PyPI / azure-keyvault-secrets / 4.12.0

azure-keyvault-secrets 4.12.0

Source

https://github.com/Azure/azure-sdk-for-python

Artifact scanned

azure_keyvault_secrets-4.12.0-py3-none-any.whl (wheel · 109.2 KB · SHA-256 ec5ff84ee0a0…)

Compared with

azure_keyvault_secrets-4.11.3-py3-none-any.whl (0 signals introduced since)

Files

42 scanned, 6 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 1 info

Scan time

3.5 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-29 16:12

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review encoding-base64 azure/keyvault/secrets/_shared/http_challenge.py:27:21

   base64-like blob (88 bytes, compression ratio 1.06) (raw pass, confidence 0.60)

               error_description="User session has been revoked",
               claims="eyJhY2Nlc3NfdG9rZW4iOnsibmJmIjp7ImVzc2VudGlhbCI6dHJ1ZSwgInZhbHVlIjoiMTYwMzc0MjgwMCJ9fX0="
           """
           self.source_authority = self._validate_request_uri(request_uri)

   likely benign LLM, confidence 0.93 A base64-encoded OIDC claims example inside a docstring of Azure Key Vault's HTTP challenge code.

   Reasoning

   The flagged blob is a base64 claims parameter inside a docstring of the Azure Key Vault challenge-handling code. It decodes to a standard OIDC-style claims request ({"access_token":{"nbf":{"essential":true,"value":"1603742800"}}}), which is a documented example of an authentication challenge parameter. It is an ordinary encoded value in a raw-pass finding, a pass with a higher false-positive rate, and there is no execution, decoding into code, or network activity around it.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o azure_keyvault_secrets-4.12.0-py3-none-any.whl https://files.pythonhosted.org/packages/2f/32/48509a0e574485003e7dc22aaebcb985555c69bdf730761427077cd6b854/azure_keyvault_secrets-4.12.0-py3-none-any.whl
printf '%s  %s\n' ec5ff84ee0a045094e62d38e9b962769003e60fe7396d8dcf1ac4c78e7d010c6 azure_keyvault_secrets-4.12.0-py3-none-any.whl | shasum -a 256 -c -
unzip -q azure_keyvault_secrets-4.12.0-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg