bcrypt 5.0.0

Source: https://github.com/pyca/bcrypt
Tag scanned: 5.0.0
Compared with: 4.3.0 (0 signals introduced since)
Files: 8 scanned, 6 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 22 info
Scan time: 12.7 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 22 of 22 warn and critical signals; 22 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:48

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review payload-bytes-literal tests/test_bcrypt.py:130:9

concatenated bytes literal contains 40 `\xNN` escapes (87% of content) — binary payload shape (ast pass, confidence 0.85)
```
    (
        b"}>\xb3\xfe\xf1\x8b\xa0\xe6(\xa2Lzq\xc3P\x7f\xcc\xc8b{\xf9\x14\xf6"
        b"\xf6`\x81G5\xec\x1d\x87\x10\xbf\xa7\xe1}I7 \x96\xdfc\xf2\xbf\xb3Vh"
        b"\xdfM\x88q\xf7\xff\x1b\x82~z\x13\xdd\xe9\x84\x00\xdd4",
```
likely benign LLM, confidence 0.97 Binary test vector bytes literal in bcrypt test suite.
Reasoning
This is a bcrypt test file containing binary test vectors (hashes/salts) written as bytes literals. Binary test vectors in a crypto library test suite are expected, not a payload.
info ~~warn~~ → info by review payload-bytes-literal tests/test_bcrypt.py:137:9

concatenated bytes literal contains 37 `\xNN` escapes (84% of content) — binary payload shape (ast pass, confidence 0.85)
```
    (
        b"g7\r\x01\xf3\xd4\xd0\xa9JB^\x18\x007P\xb2N\xc7\x1c\xee\x87&\x83C"
        b"\x8b\xe8\x18\xc5>\x86\x14/\xd6\xcc\x1cJ\xde\xd7ix\xeb\xdeO\xef"
        b"\xe1i\xac\xcb\x03\x96v1' \xd6@.m\xa5!\xa0\xef\xc0(",
```
likely benign LLM, confidence 0.97 Binary known-answer test vector in bcrypt tests.
Reasoning
Same pattern: binary known-answer test data in a bcrypt test file, consistent with legitimate cryptographic test vectors.
info ~~warn~~ → info by review payload-bytes-literal tests/test_bcrypt.py:346:13

concatenated bytes literal contains 32 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
            b"salt",
            b"\x5b\xbf\x0c\xc2\x93\x58\x7f\x1c\x36\x35\x55\x5c\x27\x79\x65\x98"
            b"\xd4\x7e\x57\x90\x71\xbf\x42\x7e\x9d\x8f\xbe\x84\x2a\xba\x34\xd9",
        ],
```
likely benign LLM, confidence 0.97 16-byte salt/hash test vector in test parameter list.
Reasoning
Bytes literal of 16-byte values adjacent to b"salt" in a test parameter list is a typical KDF/bcrypt test vector layout.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:346:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            b"salt",
            b"\x5b\xbf\x0c\xc2\x93\x58\x7f\x1c\x36\x35\x55\x5c\x27\x79\x65\x98"
            b"\xd4\x7e\x57\x90\x71\xbf\x42\x7e\x9d\x8f\xbe\x84\x2a\xba\x34\xd9",
        ],
```
likely benign LLM, confidence 0.96 Hex-escaped test vector bytes in bcrypt test.
Reasoning
Raw-pass hex escape run is just the same test vector bytes; high-entropy binary data is expected for salts and hashes in crypto tests.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:347:15

