Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
identifier `необовʼязкові` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
### Додаткові необовʼязкові залежності { #additional-optional-dependencies }
Є ще деякі додаткові залежності, які ви можете захотіти встановити.
-
identifier `необовʼязкові` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Додаткові необовʼязкові залежності Pydantic:
* [`pydantic-settings`](https://pydantic.dev/docs/validation/latest/concepts/pydantic_settings/) - для керування налаштуваннями.
-
identifier `необовʼязкові` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Додаткові необовʼязкові залежності FastAPI:
* [`orjson`](https://github.com/ijl/orjson) - потрібно, якщо ви хочете використовувати `ORJSONResponse`.
-
identifier `імʼям` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Скажімо, у вас є клас `Person` з імʼям:
{* ../../docs_src/python_types/tutorial010_py310.py hl[1:3] *}
-
identifier `прикладi` contains homoglyph candidates: р (0440)→p, а (0430)→a (raw pass, confidence 0.70)
У попередньому прикладi *операції шляху* очікували б JSON-тіло з атрибутами `Item`, наприклад:
```JSON
-
identifier `прикладi` mixes scripts: Cyrillic + Latin (raw pass, confidence 0.80)
У попередньому прикладi *операції шляху* очікували б JSON-тіло з атрибутами `Item`, наприклад:
```JSON
-
identifier `сирa` contains homoglyph candidates: с (0441)→c, р (0440)→p (raw pass, confidence 0.70)
Якщо вас цікавить, як виглядає «сирa» схема OpenAPI, FastAPI автоматично генерує JSON (схему) з описами всього вашого API.
-
identifier `сирa` mixes scripts: Cyrillic + Latin (raw pass, confidence 0.80)
Якщо вас цікавить, як виглядає «сирa» схема OpenAPI, FastAPI автоматично генерує JSON (схему) з описами всього вашого API.
-
identifier `обʼєкт` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Ви також можете передати шлях до файлу в команду `fastapi dev`, і вона вгадає обʼєкт FastAPI app, який слід використовувати:
```console
-
identifier `памʼятати` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Але вам доведеться щоразу памʼятати передавати правильний шлях\entrypoint під час виклику команди `fastapi`.
-
identifier `необовʼязково` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
### Розгорніть ваш застосунок (необовʼязково) { #deploy-your-app-optional }
За бажанням ви можете розгорнути ваш FastAPI-застосунок у [FastAPI Cloud](https://fastapicloud.com) однією командою. 🚀
-
identifier `Підібʼємо` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
## Підібʼємо підсумки, крок за кроком { #recap-step-by-step }
### Крок 1: імпортуємо `FastAPI` { #step-1-import-fastapi }
-
identifier `навʼязує` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
**FastAPI** не навʼязує жодного конкретного значення.
Наведена тут інформація подана як настанова, а не вимога.
-
identifier `обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Існує багато інших обʼєктів і моделей, які будуть автоматично конвертовані в JSON (зокрема ORM тощо). Спробуйте використати свої улюблені - велика ймовірність, що вони вже підтрим
-
identifier `Підібʼємо` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
## Підібʼємо підсумки { #recap }
* Імпортуйте `FastAPI`.
-
identifier `розвʼязати` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Існувала також специфікація «OpenID». Вона намагалася розвʼязати те саме, що й **OpenID Connect**, але не базувалась на OAuth2.
Тож це була повністю додаткова система.
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
-
string literal compression ratio 0.962 (132 bytes) (raw pass, confidence 0.60)
* <dfn title="被設定為連接並以某種方式一起工作的機器群組。">叢集</dfn>
* <dfn title="一種機器學習方法，使用具備多個隱藏層的人工神經網路，在輸入與輸出層之間建立完整的內部結構">深度學習</dfn>
## 標題 { #headings }
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
-
string literal compression ratio 0.975 (161 bytes) (raw pass, confidence 0.60)
QL 資料庫函式庫（有時稱為 <abbr title="Object Relational Mapper - 物件關聯對應器：一個用來描述某些類別代表 SQL 資料表且其實例代表資料表中資料列的函式庫的術語">"ORMs"</abbr>），FastAPI 不會強迫你使用特定工具。😎
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
-
file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
if "gzip" in self.headers.getlist("Content-Encoding"):
body = gzip.decompress(body)
self._body = body
return self._body
-
file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
if "gzip" in self.headers.getlist("Content-Encoding"):
body = gzip.decompress(body)
self._body = body
return self._body
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Default
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant
likely benign
LLM, confidence 0.93
Soft hyphen characters embedded in German words in a markdown doc.
Reasoning
Soft hyphen inside German compound word 'Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung' in documentation markdown; typical of hyphenation in German text, not an attack vector.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Default
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant
likely benign
LLM, confidence 0.93
Second soft hyphen in a German compound word in a markdown doc.
Reasoning
Same soft hyphen pattern in a German compound word within docs; benign hyphenation artifact.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant
* die Anwendung bereitstellen
likely benign
LLM, confidence 0.93
Soft hyphen in German prose in a docs file.
Reasoning
Soft hyphen in 'Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung' in documentation prose; benign.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant
* die Anwendung bereitstellen
likely benign
LLM, confidence 0.93
Soft hyphen in German prose in a docs file.
Reasoning
Soft hyphen in German prose; no code execution or hidden payload.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
PowerShell env var assignment example in a console code block in settings docs.
Reasoning
PowerShell environment variable syntax ($Env:...) shown in a console example in docs; the flagged 'variable command' is an illustrative shell line, not executed by the project.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Second PowerShell env var example line in settings docs.
Reasoning
Same illustrative PowerShell environment setup in documentation followed by a normal uv run command.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
Außerdem ist Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung in HTTP-Headern nicht relevant, daher können Sie sie im Standard-Python-Stil (auch bekannt als „snake_case“) deklarieren.
likely benign
LLM, confidence 0.93
Soft hyphen in German tutorial text.
Reasoning
Soft hyphen within German word 'Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung' in tutorial prose; benign.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
Außerdem ist Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung in HTTP-Headern nicht relevant, daher können Sie sie im Standard-Python-Stil (auch bekannt als „snake_case“) deklarieren.
likely benign
LLM, confidence 0.93
Second soft hyphen in German tutorial text.
Reasoning
Soft hyphen in German tutorial prose; benign hyphenation.
-
line length 725 characters (raw pass, confidence 0.50)
-
line length 930 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
Sample JWT string used as an example in OAuth2 tutorial.
Reasoning
This is the canonical example JWT from jwt.io documentation, widely used in tutorials; it is a sample token, not a secret or payload.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Starlette's Y: Starlettes Y
* X is case-sensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant in X
* X is case-insensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant in X
* standard Python: Standard-Python
likely benign
LLM, confidence 0.93
Soft hyphen in German text in a prompt markdown file.
Reasoning
Soft hyphen in German prose inside an LLM prompt doc; benign.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Starlette's Y: Starlettes Y
* X is case-sensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant in X
* X is case-insensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant in X
* standard Python: Standard-Python
likely benign
LLM, confidence 0.93
Second soft hyphen in German prompt text.
Reasoning
Soft hyphen in German prose; no hidden instructions or code.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* X is case-sensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant in X
* X is case-insensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant in X
* standard Python: Standard-Python
* deprecated: deprecatet
likely benign
LLM, confidence 0.93
Soft hyphen in German prompt text line.
Reasoning
Soft hyphen in German prose in documentation; benign.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* X is case-sensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant in X
* X is case-insensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant in X
* standard Python: Standard-Python
* deprecated: deprecatet
likely benign
LLM, confidence 0.93
Second soft hyphen in German prompt text line.
Reasoning
Soft hyphen in German prose; benign hyphenation.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
PowerShell env var example in English settings docs.
Reasoning
Illustrative PowerShell env var example in English docs console block; not executed code.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Second PowerShell env var example in English settings docs.
Reasoning
Same illustrative PowerShell env setup in English docs; benign.
-
file mixes tab and space indentation (6 tab-indented and 172 space-indented lines) (raw pass, confidence 0.40)
class Termynal {
-
line length 508 characters (raw pass, confidence 0.50)
* ✨ Allow setting the `response_class` to `RedirectResponse` or `FileResponse` and returning the URL from the function. New and updated docs are in the tutorial section **Custom Response - HTML, Stream, File, others**, in [RedirectResponse](https://fastapi.tiangolo.com/advanced/custom-response/#redirectresponse) and
-
identifier `с` contains homoglyph candidates: с (0441)→c (raw pass, confidence 0.70)
* 📝 Add link to article in Russian "FastAPI: знакомимся с фреймворком". PR [#2564](https://github.com/tiangolo/fastapi/pull/2564) by [@trkohler](https://github.com/trkohler).
likely benign
LLM, confidence 0.95
Cyrillic letter in a Russian article title inside release notes.
Reasoning
The Cyrillic 'с' sits inside ordinary Russian prose in a release note ('знакомимся с фреймворком'). Homoglyph flags in natural-language text in a non-Latin language are expected; this is not an identifier used for deception.
-
line length 706 characters (raw pass, confidence 0.50)
-
line length 882 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
Sample JWT token in the OAuth2 tutorial.
Reasoning
This is the canonical JWT example token from jwt.io (header {alg HS256, typ JWT}, sample payload 'John Doe'). It is documentation illustrating the format, not a hidden payload.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
PowerShell environment-variable example in Spanish settings docs.
Reasoning
This is a PowerShell console example in Markdown showing how to set environment variables. The 'variable command' flag comes from the bash parser misreading PowerShell $Env: syntax. It is documentation, not a dropper.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
PowerShell environment-variable example in Spanish settings docs.
Reasoning
Same PowerShell documentation example as the preceding finding, with the same parser artifact on $Env.
-
line length 750 characters (raw pass, confidence 0.50)
-
line length 921 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
Sample JWT token in the Spanish OAuth2 tutorial.
Reasoning
Same canonical jwt.io sample token used in the English docs, shown as an illustrative example.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
PowerShell environment-variable example in French settings docs.
Reasoning
Same PowerShell environment-variable documentation example; the variable-command warning is a parser artifact.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
PowerShell environment-variable example in French settings docs.
Reasoning
Same PowerShell documentation example as the other locale copies.
-
compression ratio 0.850 is >2σ above file mean 0.736 (raw pass, confidence 0.50)
Si vous exécutez votre conteneur derrière un proxy de terminaison TLS (load balancer) comme Nginx ou Traefik, ajoutez l'option `--proxy-headers`, cela indiquera à Uvicorn (via la CLI FastAPI) de faire confiance aux en-têtes envoyés par ce proxy lui indiquant que l'application s'exécute derrière HTTPS, etc.
-
line length 725 characters (raw pass, confidence 0.50)
-
line length 918 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
Sample JWT token in the French OAuth2 tutorial.
Reasoning
Same canonical sample JWT token used as documentation.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
PowerShell environment-variable example in Hindi settings docs.
Reasoning
Same PowerShell environment-variable documentation example in the Hindi translation.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
PowerShell environment-variable example in Hindi settings docs.
Reasoning
Same PowerShell documentation example in the Hindi translation.
-
line length 674 characters (raw pass, confidence 0.50)
-
line length 871 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
Sample JWT token in the Hindi OAuth2 tutorial.
Reasoning
Same canonical sample JWT token used as documentation in the Hindi translation.
-
identifier `時々いくつかランダムに見える変更を行うことがあります` mixes scripts: Han + Other + Hiragana + Katakana (raw pass, confidence 0.80)
�良であることを意味します（時々いくつかランダムに見える変更を行うことがあります。理由は [LLM は決定論的アルゴリズムではない](https://doublespeak.chat/#/handbook#deterministic-output) ためです）。
likely benign
LLM, confidence 0.90
Japanese sentence in an LLM test doc flagged for mixed scripts.
Reasoning
Japanese prose mixing Han, Hiragana and Katakana with punctuation is normal for Japanese text. The file is an LLM test document, and the mixed-script flag is a false positive on natural language.
-
string literal compression ratio 0.962 (130 bytes) (raw pass, confidence 0.60)
* <abbr title="Mozilla Developer Network - Mozilla 開発者ネットワーク: 開発者向けドキュメント、Firefox の開発元が執筆">MDN</abbr>
* <abbr title="Input/Output - 入出力: ディスクの読み書き、ネットワーク通信。">I/O</abbr>.
likely benign
LLM, confidence 0.95
Markdown glossary lines with HTML abbr tags containing Japanese explanatory text.
Reasoning
This is a raw-pass high-complexity signal on a Japanese markdown documentation file. The high compression ratio is caused by long, non-repetitive Japanese prose inside HTML abbr title attributes, which is normal for translated glossary text. No executable code, encoding, or dropper behavior is present.
-
identifier `リクエストごとやユーザーごとに別々のモデルを使うわけではありません` mixes scripts: Katakana + Hiragana + Han + Other (raw pass, confidence 0.80)
同じモデルをリクエスト間で共有するので、リクエストごとやユーザーごとに別々のモデルを使うわけではありません。
dismissed
LLM, confidence 0.95
Japanese sentence in FastAPI documentation flagged for mixed scripts.
Reasoning
Japanese prose mixing hiragana, katakana and kanji is normal; the flagged 'identifier' is a sentence in markdown, not code. Raw-pass unicode-mixed-script is a known false-positive pattern for CJK text.
-
identifier `共有するロジックや変数のない別々の関数でそれを行うのは難しく` mixes scripts: Han + Hiragana + Katakana + Other (raw pass, confidence 0.80)
共有するロジックや変数のない別々の関数でそれを行うのは難しく、グローバル変数などに値を保存する必要が出てきます。
そのため、現在は上で説明したとおり `lifespan` を使うことが推奨されています。
dismissed
LLM, confidence 0.95
Japanese documentation paragraph about lifespan and global state flagged for mixed scripts.
Reasoning
Ordinary Japanese documentation prose. Mixed scripts are the normal form of written Japanese, and the file is markdown with no executable content.
-
identifier `個々のリクエストと` mixes scripts: Han + Other + Hiragana + Katakana (raw pass, confidence 0.80)
- **トレース**: 個々のリクエストと、それを処理するために実行された操作の記録です。時間を計測する各操作を**スパン**と呼びます。
- **ログ**: アプリケーションの起動や操作の失敗など、イベントのタイムスタンプ付きの記録です。
dismissed
LLM, confidence 0.95
Japanese bullet describing traces in OpenTelemetry docs flagged for mixed scripts.
Reasoning
Standard Japanese prose in a bullet list describing traces and logs. The script mixing is expected for Japanese text.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
PowerShell environment-variable example in a settings doc misread as dynamic command execution.
Reasoning
This is a console example in markdown showing PowerShell environment variable syntax ($Env:NAME = value). The scanner misparsed the $Env assignment as a command invocation. It is documentation, not executable code, and nothing is downloaded or run maliciously.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Second PowerShell env-var example line in the settings doc flagged as dynamic execution.
Reasoning
Same console block as the previous finding: a documentation example setting environment variables before running fastapi. The variable-command-name signal is a parser artifact of PowerShell syntax in markdown.
-
identifier `時々カウンターの表示を見て` mixes scripts: Han + Other + Katakana + Hiragana (raw pass, confidence 0.80)
時々カウンターの表示を見て、自分の番号になっているか確認します。
やがてあなたの番になります。カウンターに行き、ハンバーガーを受け取り、テーブルに戻ります。
dismissed
LLM, confidence 0.95
Japanese analogy paragraph in async documentation flagged for mixed scripts.
Reasoning
Japanese narrative prose from the restaurant analogy in the async docs. Mixed kanji, hiragana and katakana is normal and the file is markdown.
-
identifier `家の別々のエリアを掃除できれば` mixes scripts: Han + Hiragana + Other + Katakana (raw pass, confidence 0.80)
しかしこの場合、8 人の元レジ係/料理人/現清掃員を連れてきて、それぞれ (あなたも加えて) 家の別々のエリアを掃除できれば、**並列** に作業でき、より早く終えられます。
dismissed
LLM, confidence 0.95
Japanese paragraph about parallel work in async docs flagged for mixed scripts.
Reasoning
Japanese prose about parallel cleaning in a documentation analogy. The mixed-script signal is a false positive on natural Japanese text.
-
identifier `我々は間違いを犯す` mixes scripts: Han + Other + Hiragana (raw pass, confidence 0.80)
### 我々は間違いを犯す { #we-make-mistakes }
私たち人間は常に**間違い**を犯します。ソフトウェアには、ほとんど常に**バグ**があらゆる箇所に隠されています。🐛
dismissed
LLM, confidence 0.95
Japanese heading about making mistakes in deployment concepts doc flagged for mixed scripts.
Reasoning
Japanese heading and prose about human error in deployment docs. Normal CJK text in markdown, not an identifier or obfuscation.
-
identifier `他の人々のこれまでの働きがなければ存在しなかったでしょう` mixes scripts: Han + Hiragana + Other (raw pass, confidence 0.80)
**FastAPI**は、他の人々のこれまでの働きがなければ存在しなかったでしょう。
以前に作られた多くのツールが、作成における刺激として役立ってきました。
dismissed
LLM, confidence 0.95
Japanese history sentence flagged for mixed scripts.
Reasoning
Standard Japanese sentence about FastAPI's history in a documentation file. Mixed script usage is expected.
-
identifier `を別々のモデルとして分けて使うことは可能です` mixes scripts: Hiragana + Han + Other + Katakana (raw pass, confidence 0.80)
...しかし、同じアプリ内で Pydantic v1 と v2 を別々のモデルとして分けて使うことは可能です。
```mermaid
dismissed
LLM, confidence 0.95
Japanese Pydantic migration sentence flagged for mixed scripts.
Reasoning
Japanese migration guidance prose in markdown. The mixed scripts and the surrounding Latin tokens are ordinary for this text, with no code execution involved.
-
identifier `徐々に` mixes scripts: Han + Other + Hiragana (raw pass, confidence 0.80)
`bump-pydantic` が適用できない場合は、同一アプリで v1 と v2 のモデルを併用できるサポートを利用して、徐々に v2 へ移行できます。
dismissed
LLM, confidence 0.95
Japanese sentence about gradual v2 migration flagged for mixed scripts.
Reasoning
Japanese prose about incremental migration. The signal is triggered by normal kanji and hiragana in documentation text.
-
string literal compression ratio 1.036 (140 bytes) (raw pass, confidence 0.70)
"_FastAPIライブラリを採用し、クエリで **予測値** を取得できる **REST** サーバを構築しました。 [for Ludwig]_"
dismissed
LLM, confidence 0.90
Short Japanese string in the docs index flagged for high complexity by compression ratio.
Reasoning
This is a short Japanese string in the markdown index page, a quoted badge/sentence. Its compression ratio is high only because it is short, non-repetitive text; there is no encoded payload or code behind it.
-
identifier `様々な階層` mixes scripts: Han + Other + Hiragana (raw pass, confidence 0.80)
`BackgroundTasks` の使用は依存性注入システムでも機能し、様々な階層 (*path operation function*、依存性 (dependable)、サブ依存性など) で `BackgroundTasks` 型のパラメーターを宣言できます。
dismissed
LLM, confidence 0.95
Japanese documentation sentence about declaring BackgroundTasks parameters, flagged for mixed-script text.
Reasoning
The flagged identifier is ordinary Japanese prose in a Markdown tutorial. Mixing Han, Hiragana and punctuation is normal for Japanese text and carries no code-level risk.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
**FastAPI** は、それぞれの場合の処理⟨U+200B⟩⟨U+200B⟩方法と同じオブジェクトの再利用方法を知っているため、すべてのバックグラウンドタスクがマージされ、バックグラウンドで後で実行されます:
likely benign
LLM, confidence 0.80
Stray zero-width space in a Japanese tutorial paragraph about background task merging.
Reasoning
A zero-width space inside Japanese prose is a typical artifact of translation or copy-paste. It is not executable and does not change rendered meaning in any harmful way, though it is untidy.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
**FastAPI** は、それぞれの場合の処理⟨U+200B⟩⟨U+200B⟩方法と同じオブジェクトの再利用方法を知っているため、すべてのバックグラウンドタスクがマージされ、バックグラウンドで後で実行されます:
likely benign
LLM, confidence 0.80
Second stray zero-width space in the same Japanese paragraph.
Reasoning
This is a second zero-width space in the same Japanese paragraph, consistent with the same copy or translation artifact. It has no code effect.
-
identifier `個々の` mixes scripts: Han + Other + Hiragana (raw pass, confidence 0.80)
`APIRouter` に `dependencies` を置くことで、*path operations* のグループ全体に認証を要求する、といった用途に使えます。個々の *path operation* に依存関係を追加していなくても構いません。
///
dismissed
LLM, confidence 0.95
Japanese documentation sentence about APIRouter dependencies, flagged for mixed-script text.
Reasoning
The identifier is ordinary Japanese prose in documentation. Mixed Han and Hiragana is expected and not an obfuscation signal.
-
line length 509 characters (raw pass, confidence 0.50)
-
line length 720 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
Example JSON Web Token in a tutorial showing header, payload and signature segments.
Reasoning
The blob is the widely published jwt.io example JWT used to illustrate token structure. It is a documentation sample, not a credential or payload.
-
identifier `同じデータベースを使用してDjangoアプリケーションを徐々に移行することもできます` mixes scripts: Han + Hiragana + Katakana + Latin + Other (raw pass, confidence 0.80)
例えば、Djangoアプリケーションからデータベース内の同じデータをFastAPIアプリケーションと共有できるだけではなく、同じデータベースを使用してDjangoアプリケーションを徐々に移行することもできます。
dismissed
LLM, confidence 0.95
Japanese documentation sentence about migrating from Django, flagged for mixed-script text.
Reasoning
This is Japanese prose discussing Django and FastAPI sharing a database. The mixed scripts are natural in this text and there is no code behind it.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Korean docs showing PowerShell commands that set ADMIN_EMAIL and APP_NAME environment variables.
Reasoning
This is a PowerShell example in a console block showing how to set environment variables before running uvicorn-style commands. The $Env: syntax is documentation of user-run commands. The file does not execute anything, and the flag is an AST heuristic that cannot see that the command is illustrative.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Second PowerShell environment-variable example in the same Korean settings doc.
Reasoning
Same as the adjacent finding: a documentation console example setting environment variables for a FastAPI app. Nothing is executed by the file.
-
string literal compression ratio 0.992 (128 bytes) (raw pass, confidence 0.70)
* 100% <dfn title="Python 타입 어노테이션으로, 이를 통해 편집기와 외부 도구가 더 나은 지원을 제공할 수 있습니다">타입 어노테이션</dfn> 코드 베이스.
* 프로덕션 애플리케이션에서 사용됩니다.
dismissed
LLM, confidence 0.90
Korean feature-list text with an inline HTML dfn element, flagged for high string compressibility.
Reasoning
The high compression ratio comes from Korean natural-language prose and an HTML definition element. Repeated Hangul and short phrases compress well, so this is not encoded content.
-
string literal compression ratio 0.957 (162 bytes) (raw pass, confidence 0.60)
"_**FastAPI** 라이브러리를 채택하여 **예측**을 얻기 위해 쿼리를 실행할 수 있는 **REST** 서버를 생성했습니다. [Ludwig을 위해]_"
dismissed
LLM, confidence 0.90
Korean testimonial quote about a Ludwig project built with FastAPI.
Reasoning
This is a Korean quotation in Markdown. Its compressibility reflects ordinary repetitive prose, not obfuscation.
-
string literal compression ratio 0.956 (183 bytes) (raw pass, confidence 0.60)
"_**Netflix**는 우리의 **위기 관리** 오케스트레이션 프레임워크인 **Dispatch**의 오픈 소스 공개를 발표하게 되어 기쁩니다! [**FastAPI**로 빌드]_"
dismissed
LLM, confidence 0.90
Korean testimonial quote about Netflix's Dispatch project built with FastAPI.
Reasoning
This is a Korean testimonial quote in documentation. The compression ratio reflects natural-language text and there is no executable or encoded payload.
-
line length 514 characters (raw pass, confidence 0.50)
-
line length 719 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
Example JSON Web Token in the Korean OAuth2 JWT tutorial.
Reasoning
This is the same widely published jwt.io sample token used in the tutorial. It is an illustrative value, not a live secret.
-
identifier `azərbaycan` mixes scripts: Latin + Other (raw pass, confidence 0.80)
ay: aymar aru
az: azərbaycan dili
ba: башҡорт теле
be: беларуская мова
dismissed
LLM, confidence 0.90
Language-name mapping entry for Azerbaijani written in its native Latin script with schwa.
Reasoning
The value is the native-language name of Azerbaijani written with the schwa ə, a legitimate Latin-extended character. This is a locale-name data file with no code path.
-
identifier `Eʋegbe` mixes scripts: Latin + Other (raw pass, confidence 0.80)
dz: རྫོང་ཁ
ee: Eʋegbe
el: Ελληνικά
en: English
likely benign
LLM, confidence 0.93
The Ewe language name 'Eʋegbe' in a language-names mapping uses the standard Ewe letter ʋ.
Reasoning
The flagged identifier is the Ewe language name 'Eʋegbe' in a YAML table of language display names. The 'ʋ' is a standard Latin-script letter used in Ewe orthography, so the mixed-script warning is a false positive from a legitimate multilingual list.
-
identifier `æвзаг` contains homoglyph candidates: а (0430)→a (raw pass, confidence 0.70)
or: ଓଡ଼ିଆ
os: ирон æвзаг
pa: ਪੰਜਾਬੀ
pi: पाऴि
likely benign
LLM, confidence 0.85
The Ossetian language name 'ирон æвзаг' in a language-names list mixes Cyrillic and æ as its native orthography.
Reasoning
The value 'ирон æвзаг' is the native name of the Ossetian language. Its Cyrillic letters and the Latin-looking 'æ' are the normal orthography, so the homoglyph flag reflects legitimate multilingual text in a language-names table, not spoofing.
-
identifier `æвзаг` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)
or: ଓଡ଼ିଆ
os: ирон æвзаг
pa: ਪੰਜਾਬੀ
pi: पाऴि
likely benign
LLM, confidence 0.85
The same Ossetian language name is flagged for mixing Cyrillic and Latin 'æ', which is its normal spelling.
Reasoning
This is the mixed-script report for the same Ossetian name 'ирон æвзаг'. Cyrillic plus 'æ' is expected for this language, and the context is a plain documentation table, so there is no sign of obfuscation.
-
identifier `Saɯ` mixes scripts: Latin + Other (raw pass, confidence 0.80)
yo: Yorùbá
za: Saɯ cueŋƅ
zh: 简体中文
zh-hant: 繁體中文
likely benign
LLM, confidence 0.90
The Zhuang language name 'Saɯ cueŋƅ' uses IPA-style letters in a language-names table.
Reasoning
The value 'Saɯ cueŋƅ' is the Zhuang language name written with IPA-style letters (ɯ, ŋ, ƅ), which is standard for that language. It sits in a language-names mapping, so the mixed-script finding is a false positive.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.85
A documentation console example sets PowerShell environment variables before running a FastAPI app.
Reasoning
This is a PowerShell-style environment variable assignment inside a console example block in Portuguese tutorial documentation. The '$Env' is shown as a user typing a command, not as code that runs from this file, so the dynamic-execution flag is a documentation false positive.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.85
A second console example in the settings doc shows the same PowerShell environment-variable setup.
Reasoning
This is the same PowerShell environment-variable example in the Portuguese settings documentation. It is illustrative console text in a markdown tutorial, with no executable payload or encoded content.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
o tem suas próprias coisas, variáveis ⟨U+200B⟩⟨U+200B⟩e memória. E se você estiver consumindo uma grande quantidade de memória em seu código, **cada processo** consumirá uma quantidade equivalente de memória.
likely benign
LLM, confidence 0.80
A zero-width space sits between words in a Portuguese deployment-concepts paragraph.
Reasoning
A zero-width space appears inside Portuguese prose ('variáveis ⟨U+200B⟩⟨U+200B⟩e memória'). This is most likely a copy-paste or translation-tool artifact in documentation text. It is invisible noise, not a functional payload, though it is worth cleaning up.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
em suas próprias coisas, variáveis ⟨U+200B⟩⟨U+200B⟩e memória. E se você estiver consumindo uma grande quantidade de memória em seu código, **cada processo** consumirá uma quantidade equivalente de memória.
likely benign
LLM, confidence 0.80
A second zero-width space appears in the same Portuguese deployment-concepts paragraph.
Reasoning
Another zero-width space in the same Portuguese paragraph, repeated around the word 'variáveis'. It is consistent with a translation or editing artifact in prose and has no execution or data-hiding role.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Esses processos de trabalho seriam aqueles que executariam sua aplicação, eles executariam os cálculos principais para receber uma **request** e retornar uma **resposta**, e carregariam qualquer coisa que você colocasse em variáveis ⟨U+200B⟩⟨U+200B⟩na RAM.
<img src="/img/deployment/concepts/process-ram.drawio.svg">
likely benign
LLM, confidence 0.80
A zero-width space sits in a Portuguese paragraph that precedes an image in the deployment-concepts doc.
Reasoning
A zero-width space appears in Portuguese prose near an image tag and the word 'variáveis'. The pattern matches invisible characters left by copy or translation tooling, not code that hides logic.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Esses processos de trabalho seriam aqueles que executariam sua aplicação, eles executariam os cálculos principais para receber uma **request** e retornar uma **resposta**, e carregariam qualquer coisa que você colocasse em variáveis ⟨U+200B⟩⟨U+200B⟩na RAM.
<img src="/img/deployment/concepts/process-ram.drawio.svg">
likely benign
LLM, confidence 0.80
A second zero-width space appears in the same Portuguese deployment-concepts passage.
Reasoning
This is another zero-width space in the same Portuguese passage. The characters are invisible formatting noise in documentation prose and do not form an encoded or executable payload.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Para alterar as URLs usadas ⟨U+200B⟩⟨U+200B⟩para as interfaces de usuário da documentação gerada automaticamente, leia a documentação de [Tutorial - Metadados e URLs da Documentação](../tutorial/metadata.md#docs-urls).
likely benign
LLM, confidence 0.80
A zero-width space sits in a Portuguese how-to sentence about documentation URLs.
Reasoning
A zero-width space appears in the Portuguese sentence 'usadas ⟨U+200B⟩⟨U+200B⟩para as interfaces'. This looks like an artifact from translation or copy-paste in a documentation file, not a hidden instruction or code.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Para alterar as URLs usadas ⟨U+200B⟩⟨U+200B⟩para as interfaces de usuário da documentação gerada automaticamente, leia a documentação de [Tutorial - Metadados e URLs da Documentação](../tutorial/metadata.md#docs-urls).
likely benign
LLM, confidence 0.80
A second zero-width space appears in the same Portuguese how-to sentence.
Reasoning
A second zero-width space in the same Portuguese sentence, again consistent with invisible copy or translation residue in prose. There is no functional or concealed logic involved.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Mas isso só permitirá certos tipos de comunicação, excluindo tudo que envolva credenciais: cookies, cabeçalhos de autorização como aqueles usados ⟨U+200B⟩⟨U+200B⟩com Bearer Tokens, etc.
Então, para que tudo funcione corretamente, é melhor especificar explicitamente as origens permitidas.
likely benign
LLM, confidence 0.80
A zero-width space sits in a Portuguese CORS tutorial paragraph.
