00\x00\x00\x0f"
+ b"\x42\x6f\x62\x20\x61\x6e\x64\x20\x43\x68\x61\x72\x6c\x69\x65\x00"
+ b"\x00\x00\x80\x00\x00\x00\x20\x1c\xb6\xf8\x7d\x39\x66\xf2\xca\x46"
+ b"\x9a\x28\xf7\x47\x23\xac\xda\x02\x78\x0e\x91\xcc\xe2\x18\x55\x47"
dismissed
LLM, confidence 0.97
Continuation of KDF fixed-info bytes in a test.
Reasoning
Continuation of the fixed-info test vector; benign.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
+ b"\x00\x00\x80\x00\x00\x00\x20\x1c\xb6\xf8\x7d\x39\x66\xf2\xca\x46"
+ b"\x9a\x28\xf7\x47\x23\xac\xda\x02\x78\x0e\x91\xcc\xe2\x18\x55\x47"
+ b"\x07\x45\xfe\x11\x9b\xdd\x64"
)
dismissed
LLM, confidence 0.97
Continuation of expected key/info bytes in a test.
Reasoning
Continuation of the test vector literal; benign.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
_dk_at_alice_for_bob
== b"\xdf\x4c\x37\xa0\x66\x83\x06\xa1\x1e\x3d\x6b\x00\x74\xb5\xd8\xdf"
)
dismissed
LLM, confidence 0.97
Expected derived key bytes in an ECDH-1PU test.
Reasoning
Expected derived key bytes in a cryptographic unit test; benign.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
dk_at_alice_for_bob
== b"\xdf\x4c\x37\xa0\x66\x83\x06\xa1\x1e\x3d\x6b\x00\x74\xb5\xd8\xdf"
)
dismissed
LLM, confidence 0.97
Expected derived key bytes in an ECDH-1PU test.
Reasoning
Expected derived key bytes in a cryptographic unit test; benign.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
_shared_key_e_at_alice_for_charlie
== b"\x89\xdc\xfe\x4c\x37\xc1\xdc\x02\x71\xf3\x46\xb5\xb3\xb1\x9c\x3b"
+ b"\x70\x5c\xa2\xa7\x2f\x9a\x23\x77\x85\xc3\x44\x06\xfc\xb7\x5f\x10"
)
dismissed
LLM, confidence 0.97
Expected shared-secret bytes for a Charlie scenario in an ECDH-1PU test.
Reasoning
Known-answer test vector for a third party's shared key in a JOSE test; benign.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
== b"\x89\xdc\xfe\x4c\x37\xc1\xdc\x02\x71\xf3\x46\xb5\xb3\xb1\x9c\x3b"
+ b"\x70\x5c\xa2\xa7\x2f\x9a\x23\x77\x85\xc3\x44\x06\xfc\xb7\x5f\x10"
)
dismissed
LLM, confidence 0.97
Continuation of expected shared-secret bytes in an ECDH-1PU test.
Reasoning
Continuation of the same test vector literal; benign.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
_shared_key_s_at_alice_for_charlie
== b"\x78\xfe\x63\xfc\x66\x1c\xf8\xd1\x8f\x92\xa8\x42\x2a\x64\x18\xe4"
+ b"\xed\x5e\x20\xa9\x16\x81\x85\xfd\xee\xdc\xa1\xc3\xd8\xe6\xa6\x1c"
)
likely benign
LLM, confidence 0.95
Expected ECDH shared-key bytes written as hex escapes in a unit test.
Reasoning
Test vectors of raw key bytes written as hex escapes in a cryptography library test file; expected byte values for a key derivation assertion, a common legitimate pattern.
-
16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
== b"\x78\xfe\x63\xfc\x66\x1c\xf8\xd1\x8f\x92\xa8\x42\x2a\x64\x18\xe4"
+ b"\xed\x5e\x20\xa9\x16\x81\x85\xfd\xee\xdc\xa1\xc3\xd8\xe6\xa6\x1c"
)
likely benign
LLM, confidence 0.97
Test vector byte literals written as hex escapes in a JWE ECDH-1PU test.
Reasoning
Hex-escaped byte literals are test vectors for ECDH-1PU key derivation in a JOSE library's test suite; the escapes are expected cryptographic constants, not obfuscation.
-
4 rows of escape runs, lines 340-343 (first: 16 consecutive `\xNN` escapes (entropy 3.9 bits/byte)) (raw pass, confidence 0.65)
_shared_key_at_alice_for_charlie
== b"\x89\xdc\xfe\x4c\x37\xc1\xdc\x02\x71\xf3\x46\xb5\xb3\xb1\x9c\x3b"
+ b"\x70\x5c\xa2\xa7\x2f\x9a\x23\x77\x85\xc3\x44\x06\xfc\xb7\x5f\x10"
+ b"\x78\xfe\x63\xfc\x66\x1c\xf8\xd1\x8f\x92\xa8\x42\x2a\x64\x18\xe4"
likely benign
LLM, confidence 0.97
Expected shared-key constant split across lines as hex-escaped bytes in tests.
Reasoning
Multi-line concatenated byte literals are shared-key test constants in a crypto library test file; consistent with legitimate test data.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
_dk_at_alice_for_charlie
== b"\x57\xd8\x12\x6f\x1b\x7e\xc4\xcc\xb0\x58\x4d\xac\x03\xcb\x27\xcc"
)
likely benign
LLM, confidence 0.97
Expected derived-key bytes in an ECDH-1PU test assertion.
Reasoning
A 16-byte expected derived-key value in a test assertion; ordinary cryptographic test vector.
-
16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
dk_at_alice_for_charlie
== b"\x57\xd8\x12\x6f\x1b\x7e\xc4\xcc\xb0\x58\x4d\xac\x03\xcb\x27\xcc"
)
likely benign
LLM, confidence 0.97
Repeated expected derived-key bytes in an ECDH-1PU test.
Reasoning
Same expected derived-key test vector repeated in another test; benign.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
data = {
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
likely benign
LLM, confidence 0.96
Base64url-encoded JWE protected header in a test fixture.
Reasoning
The base64 segment decodes to a JWE protected header (alg ECDH-1PU+A128KW, enc A256CBC-HS512) in a test fixture; standard JOSE test data.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
+ "RnFVQUZhMzlkeUJjIn19",
likely benign
LLM, confidence 0.96
Continuation of a base64url JWE protected header test fixture.
Reasoning
Continuation of the same base64url JWE header test fixture; benign.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
+ "RnFVQUZhMzlkeUJjIn19",
"unprotected": {"jku": "https://provider.test/jwks"},
likely benign
LLM, confidence 0.96
Continuation of a JWE test fixture including a jku header.
Reasoning
Continuation of the same JWE test fixture with a jku header; benign test data.
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
"crv": "P-521",
"x": "1JDMOjnMgASo01PVHRcyCDtE6CLgKuwXLXLbdLGxpdubLuHYBa0KAepyimnxCWsX",
"y": "w7BSC8Xb3XgMMfE7IFCJpoOmx1Sf3T3_3OZ4CrF6_iCFAw4VOdFYR42OnbKMFG--",
"d": "lCkpFBaVwHzfHtkJEV3PzxefObOPnMgUjNZSLryqC5AkERgXT3-DZLEi6eBzq5gk",
likely benign
LLM, confidence 0.96
P-521 elliptic curve JWK test vector in a test file.
Reasoning
P-521 EC JWK test vector with a comment confirming the point is on the curve; standard test key material.
-
base64-like blob (87 bytes, compression ratio 1.05) (raw pass, confidence 0.60)
"x": "Cd6rinJdgS4WJj6iaNyXiVhpMbhZLmPykmrnFhIad04B3ulf5pURb5v9mx21c_Cv8Q1RBOptwleLg5Qjq2J1qa4",
"y": "hXo9p1EjW6W4opAQdmfNgyxztkNxYwn9L4FVTLX51KNEsW0aqueLm96adRmf0HoGIbNhIdcIlXOKlRUHqgunDkM",
}
likely benign
LLM, confidence 0.96
EC point coordinates used in a curve-validation test.
Reasoning
Coordinate values for an invalid-curve-point test case, annotated in the code; expected test data for a cryptographic library.
-
base64-like blob (75 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
"crv": "X25519",
"x": "lVHcPx4R9bExaoxXZY9tAq7SNW9pJKCoVQxURLtkAs3Dg5ZRxcjhf0JUyg2lod5OGDptJ7wowwY",
}
)
likely benign
LLM, confidence 0.96
X25519 public point used in a curve-mismatch test case.
Reasoning
X25519 point used in a test asserting behavior on mismatched curve; commented test data, benign.
-
base64-like blob (75 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
"crv": "X448",
"x": "lVHcPx4R9bExaoxXZY9tAq7SNW9pJKCoVQxURLtkAs3Dg5ZRxcjhf0JUyg2lod5OGDptJ7wowwY",
}
)
likely benign
LLM, confidence 0.96
X448 public point used in a positive test case.
Reasoning
X448 point used in a valid-curve test case with a comment; benign test vector.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
data = {
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
likely benign
LLM, confidence 0.96
Base64url-encoded JWE protected header test fixture.
Reasoning
Same JWE protected header test fixture as in the ECDH-1PU test file, base64url-encoded and benign in a JOSE library test suite.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
+ "RnFVQUZhMzlkeUJjIn19",
likely benign
LLM, confidence 0.95
Split base64 JWE protected-header test vector in the jose library's test suite.
Reasoning
The base64 fragments decode to a JWE protected header (ECDH-1PU+A128KW, A256CBC-HS512, apu/apv, epk OKP X25519, jku unprotected header). This is a standard JOSE test vector in a jose library test file, not an obfuscated payload. The raw-pass base64 heuristic fires on any long base64 string, so this is a false positive.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
+ "RnFVQUZhMzlkeUJjIn19",
"unprotected": {"jku": "https://provider.test/jwks"},
likely benign
LLM, confidence 0.95
Continuation line of the same base64 JWE protected header test vector.
