bcrypt 5.0.0

Source: https://github.com/pyca/bcrypt
Artifact scanned: bcrypt-5.0.0.tar.gz (sdist · 24.8 KB · SHA-256 f748f7c2d6fd…)
Compared with: bcrypt-4.3.0.tar.gz (0 signals introduced since)
Files: 10 scanned, 11 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 22 info
Scan time: 14.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 22 of 22 warn and critical signals; 22 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 08:36

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review payload-bytes-literal tests/test_bcrypt.py:130:9

concatenated bytes literal contains 40 `\xNN` escapes (87% of content) — binary payload shape (ast pass, confidence 0.85)
```
    (
        b"}>\xb3\xfe\xf1\x8b\xa0\xe6(\xa2Lzq\xc3P\x7f\xcc\xc8b{\xf9\x14\xf6"
        b"\xf6`\x81G5\xec\x1d\x87\x10\xbf\xa7\xe1}I7 \x96\xdfc\xf2\xbf\xb3Vh"
        b"\xdfM\x88q\xf7\xff\x1b\x82~z\x13\xdd\xe9\x84\x00\xdd4",
```
likely benign LLM, confidence 0.92 Binary test-vector bytes literal in the bcrypt test suite.
Reasoning
The file is a bcrypt test suite, and this bytes literal of 40 \xNN escapes is a binary known-answer test vector (a hash or key-derivation output). Byte-heavy literals are expected in such tests, and nothing in the snippet executes or decodes anything.
info ~~warn~~ → info by review payload-bytes-literal tests/test_bcrypt.py:137:9

concatenated bytes literal contains 37 `\xNN` escapes (84% of content) — binary payload shape (ast pass, confidence 0.85)
```
    (
        b"g7\r\x01\xf3\xd4\xd0\xa9JB^\x18\x007P\xb2N\xc7\x1c\xee\x87&\x83C"
        b"\x8b\xe8\x18\xc5>\x86\x14/\xd6\xcc\x1cJ\xde\xd7ix\xeb\xdeO\xef"
        b"\xe1i\xac\xcb\x03\x96v1' \xd6@.m\xa5!\xa0\xef\xc0(",
```
likely benign LLM, confidence 0.92 Binary test-vector bytes literal in the bcrypt test suite.
Reasoning
Same file and pattern as the other test vectors: a concatenated bytes literal of expected binary output for a bcrypt test. It is data, not code that runs a payload.
info ~~warn~~ → info by review payload-bytes-literal tests/test_bcrypt.py:346:13

concatenated bytes literal contains 32 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
            b"salt",
            b"\x5b\xbf\x0c\xc2\x93\x58\x7f\x1c\x36\x35\x55\x5c\x27\x79\x65\x98"
            b"\xd4\x7e\x57\x90\x71\xbf\x42\x7e\x9d\x8f\xbe\x84\x2a\xba\x34\xd9",
        ],
```
likely benign LLM, confidence 0.92 Expected binary digest in a parametrized bcrypt test case.
Reasoning
A bytes literal of 32 escapes sits inside a parametrized list of password, salt and expected-output tuples, which is the standard form of known-answer test data in a crypto library's tests.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:346:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            b"salt",
            b"\x5b\xbf\x0c\xc2\x93\x58\x7f\x1c\x36\x35\x55\x5c\x27\x79\x65\x98"
            b"\xd4\x7e\x57\x90\x71\xbf\x42\x7e\x9d\x8f\xbe\x84\x2a\xba\x34\xd9",
        ],
```
dismissed LLM, confidence 0.90 Hex escapes forming a random-looking expected digest in a test vector.
Reasoning
Raw-pass hex-escape hit on the same expected-digest literal as the adjacent finding. The entropy is what random digest bytes would show, and the surrounding code is a test-vector table, so this is a false positive.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:347:15