Reasoning
A zero-width space appears in the Portuguese CORS tutorial prose ('usados ⟨U+200B⟩⟨U+200B⟩com Bearer Tokens'). This is invisible formatting residue in documentation text, with no effect on code or data.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Mas isso só permitirá certos tipos de comunicação, excluindo tudo que envolva credenciais: cookies, cabeçalhos de autorização como aqueles usados ⟨U+200B⟩⟨U+200B⟩com Bearer Tokens, etc.
Então, para que tudo funcione corretamente, é melhor especificar explicitamente as origens permitidas.
likely benign
LLM, confidence 0.80
A second zero-width space appears in the same Portuguese CORS tutorial paragraph.
Reasoning
A second zero-width space in the same CORS tutorial paragraph. It is the same invisible translation or copy artifact and does not hide any executable content.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Os parâmetros padrão usados ⟨U+200B⟩⟨U+200B⟩pela implementação `CORSMiddleware` são restritivos por padrão, então você precisará habilitar explicitamente as origens, métodos ou cabeçalhos específicos para que os navegadores tenham permissão para usá-los em um contexto cross domain.
likely benign
LLM, confidence 0.97
A U+200B zero-width space appears in a Portuguese markdown paragraph about CORSMiddleware.
Reasoning
Zero-width space inserted around a Portuguese word in documentation prose; a typographic artifact from translation, not a payload. Harmless, though worth cleaning up.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Os parâmetros padrão usados ⟨U+200B⟩⟨U+200B⟩pela implementação `CORSMiddleware` são restritivos por padrão, então você precisará habilitar explicitamente as origens, métodos ou cabeçalhos específicos para que os navegadores tenham permissão para usá-los em um contexto cross domain.
likely benign
LLM, confidence 0.97
Another U+200B zero-width space in the same Portuguese CORS paragraph.
Reasoning
Same as the other finding in this paragraph: a stray zero-width space in translated documentation prose with no code execution or hidden logic.
-
line length 710 characters (raw pass, confidence 0.50)
-
line length 897 characters (raw pass, confidence 0.50)
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
E ambos os modelos serão usados ⟨U+200B⟩⟨U+200B⟩para a documentação interativa da API:
<img src="/img/tutorial/response-model/image02.png">
likely benign
LLM, confidence 0.97
A U+200B zero-width space in Portuguese response-model documentation text.
Reasoning
Zero-width space in Portuguese documentation prose before an image reference; a translation artifact, not an attack.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
E ambos os modelos serão usados ⟨U+200B⟩⟨U+200B⟩para a documentação interativa da API:
<img src="/img/tutorial/response-model/image02.png">
likely benign
LLM, confidence 0.97
A second U+200B zero-width space in the same Portuguese response-model sentence.
Reasoning
Zero-width space in the same documentation sentence; benign formatting noise.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
E as ferramentas também ficarão felizes porque `RedirectResponse` e ⟨U+200B⟩⟨U+200B⟩`JSONResponse` são subclasses de `Response`, então a anotação de tipo está correta.
### Anote uma subclasse de Response { #annotate-a-response-subclass }
likely benign
LLM, confidence 0.96
A U+200B zero-width space near RedirectResponse in Portuguese documentation.
Reasoning
Zero-width space between inline code spans in Portuguese prose; markdown documentation with no executable content.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
E as ferramentas também ficarão felizes porque `RedirectResponse` e ⟨U+200B⟩⟨U+200B⟩`JSONResponse` são subclasses de `Response`, então a anotação de tipo está correta.
### Anote uma subclasse de Response { #annotate-a-response-subclass }
likely benign
LLM, confidence 0.96
Another U+200B zero-width space near JSONResponse in the same Portuguese paragraph.
Reasoning
Same benign zero-width space artifact in translated documentation prose.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
...isso falha porque a anotação de tipo não é um tipo Pydantic e não é apenas uma única classe ou subclasse `Response`, é uma união (qualquer uma das duas) entre um `Response` e ⟨U+200B⟩⟨U+200B⟩um `dict`.
### Desative o modelo de resposta { #disable-response-model }
likely benign
LLM, confidence 0.96
A U+200B zero-width space in Portuguese documentation about response model union types.
Reasoning
Zero-width space in Portuguese documentation text explaining a union type annotation; no hidden code.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
...isso falha porque a anotação de tipo não é um tipo Pydantic e não é apenas uma única classe ou subclasse `Response`, é uma união (qualquer uma das duas) entre um `Response` e ⟨U+200B⟩⟨U+200B⟩um `dict`.
### Desative o modelo de resposta { #disable-response-model }
likely benign
LLM, confidence 0.96
A second U+200B zero-width space in the same Portuguese documentation sentence.
Reasoning
Second zero-width space in the same benign documentation sentence.
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
A base64url-encoded example JWT in the OAuth2 JWT tutorial.
Reasoning
The blob is the standard JWT example token from jwt.io (header with alg HS256, typ JWT; sub 1234567890, name John Doe), used illustratively in docs. Not obfuscated payload.
-
identifier `Pythonу` contains homoglyph candidates: у (0443)→y (raw pass, confidence 0.70)
Pythonу придётся сравнить весь общий префикс `stanleyjobso` в `stanleyjobsox` и `stanleyjobson`, прежде чем понять, что строки отличаются. Поэтому на ответ «Неверное имя пользователя или пароль» уйдё
likely benign
LLM, confidence 0.90
A Russian prose word combining the Latin term Python with a Cyrillic case ending, flagged as a homoglyph.
Reasoning
The Latin 'y' homoglyph flag comes from a Cyrillic у in a Russian word 'Pythonу' (Python with Russian case ending). This is ordinary Russian prose with a Latin technical term plus case suffix; not an identifier in code.
-
identifier `Pythonу` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)
Pythonу придётся сравнить весь общий префикс `stanleyjobso` в `stanleyjobsox` и `stanleyjobson`, прежде чем понять, что строки отличаются. Поэтому на ответ «Неверное имя пользователя или пароль» уйдё
likely benign
LLM, confidence 0.90
The same Russian word 'Pythonу' flagged for mixing Latin and Cyrillic scripts.
Reasoning
Mixed Latin and Cyrillic in 'Pythonу' is a natural result of inflecting a Latin-spelled term in Russian prose. It is not a spoofed identifier in executable code.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.88
A documentation console example setting environment variables via $Env: before running a FastAPI app.
Reasoning
This is a console transcript in documentation showing PowerShell-style environment variable assignment ($Env:...) before running uv. The flagged 'variable command' is just illustrative shell output in a markdown code block, not executed by the scanner's target or by the project.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.92
Documentation example setting environment variables before running a FastAPI app.
Reasoning
The flagged line is a PowerShell environment-variable example in a documentation code block. The variable command name is a documentation artifact of showing Windows syntax, not an executed dropper.
-
line length 666 characters (raw pass, confidence 0.50)
-
line length 890 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
dismissed
LLM, confidence 0.95
Sample JSON Web Token used as an illustrative example in OAuth2 documentation.
Reasoning
The blob is the well-known jwt.io sample JWT (header, payload with sub 1234567890, and signature). It is a standard illustrative token in OAuth2 tutorial docs, not an obfuscated payload.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.92
Documentation example setting environment variables before running a FastAPI app.
Reasoning
Same PowerShell environment-variable documentation example inside a console code block, with no executed payload or dropper behavior.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.92
Documentation example setting environment variables before running a FastAPI app.
Reasoning
Same PowerShell environment-variable documentation example; the variable command name is an artifact of showing shell syntax in docs.
-
line length 654 characters (raw pass, confidence 0.50)
-
line length 899 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
dismissed
LLM, confidence 0.95
Sample JSON Web Token used as an illustrative example in OAuth2 documentation.
Reasoning
This is the standard jwt.io sample JWT used as a teaching example in the translated OAuth2 tutorial. It carries no hidden payload.
-
identifier `необовʼязковою` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Властивість `servers` у специфікації OpenAPI є необовʼязковою.
dismissed
LLM, confidence 0.90
Ukrainian prose word using the modifier apostrophe, flagged as mixed script.
Reasoning
The flagged character is the U+02BC modifier apostrophe, which is the standard way to write the Ukrainian apostrophe in words like необовʼязковою. This is ordinary Ukrainian orthography, not a homoglyph attack in code.
-
identifier `обʼєкті` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Потім ви можете встановлювати заголовки в цьому *тимчасовому* обʼєкті відповіді.
{* ../../docs_src/response_headers/tutorial002_py310.py hl[1, 7:8] *}
dismissed
LLM, confidence 0.90
Ukrainian prose word using the modifier apostrophe, flagged as mixed script.
Reasoning
The mixed-script flag comes from the U+02BC apostrophe in обʼєкті, which is correct Ukrainian spelling. It is a documentation prose word, not an identifier in executable code.
-
identifier `обʼєкт` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Далі ви можете повернути будь-який потрібний обʼєкт, як зазвичай (наприклад, `dict`, модель бази даних тощо).
dismissed
LLM, confidence 0.90
Ukrainian prose word using the modifier apostrophe, flagged as mixed script.
Reasoning
The apostrophe in обʼєкт is standard Ukrainian orthography for this word, so the mixed-script signal is a false positive from legitimate language use.
-
identifier `обʼєкта` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Якщо ви оголосили `response_model`, його все одно буде використано для фільтрації та перетворення поверненого обʼєкта.
dismissed
LLM, confidence 0.90
Ukrainian prose word using the modifier apostrophe, flagged as mixed script.
Reasoning
The flagged обʼєкта uses the same legitimate Ukrainian apostrophe in running prose, not a hidden or deceptive identifier.
-
identifier `обʼєкт` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
�стає цей *тимчасовий* обʼєкт відповіді, щоб витягти заголовки (а також кукі та код статусу) і помістить їх у кінцеву відповідь, яка міститиме повернуте вами значення, відфіль… (340 bytes total)
dismissed
LLM, confidence 0.85
Ukrainian prose word using the modifier apostrophe, flagged as mixed script, with a rendering glitch.
Reasoning
The snippet is truncated and contains a replacement character near the word, but the flagged token obʼєкт is the same legitimate Ukrainian apostrophe usage. Nothing suggests a malicious identifier.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.92
Documentation example setting environment variables before running a FastAPI app.
Reasoning
Same PowerShell environment-variable documentation example in a console block, consistent with translated docs for other languages.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.92
Documentation example setting environment variables before running a FastAPI app.
Reasoning
Same PowerShell environment-variable documentation example; no executed payload or encoded dropper.
-
identifier `необовʼязковий` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* _Шлях_ `/items/{item_id}` містить _параметр шляху_ `item_id`, який має бути типу `int`.
* _Шлях_ `/items/{item_id}` містить необовʼязковий `str` _параметр запиту_ `q`.
dismissed
LLM, confidence 0.90
Ukrainian prose word using the modifier apostrophe, flagged as mixed script.
Reasoning
необовʼязковий uses the modifier apostrophe required by Ukrainian spelling in prose. The mixed-script signal is a false positive.
-
identifier `обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Автоматичні та зрозумілі помилки, коли дані некоректні.
* Валідацію навіть для глибоко вкладених JSON-обʼєктів.
dismissed
LLM, confidence 0.95
Ukrainian prose word 'обʼєктів' containing a modifier-letter apostrophe.
Reasoning
The flagged word uses the Ukrainian apostrophe U+02BC (ʼ) inside a Cyrillic word, which is standard Ukrainian orthography. The raw pass flags it only because the apostrophe is a non-Cyrillic code point. This is a documentation prose line, not an identifier.
-
identifier `Обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Перетворення типів Python (`str`, `int`, `float`, `bool`, `list`, тощо).
* Обʼєктів `datetime`.
* Обʼєктів `UUID`.
* Моделей бази даних.
dismissed
LLM, confidence 0.95
Ukrainian documentation bullet 'Обʼєктів' with a standard apostrophe variant.
Reasoning
Same Ukrainian apostrophe (U+02BC) in a capitalized plural noun in Markdown documentation. Legitimate orthography, and the raw mixed-script rule is a known false positive on natural-language text.
-
identifier `Обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Обʼєктів `datetime`.
* Обʼєктів `UUID`.
* Моделей бази даних.
* ...та багато іншого.
dismissed
LLM, confidence 0.95
Ukrainian documentation bullet 'Обʼєктів' with a standard apostrophe variant.
Reasoning
Same pattern as the other Ukrainian findings: a legitimate apostrophe variant in Markdown prose, not an identifier or obfuscation.
-
identifier `обовʼязковий` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Перевірить, що є обовʼязковий атрибут `name`, який має бути типу `str`.
* Перевірить, що є обовʼязковий атрибут `price`, який має бути типу `float`.
dismissed
LLM, confidence 0.95
Ukrainian documentation word 'обовʼязковий' with a modifier-letter apostrophe.
Reasoning
'обовʼязковий' is the correct Ukrainian spelling, using U+02BC as the apostrophe. The file is documentation prose, so the mixed-script warning is a false positive.
