PyPI / bracex / 3.2

bracex 3.2

Source

https://github.com/facelessuser/bracex

Tag scanned

3.2

Compared with

3.1.0 (0 signals introduced since)

Files

23 scanned, 2 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 1 info

Scan time

2.8 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 03:13

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-execution tests/generate.sh:18:10

   command name is a variable (`$BASH`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

       fi;
       b="$($BASH -c 'for c in '"$case"'; do echo "[$c]"; done')"
       echo "$case"
       echo -n "$b><><><><";

   likely benign LLM, confidence 0.90 A test-generation script re-invokes the running bash ($BASH) to print expansion results for test cases.

   Reasoning

   The command runs $BASH, the path to the currently running bash interpreter, with a -c string that expands a test case in a brace/glob loop and echoes results. This is a test-fixture generator for shell behavior, not a dropper. Using $BASH to re-invoke the same shell is a standard idiom in test scripts, and the flagged 'variable command name' is only a generic dynamic-execution pattern.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/facelessuser/bracex bracex && cd bracex
git checkout 3.2
disclude scan --severity info --diff 3.1.0 .