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
            b"\x5b\xbf\x0c\xc2\x93\x58\x7f\x1c\x36\x35\x55\x5c\x27\x79\x65\x98"
            b"\xd4\x7e\x57\x90\x71\xbf\x42\x7e\x9d\x8f\xbe\x84\x2a\xba\x34\xd9",
        ],
        [
```
dismissed LLM, confidence 0.90 Hex escapes forming a random-looking expected digest in a test vector.
Reasoning
Raw-pass hit on another expected-output byte literal in the bcrypt test table. Random-looking bytes are normal for hash test vectors, and the file context explains them.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:353:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            b"\x00",
            b"\xc1\x2b\x56\x62\x35\xee\xe0\x4c\x21\x25\x98\x97\x0a\x57\x9a\x67",
        ],
        [
```
dismissed LLM, confidence 0.90 Hex escapes forming a random-looking derived key in a test vector.
Reasoning
Raw-pass hit on a 16-byte expected-output literal inside a bcrypt test case list. The entropy is consistent with a derived key, and no decoding or execution is involved.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:359:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            b"salt",
            b"\x60\x51\xbe\x18\xc2\xf4\xf8\x2c\xbf\x0e\xfe\xe5\x47\x1b\x4b\xb9",
        ],
        [
```
dismissed LLM, confidence 0.90 Hex escapes forming a random-looking expected digest in a test vector.
Reasoning
Raw-pass hit on a 16-byte expected-output literal in a bcrypt test table. This is test data with the entropy expected of a hash, not an obfuscated payload.
info ~~warn~~ → info by review payload-bytes-literal tests/test_bcrypt.py:366:13

concatenated bytes literal contains 32 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
            b"salt\x00",
            b"\x74\x10\xe4\x4c\xf4\xfa\x07\xbf\xaa\xc8\xa9\x28\xb1\x72\x7f\xac"
            b"\x00\x13\x75\xe7\xbf\x73\x84\x37\x0f\x48\xef\xd1\x21\x74\x30\x50",
        ],
```
likely benign LLM, confidence 0.92 Binary test-vector bytes literal in the bcrypt test suite.
Reasoning
A 32-byte bytes literal of expected output in a bcrypt known-answer test with a salt that contains a NUL byte. It is a standard test vector with no executable behaviour.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:366:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            b"salt\x00",
            b"\x74\x10\xe4\x4c\xf4\xfa\x07\xbf\xaa\xc8\xa9\x28\xb1\x72\x7f\xac"
            b"\x00\x13\x75\xe7\xbf\x73\x84\x37\x0f\x48\xef\xd1\x21\x74\x30\x50",
        ],
```
dismissed LLM, confidence 0.90 Hex escapes forming a random-looking expected digest in a test vector.
Reasoning
Raw-pass hit on the same expected-output literal as the adjacent finding. The high entropy is what a hash output looks like, so this is a false positive from the raw pass.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:367:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            b"\x74\x10\xe4\x4c\xf4\xfa\x07\xbf\xaa\xc8\xa9\x28\xb1\x72\x7f\xac"
            b"\x00\x13\x75\xe7\xbf\x73\x84\x37\x0f\x48\xef\xd1\x21\x74\x30\x50",
        ],
        [
```
dismissed LLM, confidence 0.90 Hex escapes forming a random-looking expected digest in a test vector.
Reasoning
Raw-pass hit on a 16-byte fragment of a bcrypt test vector. The bytes are expected hash output inside the test data, so the finding does not reflect malicious intent.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:373:15

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
            b"sa\0l",
            b"\xc2\xbf\xfd\x9d\xb3\x8f\x65\x69\xef\xef\x43\x72\xf4\xde\x83\xc0",
        ],
        [
```
dismissed LLM, confidence 0.90 Hex escapes forming a random-looking expected digest in a test vector.
Reasoning
Raw-pass hit on a bytes literal in a bcrypt test case that uses a salt with an embedded NUL. The high-entropy expected output is what a derived key looks like in test data.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:379:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            b"sa\0lt",
            b"\x4b\xa4\xac\x39\x25\xc0\xe8\xd7\xf0\xcd\xb6\xbb\x16\x84\xa5\x6f",
        ],
        [
```
dismissed LLM, confidence 0.90 Hex escapes forming a random-looking expected digest in a test vector.
Reasoning
Raw-pass hit on an expected-output byte literal in the bcrypt test table. It is test data, and the raw pass is known to over-flag this kind of literal.
info ~~warn~~ → info by review payload-bytes-literal tests/test_bcrypt.py:386:13

concatenated bytes literal contains 64 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
            b"salt",
            b"\xe1\x36\x7e\xc5\x15\x1a\x33\xfa\xac\x4c\xc1\xc1\x44\xcd\x23\xfa"
            b"\x15\xd5\x54\x84\x93\xec\xc9\x9b\x9b\x5d\x9c\x0d\x3b\x27\xbe\xc7"
            b"\x62\x27\xea\x66\x08\x8b\x84\x9b\x20\xab\x7a\xa4\x78\x01\x02\x46"
```
likely benign LLM, confidence 0.92 Binary test-vector bytes literal in the bcrypt test suite.
Reasoning
A 64-byte bytes literal of expected output in the bcrypt test vectors, using a salt in the surrounding tuple. It is standard known-answer test data in a crypto library and has no executable behaviour.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:386:15

4 rows of escape runs, lines 386-389 (first: 16 consecutive `\xNN` escapes (entropy 3.8 bits/byte)) (raw pass, confidence 0.65)
```
            b"salt",
            b"\xe1\x36\x7e\xc5\x15\x1a\x33\xfa\xac\x4c\xc1\xc1\x44\xcd\x23\xfa"
            b"\x15\xd5\x54\x84\x93\xec\xc9\x9b\x9b\x5d\x9c\x0d\x3b\x27\xbe\xc7"
            b"\x62\x27\xea\x66\x08\x8b\x84\x9b\x20\xab\x7a\xa4\x78\x01\x02\x46"
```
likely benign LLM, confidence 0.95 Binary bcrypt test vector bytes written as hex escapes in a test file.
Reasoning
The hex escape runs are bcrypt test vectors (salt and hash byte arrays) in a test file for a bcrypt library. Raw byte escapes of this shape are expected for cryptographic test data.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:396:15

16 consecutive `\xNN` escapes (entropy 3.6 bits/byte) (raw pass, confidence 0.65)
```
            b"salt",
            b"\x83\x3c\xf0\xdc\xf5\x6d\xb6\x56\x08\xe8\xf0\xdc\x0c\xe8\x82\xbd",
        ],
        [
```
likely benign LLM, confidence 0.95 16-byte bcrypt known-answer test vector as hex escapes.
Reasoning
Same test-vector table in a bcrypt test suite; 16-byte hex escape rows are the expected representation of known-answer data.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:409:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            b"salis\x00",
            b"\x10\x97\x8b\x07\x25\x3d\xf5\x7f\x71\xa1\x62\xeb\x0e\x8a\xd3\x0a",
        ],
        [
```
likely benign LLM, confidence 0.95 Test vector bytes in a bcrypt test case.
Reasoning
Known-answer test data for bcrypt hashing with a salt string and byte output; no execution or decoding of hidden content.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:414:15