-
identifier `обовʼязковий` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Перевірить, що є обовʼязковий атрибут `price`, який має бути типу `float`.
* Перевірить, що є необовʼязковий атрибут `is_offer`, який має бути типу `bool`, якщо він присутній.
dismissed
LLM, confidence 0.95
Ukrainian documentation word 'обовʼязковий' with a modifier-letter apostrophe.
Reasoning
Same legitimate Ukrainian apostrophe usage in documentation prose. No code execution or hidden identifier is involved.
-
identifier `необовʼязковий` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Перевірить, що є необовʼязковий атрибут `is_offer`, який має бути типу `bool`, якщо він присутній.
* Усе це також працюватиме для глибоко вкладених JSON-обʼєктів.
dismissed
LLM, confidence 0.95
Ukrainian documentation word 'необовʼязковий' with a modifier-letter apostrophe.
Reasoning
'необовʼязковий' is standard Ukrainian with U+02BC. This is Markdown prose and the raw-pass mixed-script check misfires on it.
-
identifier `обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Усе це також працюватиме для глибоко вкладених JSON-обʼєктів.
* Автоматично перетворюватиме з та в JSON.
* Документуватиме все за допомогою OpenAPI, який може бути використано в:
dismissed
LLM, confidence 0.95
Ukrainian documentation word 'обʼєктів' with a modifier-letter apostrophe.
Reasoning
Legitimate Ukrainian spelling 'обʼєктів' in a documentation sentence. The raw-pass rule flags the apostrophe character, not any malicious construct.
-
identifier `необовʼязково` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
### Розгортання застосунку (необовʼязково) { #deploy-your-app-optional }
За бажання ви можете розгорнути ваш застосунок FastAPI у [FastAPI Cloud](https://fastapicloud.com) однією командою. 🚀
dismissed
LLM, confidence 0.95
Ukrainian documentation heading word 'необовʼязково' with a modifier-letter apostrophe.
Reasoning
'необовʼязково' in a Markdown heading is normal Ukrainian orthography, and the file is documentation rather than code.
-
identifier `необовʼязкових` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Коли ви встановлюєте FastAPI за допомогою `uv add "fastapi[standard]"`, ви отримуєте групу необовʼязкових залежностей `standard`:
Використовується Pydantic:
dismissed
LLM, confidence 0.95
Ukrainian documentation word 'необовʼязкових' with a modifier-letter apostrophe.
Reasoning
'необовʼязкових' is correct Ukrainian with U+02BC in documentation prose. The mixed-script flag is a false positive for natural-language text.
-
identifier `необовʼязкові` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Якщо ви не хочете включати необовʼязкові залежності `standard`, ви можете встановити через `uv add fastapi` замість `uv add "fastapi[standard]"`.
### Без `fastapi-cloud-cli` { #without-fastapi-cloud-cli }
dismissed
LLM, confidence 0.95
Ukrainian documentation word 'необовʼязкові' with a modifier-letter apostrophe.
Reasoning
'необовʼязкові' is legitimate Ukrainian in Markdown prose. Nothing in the snippet suggests an identifier or hidden payload.
-
line length 717 characters (raw pass, confidence 0.50)
-
line length 857 characters (raw pass, confidence 0.50)
-
string literal compression ratio 0.993 (153 bytes) (raw pass, confidence 0.70)
你的 API 現在也能掌控自己的 <dfn title="這只是個玩笑，提醒一下。這與 Cookie 同意無關，但有趣的是連 API 現在也能拒絕可憐的 Cookie。請收下這塊餅乾。🍪">Cookie 同意</dfn>。🤪🍪
你可以使用 Pydantic 的模型設定來 `forbid` 任何 `extra` 欄位：
dismissed
LLM, confidence 0.93
A joke tooltip with emoji inside a Chinese Markdown tutorial about Pydantic models and cookie parameters.
Reasoning
This is a raw-pass high-complexity hit on a Traditional Chinese tutorial. The 153-byte string is a dfn title containing a joke about cookie consent and emoji. Long repetitive or emoji-laden prose in documentation produces a high compression ratio without any obfuscation or executable behavior. Markdown is not executed, and raw findings have a high false-positive rate.
-
line length 655 characters (raw pass, confidence 0.50)
-
string literal compression ratio 0.987 (153 bytes) (raw pass, confidence 0.70)
你的 API 现在可以控制自己的 <dfn title="只是个玩笑，别当真。和 cookie 同意无关，不过连 API 现在都能拒绝可怜的 cookie，挺好玩的。来，吃块小饼干吧。🍪">cookie 同意</dfn>。🤪🍪
dismissed
LLM, confidence 0.92
Chinese tutorial prose in an HTML <dfn> title attribute about cookie consent.
Reasoning
The flagged 'string literal' is ordinary Simplified Chinese prose inside an HTML <dfn> title in a tutorial. Natural-language CJK text has high byte-level entropy and a high compression ratio, so the complexity signal is a raw-pass false positive. The text is a harmless joke about cookie consent with no executable content.
-
line length 665 characters (raw pass, confidence 0.50)
-
string literal compression ratio 1.032 (154 bytes) (raw pass, confidence 0.70)
库类库（在某些情况下称为 <abbr title="Object Relational Mapper - 对象关系映射器: 一个花哨的术语，指一种库，其中某些类表示 SQL 表，而实例表示这些表中的行">"ORMs"</abbr>），FastAPI 不会强迫你使用任何东西。😎
dismissed
LLM, confidence 0.92
Chinese documentation prose in an HTML <abbr> title attribute explaining ORMs.
Reasoning
The flagged text is an ordinary Chinese explanation of ORMs inside an HTML <abbr> title attribute in documentation. Its compression ratio is high because CJK prose is dense, not because it is encoded or obfuscated. Nothing executes.
-
`__import__` called on a non-literal expression (ast pass, confidence 0.70)
try:
Color = __import__(module_path, fromlist=["Color"]).Color
except ImportError: pytest.skip(f"{module_path} not available")
likely benign
LLM, confidence 0.88
A pytest helper that dynamically imports a Color class from a parameterized module path and skips the test if that module is unavailable.
Reasoning
The __import__ call uses a variable module_path, which is flagged as a non-literal dynamic import. The surrounding code is a test that tries to import an optional Color class, catches ImportError, and skips the test with pytest.skip. The module path is test-local and not derived from untrusted input. This is a common compatibility pattern for testing against different Pydantic or extra-types versions, so it is most likely benign.
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
disclude.io