Reasoning
Continuation of the same JWE protected-header test vector (ECDH-1PU key agreement with an X25519 ephemeral key). The blob is ordinary JOSE test data and the raw heuristic is over-triggering.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
data = {
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
likely benign
LLM, confidence 0.95
Base64 JWE protected header assigned in a test data dictionary.
Reasoning
Same JWE protected header vector (ECDH-1PU, A256CBC-HS512, epk X25519) assigned into a test data dict. Legitimate test fixture for JWE encryption and decryption.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
+ "RnFVQUZhMzlkeUJjIn19",
likely benign
LLM, confidence 0.95
Part of the same base64 JWE test fixture in a test data dictionary.
Reasoning
Part of the same JWE protected-header test fixture. Its structure is standard JOSE with no execution or evasion behaviour.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
+ "RnFVQUZhMzlkeUJjIn19",
"unprotected": {"jku": "https://provider.test/jwks"},
likely benign
LLM, confidence 0.95
Continuation of the JWE test fixture, including a jku unprotected header on a .test domain.
Reasoning
Continuation of the same JWE protected-header test fixture with an unprotected jku header pointing to a .test domain. This is reserved test-domain usage, consistent with a unit test.
-
base64-like blob (236 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
{
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1IjoiUVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9LUCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFBRnFVQUZhMzlkeUJjIn19",
"unprotected": {
likely benign
LLM, confidence 0.95
Full base64 JWE protected header in a JWE serialization test.
Reasoning
A 236-byte base64 string that decodes to the standard JWE protected header used across the test file. Expected in a JOSE library's serialization tests.
-
base64-like blob (236 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
{
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1IjoiUVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9LUCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFBRnFVQUZhMzlkeUJjIn19",
"unprotected": {
likely benign
LLM, confidence 0.95
Repeated full base64 JWE protected header in another test case.
Reasoning
Same 236-byte JWE protected header test vector repeated across test cases. Consistent with a test suite exercising the library.
-
base64-like blob (236 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
{
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1IjoiUVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9LUCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFBRnFVQUZhMzlkeUJjIn19",
"unprotected": {
likely benign
LLM, confidence 0.95
Base64 JWE protected header used as test input.
Reasoning
Same JWE protected header test vector, used as expected or input data in a test. No malicious indicator.
-
base64-like blob (236 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
assert parsed_msg == {
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1IjoiUVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9LUCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFBRnFVQUZhMzlkeUJjIn19",
likely benign
LLM, confidence 0.95
Base64 JWE protected header inside a test assertion comparing parsed output.
Reasoning
The JWE protected header appears as an expected value in an equality assertion (assert parsed_msg == {...}). This is a test assertion over known vector data.
-
base64-like blob (236 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
{
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1IjoiUVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9LUCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFBRnFVQUZhMzlkeUJjIn19",
"unprotected": {
likely benign
LLM, confidence 0.95
Repeated base64 JWE protected header in a test fixture.
Reasoning
Repeated JWE protected header test vector with the same ECDH-1PU structure. Benign test data.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
data = {
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
likely benign
LLM, confidence 0.95
Split base64 JWE protected header assigned in a test data dictionary.
Reasoning
Split base64 JWE protected header in a test data dictionary, matching the other vectors in this file. Benign fixture data.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
"protected": "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
+ "RnFVQUZhMzlkeUJjIn19",
likely benign
LLM, confidence 0.95
Base64url-encoded JWE protected header split across string concatenations in a jose library unit test.
Reasoning
The raw pass flagged a base64 blob in a JWE test fixture. The string is a split base64url-encoded JOSE protected header (alg ECDH-1PU+A128KW, enc A256CBC-HS512, epk OKP X25519), which is the expected content for a JWE test vector in a JOSE library's test suite. Raw-pass base64 hits are high false-positive, and this is a legitimate test fixture.
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
+ "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
+ "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
+ "RnFVQUZhMzlkeUJjIn19",
"unprotected": {"jku": "https://provider.test/jwks"},
likely benign
LLM, confidence 0.95
Continuation of a base64url JWE header fixture in a jose test file.
Reasoning
Continuation of the same JWE test fixture: base64url segments decoding to the epk key and a jku unprotected header pointing at a test URL. Consistent with a unit test exercising header parsing, not obfuscated payload delivery.
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
case2 = (
"eyJhbGciOiJIUzI1NiIsImludmFsaWQiOiIxIiwiY3JpdCI6WyJpbnZhbGlkIl19."
"aGVsbG8.ifW_D1AQWzggrpd8npcnmpiwMD9dp5FTX66lCkYFENM"
)
likely benign
LLM, confidence 0.95
Malformed JWS compact token test vector used to check error handling in a JOSE library.
Reasoning
The snippet is a JWS compact serialization test case: a header segment decoding to alg HS256 with an invalid crit field, the payload 'hello', and an HMAC signature. This is a deliberately malformed token used to test rejection logic in a JOSE library, a common pattern in test suites.
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
disclude.io