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
            b"\x5b\xbf\x0c\xc2\x93\x58\x7f\x1c\x36\x35\x55\x5c\x27\x79\x65\x98"
            b"\xd4\x7e\x57\x90\x71\xbf\x42\x7e\x9d\x8f\xbe\x84\x2a\xba\x34\xd9",
        ],
        [
```
likely benign LLM, confidence 0.96 Hex-escaped test vector bytes in bcrypt test.
Reasoning
Continuation of the same test vector list; expected binary test data in a bcrypt test file.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:353:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            b"\x00",
            b"\xc1\x2b\x56\x62\x35\xee\xe0\x4c\x21\x25\x98\x97\x0a\x57\x9a\x67",
        ],
        [
```
likely benign LLM, confidence 0.96 Hex-escaped test vector bytes in bcrypt test.
Reasoning
Test vector data alongside b"\x00" and other salts in a parameterized bcrypt test; benign.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:359:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            b"salt",
            b"\x60\x51\xbe\x18\xc2\xf4\xf8\x2c\xbf\x0e\xfe\xe5\x47\x1b\x4b\xb9",
        ],
        [
```
likely benign LLM, confidence 0.96 Hex-escaped test vector bytes in bcrypt test.
Reasoning
Hex-escaped 16-byte test vector in a bcrypt test case; expected for cryptographic known-answer tests.
info ~~warn~~ → info by review payload-bytes-literal tests/test_bcrypt.py:366:13

concatenated bytes literal contains 32 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
            b"salt\x00",
            b"\x74\x10\xe4\x4c\xf4\xfa\x07\xbf\xaa\xc8\xa9\x28\xb1\x72\x7f\xac"
            b"\x00\x13\x75\xe7\xbf\x73\x84\x37\x0f\x48\xef\xd1\x21\x74\x30\x50",
        ],
```
likely benign LLM, confidence 0.97 32-byte binary test vector in bcrypt tests.
Reasoning
Binary test vector in bcrypt test file with salt bytes; no execution or decoding of a payload.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:366:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            b"salt\x00",
            b"\x74\x10\xe4\x4c\xf4\xfa\x07\xbf\xaa\xc8\xa9\x28\xb1\x72\x7f\xac"
            b"\x00\x13\x75\xe7\xbf\x73\x84\x37\x0f\x48\xef\xd1\x21\x74\x30\x50",
        ],
```
likely benign LLM, confidence 0.96 Hex-escaped test vector bytes in bcrypt test.
Reasoning
Hex-escaped test vector bytes as part of the same expected-output data in the bcrypt test suite.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:367:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            b"\x74\x10\xe4\x4c\xf4\xfa\x07\xbf\xaa\xc8\xa9\x28\xb1\x72\x7f\xac"
            b"\x00\x13\x75\xe7\xbf\x73\x84\x37\x0f\x48\xef\xd1\x21\x74\x30\x50",
        ],
        [
```
likely benign LLM, confidence 0.96 Hex-escaped test vector bytes in bcrypt test.
Reasoning
Continuation of the test vector list; benign binary test data.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:373:15

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
            b"sa\0l",
            b"\xc2\xbf\xfd\x9d\xb3\x8f\x65\x69\xef\xef\x43\x72\xf4\xde\x83\xc0",
        ],
        [
```
likely benign LLM, confidence 0.96 Hex-escaped test vector bytes with NUL-containing salt.
Reasoning
Test vector with a salt containing an escaped NUL in a bcrypt test; benign test data.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:379:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            b"sa\0lt",
            b"\x4b\xa4\xac\x39\x25\xc0\xe8\xd7\xf0\xcd\xb6\xbb\x16\x84\xa5\x6f",
        ],
        [
```
likely benign LLM, confidence 0.96 Hex-escaped test vector bytes in bcrypt test.
Reasoning
Same kind of binary test vector in bcrypt tests; no decoding or execution path.
info ~~warn~~ → info by review payload-bytes-literal tests/test_bcrypt.py:386:13

concatenated bytes literal contains 64 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
            b"salt",
            b"\xe1\x36\x7e\xc5\x15\x1a\x33\xfa\xac\x4c\xc1\xc1\x44\xcd\x23\xfa"
            b"\x15\xd5\x54\x84\x93\xec\xc9\x9b\x9b\x5d\x9c\x0d\x3b\x27\xbe\xc7"
            b"\x62\x27\xea\x66\x08\x8b\x84\x9b\x20\xab\x7a\xa4\x78\x01\x02\x46"
```
likely benign LLM, confidence 0.93 Concatenated binary salt and hash test vector in the bcrypt test suite.
Reasoning
The bytes literal is a run of 64 escaped bytes spread over concatenated string lines, a standard way to write fixed binary test vectors. The file is a bcrypt test suite with salt and hash-like byte arrays, and the file context points to a legitimate test fixture, not a payload.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:386:15

4 rows of escape runs, lines 386-389 (first: 16 consecutive `\xNN` escapes (entropy 3.8 bits/byte)) (raw pass, confidence 0.65)
```
            b"salt",
            b"\xe1\x36\x7e\xc5\x15\x1a\x33\xfa\xac\x4c\xc1\xc1\x44\xcd\x23\xfa"
            b"\x15\xd5\x54\x84\x93\xec\xc9\x9b\x9b\x5d\x9c\x0d\x3b\x27\xbe\xc7"
            b"\x62\x27\xea\x66\x08\x8b\x84\x9b\x20\xab\x7a\xa4\x78\x01\x02\x46"
```
dismissed LLM, confidence 0.95 Rows of hex-escaped bytes forming bcrypt test vector salts and digests.
Reasoning
Hex escape runs are how binary test vectors are written in Python. The surrounding code is a bcrypt test file that passes salts and expected digests as bytes, so the entropy is expected for cryptographic test data.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:396:15

16 consecutive `\xNN` escapes (entropy 3.6 bits/byte) (raw pass, confidence 0.65)
```
            b"salt",
            b"\x83\x3c\xf0\xdc\xf5\x6d\xb6\x56\x08\xe8\xf0\xdc\x0c\xe8\x82\xbd",
        ],
        [
```
dismissed LLM, confidence 0.95 A 16-byte binary test vector in the bcrypt test data.
Reasoning
A 16-byte escape run in a bcrypt test case. Random-looking bytes are expected for a cryptographic test vector, and the raw pass has a high false-positive rate for this shape.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:409:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            b"salis\x00",
            b"\x10\x97\x8b\x07\x25\x3d\xf5\x7f\x71\xa1\x62\xeb\x0e\x8a\xd3\x0a",
        ],
        [
```
dismissed LLM, confidence 0.95 A 16-byte binary value in a bcrypt test vector list.
Reasoning
A 16-byte hex-escaped value in a list of bcrypt test inputs and expected outputs. This is binary fixture data in a test file.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:414:15

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
            8,
            b"\x0d\xb3\xac\x94\xb3\xee\x53\x28\x4f\x4a\x22\x89\x3b\x3c\x24\xae",
            b"\x3a\x62\xf0\xf0\xdb\xce\xf8\x23\xcf\xcc\x85\x48\x56\xea\x10\x28",
            b"\x20\x44\x38\x17\x5e\xee\x7c\xe1\x36\xc9\x1b\x49\xa6\x79\x23\xff",
```
dismissed LLM, confidence 0.95 Binary test vector bytes inside a bcrypt test case table.
Reasoning
Consecutive hex escapes in a list of bcrypt test vectors. Nothing in the snippet suggests execution or decoding of a payload.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:415:15

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
            b"\x0d\xb3\xac\x94\xb3\xee\x53\x28\x4f\x4a\x22\x89\x3b\x3c\x24\xae",
            b"\x3a\x62\xf0\xf0\xdb\xce\xf8\x23\xcf\xcc\x85\x48\x56\xea\x10\x28",
            b"\x20\x44\x38\x17\x5e\xee\x7c\xe1\x36\xc9\x1b\x49\xa6\x79\x23\xff",
        ],
```
dismissed LLM, confidence 0.95 A 16-byte binary test vector row in the bcrypt test fixtures.
Reasoning
Same pattern as the neighbouring test vector rows: a 16-byte binary literal in a bcrypt test fixture with no decoding or execution.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:416:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            b"\x3a\x62\xf0\xf0\xdb\xce\xf8\x23\xcf\xcc\x85\x48\x56\xea\x10\x28",
            b"\x20\x44\x38\x17\x5e\xee\x7c\xe1\x36\xc9\x1b\x49\xa6\x79\x23\xff",
        ],
        [
```
dismissed LLM, confidence 0.95 A 16-byte binary row in the bcrypt test vector table.
Reasoning
A 16-byte hex-escaped test vector row in a bcrypt test table, consistent with the other fixture rows in the file.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:421:15

18 rows of escape runs, lines 421-438 (first: 16 consecutive `\xNN` escapes (entropy 3.9 bits/byte)) (raw pass, confidence 0.65)
```
            8,
            b"\x0d\xb3\xac\x94\xb3\xee\x53\x28\x4f\x4a\x22\x89\x3b\x3c\x24\xae",
            b"\x3a\x62\xf0\xf0\xdb\xce\xf8\x23\xcf\xcc\x85\x48\x56\xea\x10\x28",
            b"\x20\x54\xb9\xff\xf3\x4e\x37\x21\x44\x03\x34\x74\x68\x28\xe9\xed"
```
dismissed LLM, confidence 0.93 Many rows of binary bcrypt test vectors in a test file.
Reasoning
A block of 18 escape-run rows in the bcrypt test vector table. The data is cryptographic test material, and the file is a test suite, not shipped code that decodes or runs anything.
info ~~warn~~ → info by review payload-bytes-literal tests/test_bcrypt.py:423:13

concatenated bytes literal contains 256 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
            b"\x3a\x62\xf0\xf0\xdb\xce\xf8\x23\xcf\xcc\x85\x48\x56\xea\x10\x28",
            b"\x20\x54\xb9\xff\xf3\x4e\x37\x21\x44\x03\x34\x74\x68\x28\xe9\xed"
            b"\x38\xde\x4b\x72\xe0\xa6\x9a\xdc\x17\x0a\x13\xb5\xe8\xd6\x46\x38"
            b"\x5e\xa4\x03\x4a\xe6\xd2\x66\x00\xee\x23\x32\xc5\xed\x40\xad\x55"
```
likely benign LLM, confidence 0.93 Long concatenated binary test vector in the bcrypt test suite.
Reasoning
A concatenated bytes literal of 256 escapes forms a long binary test vector. The shape matches a payload, but the file is a bcrypt test suite where such vectors are expected, and there is no execution or decoding in the snippet.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:446:15

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
            b"\xcf\x82",
            b"\x43\x66\x6c\x9b\x09\xef\x33\xed\x8c\x27\xe8\xe8\xf3\xe2\xd8\xe6",
        ],
    ],
```
dismissed LLM, confidence 0.95 A 16-byte binary row closing a bcrypt test vector list.
Reasoning
A 16-byte hex-escaped row at the end of a bcrypt test vector table. It is test data with no decoding, execution, or network activity.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/pyca/bcrypt bcrypt && cd bcrypt
git checkout 5.0.0
disclude scan --severity info --diff 4.3.0 .