bcrypt 5.0.0

Source: https://github.com/pyca/bcrypt
Tag scanned: 5.0.0
Compared with: 4.3.0 (0 signals introduced since)
Files: 8 scanned, 6 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 22 info
Scan time: 14.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 22 of 22 warn and critical signals; 22 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 05:42

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review payload-bytes-literal tests/test_bcrypt.py:130:9

concatenated bytes literal contains 40 `\xNN` escapes (87% of content) — binary payload shape (ast pass, confidence 0.85)
```
    (
        b"}>\xb3\xfe\xf1\x8b\xa0\xe6(\xa2Lzq\xc3P\x7f\xcc\xc8b{\xf9\x14\xf6"
        b"\xf6`\x81G5\xec\x1d\x87\x10\xbf\xa7\xe1}I7 \x96\xdfc\xf2\xbf\xb3Vh"
        b"\xdfM\x88q\xf7\xff\x1b\x82~z\x13\xdd\xe9\x84\x00\xdd4",
```
dismissed LLM, confidence 0.93 Binary test vector bytes in a bcrypt test file.
Reasoning
The bytes literal sits in a bcrypt test file, where binary hash and salt test vectors are expected. The escapes are fixed-length byte values with no decoding or execution path, so the payload-shape heuristic is matching legitimate test data.
info ~~warn~~ → info by review payload-bytes-literal tests/test_bcrypt.py:137:9

concatenated bytes literal contains 37 `\xNN` escapes (84% of content) — binary payload shape (ast pass, confidence 0.85)
```
    (
        b"g7\r\x01\xf3\xd4\xd0\xa9JB^\x18\x007P\xb2N\xc7\x1c\xee\x87&\x83C"
        b"\x8b\xe8\x18\xc5>\x86\x14/\xd6\xcc\x1cJ\xde\xd7ix\xeb\xdeO\xef"
        b"\xe1i\xac\xcb\x03\x96v1' \xd6@.m\xa5!\xa0\xef\xc0(",
```
dismissed LLM, confidence 0.93 Binary test vector bytes in a bcrypt test file.
Reasoning
This is another binary byte literal in the bcrypt test suite, consistent with known-answer test vectors. Nothing in the snippet decodes, executes, or transmits the bytes.
info ~~warn~~ → info by review payload-bytes-literal tests/test_bcrypt.py:346:13

concatenated bytes literal contains 32 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
            b"salt",
            b"\x5b\xbf\x0c\xc2\x93\x58\x7f\x1c\x36\x35\x55\x5c\x27\x79\x65\x98"
            b"\xd4\x7e\x57\x90\x71\xbf\x42\x7e\x9d\x8f\xbe\x84\x2a\xba\x34\xd9",
        ],
```
dismissed LLM, confidence 0.94 Fixed binary salt or hash fixture in a test case list.
Reasoning
The literal is a 16-byte salt or hash fixture in a list of bcrypt test cases. The payload-shape finding comes from the many \xNN escapes, which is normal for raw binary test data.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:346:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            b"salt",
            b"\x5b\xbf\x0c\xc2\x93\x58\x7f\x1c\x36\x35\x55\x5c\x27\x79\x65\x98"
            b"\xd4\x7e\x57\x90\x71\xbf\x42\x7e\x9d\x8f\xbe\x84\x2a\xba\x34\xd9",
        ],
```
dismissed LLM, confidence 0.95 Hex-escaped binary test fixture.
Reasoning
Hex escapes representing raw bytes are the expected way to write binary test fixtures in Python. The entropy is typical of random-looking hash output, and the context is a test file.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:347:15

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
            b"\x5b\xbf\x0c\xc2\x93\x58\x7f\x1c\x36\x35\x55\x5c\x27\x79\x65\x98"
            b"\xd4\x7e\x57\x90\x71\xbf\x42\x7e\x9d\x8f\xbe\x84\x2a\xba\x34\xd9",
        ],
        [
```
dismissed LLM, confidence 0.95 Hex-escaped binary test fixture continuation.
Reasoning
This is a continuation of the same binary test vector list. The raw pass flags ordinary hex escapes in a test fixture, a known false-positive pattern.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:353:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            b"\x00",
            b"\xc1\x2b\x56\x62\x35\xee\xe0\x4c\x21\x25\x98\x97\x0a\x57\x9a\x67",
        ],
        [
```
dismissed LLM, confidence 0.95 Hex-escaped binary test fixture.
Reasoning
Binary test vectors appear here as well, in the same expected-output structure of a bcrypt test. No decoding or execution is present.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:359:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            b"salt",
            b"\x60\x51\xbe\x18\xc2\xf4\xf8\x2c\xbf\x0e\xfe\xe5\x47\x1b\x4b\xb9",
        ],
        [
```
dismissed LLM, confidence 0.95 Hex-escaped binary test fixture.
Reasoning
This is a 16-byte binary fixture in a list of test inputs and expected outputs. The raw match reflects hex-escaped bytes, not obfuscation.
info ~~warn~~ → info by review payload-bytes-literal tests/test_bcrypt.py:366:13

concatenated bytes literal contains 32 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
            b"salt\x00",
            b"\x74\x10\xe4\x4c\xf4\xfa\x07\xbf\xaa\xc8\xa9\x28\xb1\x72\x7f\xac"
            b"\x00\x13\x75\xe7\xbf\x73\x84\x37\x0f\x48\xef\xd1\x21\x74\x30\x50",
        ],
```
dismissed LLM, confidence 0.94 Binary salt and hash fixture in a bcrypt test.
Reasoning
The literal is a salt with a null byte followed by binary hash bytes, a standard form for bcrypt known-answer tests. The payload-shape signal comes only from the escape density.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:366:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            b"salt\x00",
            b"\x74\x10\xe4\x4c\xf4\xfa\x07\xbf\xaa\xc8\xa9\x28\xb1\x72\x7f\xac"
            b"\x00\x13\x75\xe7\xbf\x73\x84\x37\x0f\x48\xef\xd1\x21\x74\x30\x50",
        ],
```
dismissed LLM, confidence 0.95 Hex-escaped binary test fixture.
Reasoning
Hex-escaped bytes in a test fixture are expected here. The raw pass flags a common false-positive pattern in binary test data.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:367:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            b"\x74\x10\xe4\x4c\xf4\xfa\x07\xbf\xaa\xc8\xa9\x28\xb1\x72\x7f\xac"
            b"\x00\x13\x75\xe7\xbf\x73\x84\x37\x0f\x48\xef\xd1\x21\x74\x30\x50",
        ],
        [
```
dismissed LLM, confidence 0.95 Hex-escaped binary test fixture continuation.
Reasoning
This continues the same binary fixture list in the bcrypt test file. The bytes are static test data with no runtime use.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:373:15

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
            b"sa\0l",
            b"\xc2\xbf\xfd\x9d\xb3\x8f\x65\x69\xef\xef\x43\x72\xf4\xde\x83\xc0",
        ],
        [
```
dismissed LLM, confidence 0.95 Hex-escaped binary test fixture with a salt.
Reasoning
The snippet is a binary test vector with a salt and expected hash, a common test pattern in cryptographic libraries. The raw entropy reflects random-looking hash output.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:379:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            b"sa\0lt",
            b"\x4b\xa4\xac\x39\x25\xc0\xe8\xd7\xf0\xcd\xb6\xbb\x16\x84\xa5\x6f",
        ],
        [
```
dismissed LLM, confidence 0.95 Hex-escaped binary test fixture.
Reasoning
This is another binary test vector in the bcrypt test suite. The escapes encode expected output bytes, with no dynamic execution or exfiltration.
info ~~warn~~ → info by review payload-bytes-literal tests/test_bcrypt.py:386:13

concatenated bytes literal contains 64 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
            b"salt",
            b"\xe1\x36\x7e\xc5\x15\x1a\x33\xfa\xac\x4c\xc1\xc1\x44\xcd\x23\xfa"
            b"\x15\xd5\x54\x84\x93\xec\xc9\x9b\x9b\x5d\x9c\x0d\x3b\x27\xbe\xc7"
            b"\x62\x27\xea\x66\x08\x8b\x84\x9b\x20\xab\x7a\xa4\x78\x01\x02\x46"
```
dismissed LLM, confidence 0.94 Large binary test vector in a bcrypt test file.
Reasoning
A 64-byte binary literal built from concatenated escapes in a bcrypt test file matches known-answer test data. The payload-shape rule fires on the byte density, not on any malicious behavior.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:386:15

4 rows of escape runs, lines 386-389 (first: 16 consecutive `\xNN` escapes (entropy 3.8 bits/byte)) (raw pass, confidence 0.65)
```
            b"salt",
            b"\xe1\x36\x7e\xc5\x15\x1a\x33\xfa\xac\x4c\xc1\xc1\x44\xcd\x23\xfa"
            b"\x15\xd5\x54\x84\x93\xec\xc9\x9b\x9b\x5d\x9c\x0d\x3b\x27\xbe\xc7"
            b"\x62\x27\xea\x66\x08\x8b\x84\x9b\x20\xab\x7a\xa4\x78\x01\x02\x46"
```
likely benign LLM, confidence 0.97 Binary test-vector byte literals in a bcrypt unit test file.
Reasoning
The file is a bcrypt test suite; the byte literals are known test vectors (salts, hashes, keys) in a parametrized list. Hex escape runs are the normal way to express binary test data in Python tests.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:396:15

16 consecutive `\xNN` escapes (entropy 3.6 bits/byte) (raw pass, confidence 0.65)
```
            b"salt",
            b"\x83\x3c\xf0\xdc\xf5\x6d\xb6\x56\x08\xe8\xf0\xdc\x0c\xe8\x82\xbd",
        ],
        [
```
likely benign LLM, confidence 0.97 Binary test-vector bytes inside a bcrypt test parameter list.
Reasoning
Same bcrypt test-vector table of raw byte values used as expected inputs or outputs; the pattern is legitimate test data encoding.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:409:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            b"salis\x00",
            b"\x10\x97\x8b\x07\x25\x3d\xf5\x7f\x71\xa1\x62\xeb\x0e\x8a\xd3\x0a",
        ],
        [
```
likely benign LLM, confidence 0.97 Binary test vector in bcrypt tests.
Reasoning
Test vector bytes in a bcrypt test file, consistent with a known-answer test table; no execution or decoding logic is present.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:414:15

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
            8,
            b"\x0d\xb3\xac\x94\xb3\xee\x53\x28\x4f\x4a\x22\x89\x3b\x3c\x24\xae",
            b"\x3a\x62\xf0\xf0\xdb\xce\xf8\x23\xcf\xcc\x85\x48\x56\xea\x10\x28",
            b"\x20\x44\x38\x17\x5e\xee\x7c\xe1\x36\xc9\x1b\x49\xa6\x79\x23\xff",
```
likely benign LLM, confidence 0.97 Binary known-answer test data in bcrypt tests.
Reasoning
Repeated rows of binary expected values in a bcrypt known-answer test table; benign test data.

info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:415:15

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)

            b"\x0d\xb3\xac\x94\xb3\xee\x53\x28\x4f\x4a\x22\x89\x3b\x3c\x24\xae",
            b"\x3a\x62\xf0\xf0\xdb\xce\xf8\x23\xcf\xcc\x85\x48\x56\xea\x10\x28",
            b"\x20\x44\x38\x17\x5e\xee\x7c\xe1\x36\xc9\x1b\x49\xa6\x79\x23\xff",
        ],

likely benign LLM, confidence 0.97 Binary known-answer test data in bcrypt tests.

Reasoning

Continuation of the same bcrypt test vector table; benign.

info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:416:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            b"\x3a\x62\xf0\xf0\xdb\xce\xf8\x23\xcf\xcc\x85\x48\x56\xea\x10\x28",
            b"\x20\x44\x38\x17\x5e\xee\x7c\xe1\x36\xc9\x1b\x49\xa6\x79\x23\xff",
        ],
        [
```
likely benign LLM, confidence 0.97 Binary known-answer test data in bcrypt tests.
Reasoning
Continuation of the same bcrypt test vector table; benign.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:421:15

18 rows of escape runs, lines 421-438 (first: 16 consecutive `\xNN` escapes (entropy 3.9 bits/byte)) (raw pass, confidence 0.65)
```
            8,
            b"\x0d\xb3\xac\x94\xb3\xee\x53\x28\x4f\x4a\x22\x89\x3b\x3c\x24\xae",
            b"\x3a\x62\xf0\xf0\xdb\xce\xf8\x23\xcf\xcc\x85\x48\x56\xea\x10\x28",
            b"\x20\x54\xb9\xff\xf3\x4e\x37\x21\x44\x03\x34\x74\x68\x28\xe9\xed"
```
likely benign LLM, confidence 0.96 Large binary test-vector table in bcrypt tests.
Reasoning
Large block of bcrypt test vectors (e.g., the eksblowfish/bcrypt-pbkdf style known answers) in a test file; hex escapes are the expected representation of binary test inputs.
info ~~warn~~ → info by review payload-bytes-literal tests/test_bcrypt.py:423:13

concatenated bytes literal contains 256 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
            b"\x3a\x62\xf0\xf0\xdb\xce\xf8\x23\xcf\xcc\x85\x48\x56\xea\x10\x28",
            b"\x20\x54\xb9\xff\xf3\x4e\x37\x21\x44\x03\x34\x74\x68\x28\xe9\xed"
            b"\x38\xde\x4b\x72\xe0\xa6\x9a\xdc\x17\x0a\x13\xb5\xe8\xd6\x46\x38"
            b"\x5e\xa4\x03\x4a\xe6\xd2\x66\x00\xee\x23\x32\xc5\xed\x40\xad\x55"
```
likely benign LLM, confidence 0.93 Concatenated bytes literal of binary test vectors in bcrypt tests.
Reasoning
The AST pass flags a concatenated bytes literal of 256 escapes, which is the same test-vector table. Its shape matches binary data, but it is a test fixture in a crypto library test suite, not a dropper or executed payload.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:446:15

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
            b"\xcf\x82",
            b"\x43\x66\x6c\x9b\x09\xef\x33\xed\x8c\x27\xe8\xe8\xf3\xe2\xd8\xe6",
        ],
    ],
```
likely benign LLM, confidence 0.97 Binary test vector bytes in bcrypt tests.
Reasoning
Binary test data rows in a bcrypt test table; the raw-pass escape-run heuristic fires on expected test vectors only.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/pyca/bcrypt bcrypt && cd bcrypt
git checkout 5.0.0
disclude scan --severity info --diff 4.3.0 .