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
            8,
            b"\x0d\xb3\xac\x94\xb3\xee\x53\x28\x4f\x4a\x22\x89\x3b\x3c\x24\xae",
            b"\x3a\x62\xf0\xf0\xdb\xce\xf8\x23\xcf\xcc\x85\x48\x56\xea\x10\x28",
            b"\x20\x44\x38\x17\x5e\xee\x7c\xe1\x36\xc9\x1b\x49\xa6\x79\x23\xff",
```
likely benign LLM, confidence 0.95 Test vector rows in a bcrypt test file.
Reasoning
Consecutive rows of hex-escaped bytes forming a bcrypt test vector, consistent with the rest of the test table.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:415:15

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
            b"\x0d\xb3\xac\x94\xb3\xee\x53\x28\x4f\x4a\x22\x89\x3b\x3c\x24\xae",
            b"\x3a\x62\xf0\xf0\xdb\xce\xf8\x23\xcf\xcc\x85\x48\x56\xea\x10\x28",
            b"\x20\x44\x38\x17\x5e\xee\x7c\xe1\x36\xc9\x1b\x49\xa6\x79\x23\xff",
        ],
```
likely benign LLM, confidence 0.95 Test vector rows in a bcrypt test file.
Reasoning
Continuation of the same bcrypt test-vector table; the bytes are fixed expected outputs for hashing tests.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:416:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            b"\x3a\x62\xf0\xf0\xdb\xce\xf8\x23\xcf\xcc\x85\x48\x56\xea\x10\x28",
            b"\x20\x44\x38\x17\x5e\xee\x7c\xe1\x36\xc9\x1b\x49\xa6\x79\x23\xff",
        ],
        [
```
likely benign LLM, confidence 0.95 Test vector rows in a bcrypt test file.
Reasoning
Same known-answer test table pattern; nothing in the snippet decodes or executes the bytes.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:421:15

18 rows of escape runs, lines 421-438 (first: 16 consecutive `\xNN` escapes (entropy 3.9 bits/byte)) (raw pass, confidence 0.65)
```
            8,
            b"\x0d\xb3\xac\x94\xb3\xee\x53\x28\x4f\x4a\x22\x89\x3b\x3c\x24\xae",
            b"\x3a\x62\xf0\xf0\xdb\xce\xf8\x23\xcf\xcc\x85\x48\x56\xea\x10\x28",
            b"\x20\x54\xb9\xff\xf3\x4e\x37\x21\x44\x03\x34\x74\x68\x28\xe9\xed"
```
likely benign LLM, confidence 0.93 Eighteen rows of bcrypt test vector bytes.
Reasoning
Large block of test vectors for bcrypt in a test module. The escapes are literal test data, the same style as the other findings in this file.
info ~~warn~~ → info by review payload-bytes-literal tests/test_bcrypt.py:423:13

concatenated bytes literal contains 256 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
            b"\x3a\x62\xf0\xf0\xdb\xce\xf8\x23\xcf\xcc\x85\x48\x56\xea\x10\x28",
            b"\x20\x54\xb9\xff\xf3\x4e\x37\x21\x44\x03\x34\x74\x68\x28\xe9\xed"
            b"\x38\xde\x4b\x72\xe0\xa6\x9a\xdc\x17\x0a\x13\xb5\xe8\xd6\x46\x38"
            b"\x5e\xa4\x03\x4a\xe6\xd2\x66\x00\xee\x23\x32\xc5\xed\x40\xad\x55"
```
likely benign LLM, confidence 0.90 Concatenated bytes literal of bcrypt test vector data.
Reasoning
The AST pass flags a concatenated bytes literal as a payload shape, but in a bcrypt test file this is the expected expected-output table for hash comparisons. No dynamic execution, decoding or network use is present in the snippet.
info ~~warn~~ → info by review encoding-hex tests/test_bcrypt.py:446:15

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
            b"\xcf\x82",
            b"\x43\x66\x6c\x9b\x09\xef\x33\xed\x8c\x27\xe8\xe8\xf3\xe2\xd8\xe6",
        ],
    ],
```
likely benign LLM, confidence 0.95 Bytes test vector for bcrypt tests with non-ASCII input.
Reasoning
Test vector bytes in a bcrypt test suite, including UTF-8-like byte sequences for non-ASCII password tests; legitimate test data.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o bcrypt-5.0.0.tar.gz https://files.pythonhosted.org/packages/d4/36/3329e2518d70ad8e2e5817d5a4cac6bba05a47767ec416c7d020a965f408/bcrypt-5.0.0.tar.gz
printf '%s  %s\n' f748f7c2d6fd375cc93d3fba7ef4a9e3a092421b8dbf34d8d4dc06be9492dfdd bcrypt-5.0.0.tar.gz | shasum -a 256 -c -
mkdir pkg && tar -xzf bcrypt-5.0.0.tar.gz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg