Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
identifier `необовʼязкові` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
### Додаткові необовʼязкові залежності { #additional-optional-dependencies }
Є ще деякі додаткові залежності, які ви можете захотіти встановити.
-
identifier `необовʼязкові` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Додаткові необовʼязкові залежності Pydantic:
* [`pydantic-settings`](https://pydantic.dev/docs/validation/latest/concepts/pydantic_settings/) - для керування налаштуваннями.
-
identifier `необовʼязкові` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Додаткові необовʼязкові залежності FastAPI:
* [`orjson`](https://github.com/ijl/orjson) - потрібно, якщо ви хочете використовувати `ORJSONResponse`.
-
identifier `імʼям` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Скажімо, у вас є клас `Person` з імʼям:
{* ../../docs_src/python_types/tutorial010_py310.py hl[1:3] *}
-
identifier `прикладi` contains homoglyph candidates: р (0440)→p, а (0430)→a (raw pass, confidence 0.70)
У попередньому прикладi *операції шляху* очікували б JSON-тіло з атрибутами `Item`, наприклад:
```JSON
-
identifier `прикладi` mixes scripts: Cyrillic + Latin (raw pass, confidence 0.80)
У попередньому прикладi *операції шляху* очікували б JSON-тіло з атрибутами `Item`, наприклад:
```JSON
-
identifier `сирa` contains homoglyph candidates: с (0441)→c, р (0440)→p (raw pass, confidence 0.70)
Якщо вас цікавить, як виглядає «сирa» схема OpenAPI, FastAPI автоматично генерує JSON (схему) з описами всього вашого API.
-
identifier `сирa` mixes scripts: Cyrillic + Latin (raw pass, confidence 0.80)
Якщо вас цікавить, як виглядає «сирa» схема OpenAPI, FastAPI автоматично генерує JSON (схему) з описами всього вашого API.
-
identifier `обʼєкт` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Ви також можете передати шлях до файлу в команду `fastapi dev`, і вона вгадає обʼєкт FastAPI app, який слід використовувати:
```console
-
identifier `памʼятати` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Але вам доведеться щоразу памʼятати передавати правильний шлях\entrypoint під час виклику команди `fastapi`.
-
identifier `необовʼязково` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
### Розгорніть ваш застосунок (необовʼязково) { #deploy-your-app-optional }
За бажанням ви можете розгорнути ваш FastAPI-застосунок у [FastAPI Cloud](https://fastapicloud.com) однією командою. 🚀
-
identifier `Підібʼємо` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
## Підібʼємо підсумки, крок за кроком { #recap-step-by-step }
### Крок 1: імпортуємо `FastAPI` { #step-1-import-fastapi }
-
identifier `навʼязує` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
**FastAPI** не навʼязує жодного конкретного значення.
Наведена тут інформація подана як настанова, а не вимога.
-
identifier `обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Існує багато інших обʼєктів і моделей, які будуть автоматично конвертовані в JSON (зокрема ORM тощо). Спробуйте використати свої улюблені - велика ймовірність, що вони вже підтрим
-
identifier `Підібʼємо` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
## Підібʼємо підсумки { #recap }
* Імпортуйте `FastAPI`.
-
identifier `розвʼязати` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Існувала також специфікація «OpenID». Вона намагалася розвʼязати те саме, що й **OpenID Connect**, але не базувалась на OAuth2.
Тож це була повністю додаткова система.
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
-
string literal compression ratio 0.962 (132 bytes) (raw pass, confidence 0.60)
* <dfn title="被設定為連接並以某種方式一起工作的機器群組。">叢集</dfn>
* <dfn title="一種機器學習方法，使用具備多個隱藏層的人工神經網路，在輸入與輸出層之間建立完整的內部結構">深度學習</dfn>
## 標題 { #headings }
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
-
string literal compression ratio 0.975 (161 bytes) (raw pass, confidence 0.60)
QL 資料庫函式庫（有時稱為 <abbr title="Object Relational Mapper - 物件關聯對應器：一個用來描述某些類別代表 SQL 資料表且其實例代表資料表中資料列的函式庫的術語">"ORMs"</abbr>），FastAPI 不會強迫你使用特定工具。😎
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
-
file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
if "gzip" in self.headers.getlist("Content-Encoding"):
body = gzip.decompress(body)
self._body = body
return self._body
-
file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
if "gzip" in self.headers.getlist("Content-Encoding"):
body = gzip.decompress(body)
self._body = body
return self._body
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Default
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant
likely benign
LLM, confidence 0.93
A soft hyphen inside a German compound word in a markdown test document.
Reasoning
Soft hyphens inside German words in a markdown doc; typical of hyphenation in pasted or edited German text, no executable effect.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Default
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant
likely benign
LLM, confidence 0.93
Another soft hyphen inside a German word in the same markdown file.
Reasoning
Same soft hyphen pattern in a German doc; harmless invisible character with no functional impact.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant
* die Anwendung bereitstellen
likely benign
LLM, confidence 0.93
Soft hyphen within a German word in a markdown documentation line.
Reasoning
Soft hyphen in German prose inside markdown documentation; no code is executed.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant
* die Anwendung bereitstellen
likely benign
LLM, confidence 0.93
Soft hyphen within a German word in a markdown documentation line.
Reasoning
Soft hyphen in German prose; benign typographic character in docs.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
PowerShell-style environment variable assignments in a documentation console example.
Reasoning
PowerShell environment variable syntax ($Env:NAME = value) in a console example in FastAPI docs; the flagged 'variable command' is just illustrative documentation, not a dropper.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Setting ADMIN_EMAIL and APP_NAME env vars then running fastapi in a docs console block.
Reasoning
Same documentation example of setting env vars before running fastapi; no malicious payload or dynamic execution of attacker content.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
Außerdem ist Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung in HTTP-Headern nicht relevant, daher können Sie sie im Standard-Python-Stil (auch bekannt als „snake_case“) deklarieren.
likely benign
LLM, confidence 0.93
Soft hyphen in a German word in a tutorial paragraph.
Reasoning
Soft hyphen in German prose inside markdown; harmless.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
Außerdem ist Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung in HTTP-Headern nicht relevant, daher können Sie sie im Standard-Python-Stil (auch bekannt als „snake_case“) deklarieren.
likely benign
LLM, confidence 0.93
Second soft hyphen in the same German tutorial paragraph.
Reasoning
Soft hyphen in German prose inside markdown; harmless.
-
line length 725 characters (raw pass, confidence 0.50)
-
line length 930 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
A sample JWT token used as an example in an OAuth2 tutorial.
Reasoning
This is the well-known example JWT from jwt.io documentation (header alg HS256, typ JWT, sub 1234567890, John Doe), a standard illustrative token, not a payload or obfuscated code.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Starlette's Y: Starlettes Y
* X is case-sensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant in X
* X is case-insensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant in X
* standard Python: Standard-Python
likely benign
LLM, confidence 0.93
Soft hyphen within a German word in an LLM prompt document.
Reasoning
Soft hyphen in German text within an LLM prompt markdown file; invisible but harmless.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Starlette's Y: Starlettes Y
* X is case-sensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant in X
* X is case-insensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant in X
* standard Python: Standard-Python
likely benign
LLM, confidence 0.93
Second soft hyphen in the same LLM prompt line.
Reasoning
Soft hyphen in German prose; no functional effect.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* X is case-sensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant in X
* X is case-insensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant in X
* standard Python: Standard-Python
* deprecated: deprecatet
likely benign
LLM, confidence 0.93
Soft hyphen in a German word in a bulleted prompt line.
Reasoning
Soft hyphen in German prose inside a markdown prompt file; harmless.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* X is case-sensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant in X
* X is case-insensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant in X
* standard Python: Standard-Python
* deprecated: deprecatet
likely benign
LLM, confidence 0.93
Second soft hyphen in the same bulleted prompt line.
Reasoning
Soft hyphen in German prose; harmless.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
PowerShell-style environment variable assignments in an English docs console example.
Reasoning
PowerShell env var example in English FastAPI docs; illustrative console text with no malicious behavior.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Env var setup and fastapi run command in an English docs console block.
Reasoning
Same benign documentation example of env var setup before running the app.
-
file mixes tab and space indentation (6 tab-indented and 172 space-indented lines) (raw pass, confidence 0.40)
class Termynal {
-
line length 508 characters (raw pass, confidence 0.50)
* ✨ Allow setting the `response_class` to `RedirectResponse` or `FileResponse` and returning the URL from the function. New and updated docs are in the tutorial section **Custom Response - HTML, Stream, File, others**, in [RedirectResponse](https://fastapi.tiangolo.com/advanced/custom-response/#redirectresponse) and
-
identifier `с` contains homoglyph candidates: с (0441)→c (raw pass, confidence 0.70)
* 📝 Add link to article in Russian "FastAPI: знакомимся с фреймворком". PR [#2564](https://github.com/tiangolo/fastapi/pull/2564) by [@trkohler](https://github.com/trkohler).
likely benign
LLM, confidence 0.97
Cyrillic letter in a Russian article title within release notes.
Reasoning
A Cyrillic 'с' inside a Russian article title in a changelog is ordinary Russian text, not an identifier. Markdown prose has no identifier spoofing risk.
-
line length 706 characters (raw pass, confidence 0.50)
-
line length 882 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.97
Sample JWT string used in FastAPI OAuth2 tutorial docs.
Reasoning
This is the canonical JWT example token from jwt.io (header, payload with sub/name/iat, signature). It is documentation, not a payload or dropper.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
Documentation console example setting environment variables for a FastAPI app.
Reasoning
This is a PowerShell-style environment variable example in a console code block in documentation. The '$Env:' form is a PowerShell idiom shown to the reader, not executed by the scanner's target code.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
Documentation console example running fastapi with env vars set.
Reasoning
Same documentation console example repeated; setting env vars and running fastapi run is benign tutorial content.
-
line length 750 characters (raw pass, confidence 0.50)
-
line length 921 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.97
Sample JWT string in Spanish OAuth2 tutorial docs.
Reasoning
Same canonical jwt.io sample token appearing in the Spanish translation of the tutorial; no malicious intent.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
Documentation console example setting environment variables (French translation).
Reasoning
French translation of the same PowerShell-style console example in documentation; benign.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
Documentation console example running fastapi with env vars (French translation).
Reasoning
Repeated documentation console example in French translation; benign.
-
compression ratio 0.850 is >2σ above file mean 0.736 (raw pass, confidence 0.50)
Si vous exécutez votre conteneur derrière un proxy de terminaison TLS (load balancer) comme Nginx ou Traefik, ajoutez l'option `--proxy-headers`, cela indiquera à Uvicorn (via la CLI FastAPI) de faire confiance aux en-têtes envoyés par ce proxy lui indiquant que l'application s'exécute derrière HTTPS, etc.
-
line length 725 characters (raw pass, confidence 0.50)
-
line length 918 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.97
Sample JWT string in French OAuth2 tutorial docs.
Reasoning
Canonical sample JWT from the tutorial, French translation; not a threat.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
Documentation console example setting environment variables (Hindi translation).
Reasoning
Hindi translation of the same documentation console example; benign.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
Documentation console example running fastapi with env vars (Hindi translation).
Reasoning
Repeated documentation console example in Hindi translation; benign.
-
line length 674 characters (raw pass, confidence 0.50)
-
line length 871 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.97
Sample JWT string in Hindi OAuth2 tutorial docs.
Reasoning
Canonical sample JWT from the tutorial, Hindi translation; not a threat.
-
identifier `時々いくつかランダムに見える変更を行うことがあります` mixes scripts: Han + Other + Hiragana + Katakana (raw pass, confidence 0.80)
�良であることを意味します（時々いくつかランダムに見える変更を行うことがあります。理由は [LLM は決定論的アルゴリズムではない](https://doublespeak.chat/#/handbook#deterministic-output) ためです）。
likely benign
LLM, confidence 0.90
Japanese sentence flagged as mixed-script identifier in an LLM test doc.
Reasoning
Japanese prose mixing Han, Hiragana and Katakana is normal for Japanese text; the 'identifier' is a sentence in a markdown doc. No obfuscation.
-
string literal compression ratio 0.962 (130 bytes) (raw pass, confidence 0.60)
* <abbr title="Mozilla Developer Network - Mozilla 開発者ネットワーク: 開発者向けドキュメント、Firefox の開発元が執筆">MDN</abbr>
* <abbr title="Input/Output - 入出力: ディスクの読み書き、ネットワーク通信。">I/O</abbr>.
likely benign
LLM, confidence 0.93
Markdown abbreviation list with Japanese glosses.
Reasoning
A markdown list of abbr elements with Japanese descriptions; high compression ratio on natural-language text is a false positive for a string literal in prose.
-
identifier `リクエストごとやユーザーごとに別々のモデルを使うわけではありません` mixes scripts: Katakana + Hiragana + Han + Other (raw pass, confidence 0.80)
同じモデルをリクエスト間で共有するので、リクエストごとやユーザーごとに別々のモデルを使うわけではありません。
dismissed
LLM, confidence 0.97
Normal Japanese sentence in FastAPI documentation flagged for mixed scripts.
Reasoning
Japanese prose in a markdown doc naturally mixes Katakana, Hiragana, and Han characters. The raw unicode-mixed-script heuristic misfires on normal Japanese text; no obfuscation is present.
-
identifier `共有するロジックや変数のない別々の関数でそれを行うのは難しく` mixes scripts: Han + Hiragana + Katakana + Other (raw pass, confidence 0.80)
共有するロジックや変数のない別々の関数でそれを行うのは難しく、グローバル変数などに値を保存する必要が出てきます。
そのため、現在は上で説明したとおり `lifespan` を使うことが推奨されています。
dismissed
LLM, confidence 0.97
Japanese documentation paragraph flagged for mixed scripts.
Reasoning
Ordinary Japanese prose mixing Han, Hiragana and Katakana; this is standard orthography, not an identifier obfuscation.
-
identifier `個々のリクエストと` mixes scripts: Han + Other + Hiragana + Katakana (raw pass, confidence 0.80)
- **トレース**: 個々のリクエストと、それを処理するために実行された操作の記録です。時間を計測する各操作を**スパン**と呼びます。
- **ログ**: アプリケーションの起動や操作の失敗など、イベントのタイムスタンプ付きの記録です。
dismissed
LLM, confidence 0.97
Japanese OpenTelemetry explanation flagged for mixed scripts.
Reasoning
Standard Japanese documentation text in a markdown list; mixed scripts are expected in Japanese.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Documentation showing PowerShell environment variable assignments before running a FastAPI app.
Reasoning
This is a PowerShell example in a console code block in documentation. The $Env variable is a PowerShell environment-variable assignment shown to users, not executed by the scanner or any dropper. The AST flag is a false positive from documentation examples.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Documentation console block with PowerShell env var assignments and uv run command.
Reasoning
Same PowerShell console example in documentation setting ADMIN_EMAIL and APP_NAME env vars before starting the app; benign tutorial content.
-
identifier `時々カウンターの表示を見て` mixes scripts: Han + Other + Katakana + Hiragana (raw pass, confidence 0.80)
時々カウンターの表示を見て、自分の番号になっているか確認します。
やがてあなたの番になります。カウンターに行き、ハンバーガーを受け取り、テーブルに戻ります。
dismissed
LLM, confidence 0.97
Japanese restaurant analogy text flagged for mixed scripts.
Reasoning
Japanese prose in the async tutorial mixing scripts as normal Japanese; no identifier obfuscation.
-
identifier `家の別々のエリアを掃除できれば` mixes scripts: Han + Hiragana + Other + Katakana (raw pass, confidence 0.80)
しかしこの場合、8 人の元レジ係/料理人/現清掃員を連れてきて、それぞれ (あなたも加えて) 家の別々のエリアを掃除できれば、**並列** に作業でき、より早く終えられます。
dismissed
LLM, confidence 0.97
Japanese async analogy sentence flagged for mixed scripts.
Reasoning
Ordinary Japanese sentence with Kanji, Hiragana and Katakana; expected in Japanese documentation.
-
identifier `我々は間違いを犯す` mixes scripts: Han + Other + Hiragana (raw pass, confidence 0.80)
### 我々は間違いを犯す { #we-make-mistakes }
私たち人間は常に**間違い**を犯します。ソフトウェアには、ほとんど常に**バグ**があらゆる箇所に隠されています。🐛
dismissed
LLM, confidence 0.97
Japanese deployment concepts heading flagged for mixed scripts.
Reasoning
Japanese heading and prose; mixed Han and Hiragana is normal and harmless.
-
identifier `他の人々のこれまでの働きがなければ存在しなかったでしょう` mixes scripts: Han + Hiragana + Other (raw pass, confidence 0.80)
**FastAPI**は、他の人々のこれまでの働きがなければ存在しなかったでしょう。
以前に作られた多くのツールが、作成における刺激として役立ってきました。
dismissed
LLM, confidence 0.97
Japanese history paragraph flagged for mixed scripts.
Reasoning
Standard Japanese prose in documentation; the raw heuristic misreads natural text as obfuscated identifiers.
-
identifier `を別々のモデルとして分けて使うことは可能です` mixes scripts: Hiragana + Han + Other + Katakana (raw pass, confidence 0.80)
...しかし、同じアプリ内で Pydantic v1 と v2 を別々のモデルとして分けて使うことは可能です。
```mermaid
dismissed
LLM, confidence 0.96
Japanese migration guide sentence flagged for mixed scripts.
Reasoning
Japanese prose sentence mixing scripts with Latin text for Pydantic names; normal documentation content.
-
identifier `徐々に` mixes scripts: Han + Other + Hiragana (raw pass, confidence 0.80)
`bump-pydantic` が適用できない場合は、同一アプリで v1 と v2 のモデルを併用できるサポートを利用して、徐々に v2 へ移行できます。
dismissed
LLM, confidence 0.97
Japanese migration guide sentence flagged for mixed scripts.
Reasoning
Japanese prose with the adverb 徐々に; mixed Han and Hiragana is expected and not malicious.
-
string literal compression ratio 1.036 (140 bytes) (raw pass, confidence 0.70)
"_FastAPIライブラリを採用し、クエリで **予測値** を取得できる **REST** サーバを構築しました。 [for Ludwig]_"
dismissed
LLM, confidence 0.85
Japanese marketing sentence in the FastAPI docs flagged for low compression ratio.
Reasoning
A 140-byte string of Japanese text with markdown bold markers and a link-like suffix. Compression ratio near 1.0 is expected because CJK UTF-8 text is already dense and does not compress well; this is a high-entropy artifact of the language, not a payload.
-
identifier `様々な階層` mixes scripts: Han + Other + Hiragana (raw pass, confidence 0.80)
`BackgroundTasks` の使用は依存性注入システムでも機能し、様々な階層 (*path operation function*、依存性 (dependable)、サブ依存性など) で `BackgroundTasks` 型のパラメーターを宣言できます。
likely benign
LLM, confidence 0.95
Japanese tutorial prose containing Han and Hiragana characters, flagged as a mixed-script identifier.
Reasoning
The flagged identifier is ordinary Japanese prose (様々な階層, meaning various levels) inside a markdown tutorial. Mixing Han and Hiragana is normal for Japanese text, and the raw pass has a high false-positive rate on natural-language content.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
**FastAPI** は、それぞれの場合の処理⟨U+200B⟩⟨U+200B⟩方法と同じオブジェクトの再利用方法を知っているため、すべてのバックグラウンドタスクがマージされ、バックグラウンドで後で実行されます:
likely benign
LLM, confidence 0.80
A stray U+200B zero-width space in a Japanese documentation paragraph.
Reasoning
A zero-width space appears in Japanese bold markup text. This is a common artifact of translation or copy-paste editing and carries no executable meaning. It is cosmetic, not an attack vector.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
**FastAPI** は、それぞれの場合の処理⟨U+200B⟩⟨U+200B⟩方法と同じオブジェクトの再利用方法を知っているため、すべてのバックグラウンドタスクがマージされ、バックグラウンドで後で実行されます:
likely benign
LLM, confidence 0.80
A second stray U+200B zero-width space in the same Japanese paragraph.
Reasoning
Same as the other zero-width space on the same line. It is a translation artifact in documentation prose with no code execution or concealment purpose.
-
identifier `個々の` mixes scripts: Han + Other + Hiragana (raw pass, confidence 0.80)
`APIRouter` に `dependencies` を置くことで、*path operations* のグループ全体に認証を要求する、といった用途に使えます。個々の *path operation* に依存関係を追加していなくても構いません。
///
likely benign
LLM, confidence 0.95
Japanese prose in a FastAPI tutorial flagged as a mixed-script identifier.
Reasoning
The identifier 個々の (meaning individual) is ordinary Japanese prose in a documentation file. Mixed Han and Hiragana is expected, and the file is a tutorial, not code.
-
line length 509 characters (raw pass, confidence 0.50)
-
line length 720 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
A sample JWT from the jwt.io example, shown in an OAuth2 tutorial code block.
Reasoning
The blob is the widely published jwt.io sample JSON Web Token, with a header, payload with sub 1234567890 and name John Doe, and a signature. It is a standard illustrative example in auth documentation, not a hidden payload.
-
identifier `同じデータベースを使用してDjangoアプリケーションを徐々に移行することもできます` mixes scripts: Han + Hiragana + Katakana + Latin + Other (raw pass, confidence 0.80)
例えば、Djangoアプリケーションからデータベース内の同じデータをFastAPIアプリケーションと共有できるだけではなく、同じデータベースを使用してDjangoアプリケーションを徐々に移行することもできます。
likely benign
LLM, confidence 0.95
Japanese documentation sentence mentioning Django, flagged for mixed scripts.
Reasoning
The flagged text is a normal Japanese sentence about migrating a Django application, mixing Han, Hiragana, Katakana and Latin for the product name. This is ordinary documentation prose.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.85
A PowerShell environment-variable example in a Korean settings tutorial, flagged as a variable command name.
Reasoning
This is a console example in documentation showing PowerShell syntax for setting environment variables before running a FastAPI app. The variable-named command is an artifact of the Windows example, and nothing is executed from this file.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.85
A second PowerShell environment-variable line in the same documentation example.
Reasoning
Same console example as the preceding finding: documentation showing how to set environment variables and run the app, with no malicious execution in the file.
-
string literal compression ratio 0.992 (128 bytes) (raw pass, confidence 0.70)
* 100% <dfn title="Python 타입 어노테이션으로, 이를 통해 편집기와 외부 도구가 더 나은 지원을 제공할 수 있습니다">타입 어노테이션</dfn> 코드 베이스.
* 프로덕션 애플리케이션에서 사용됩니다.
likely benign
LLM, confidence 0.90
Korean feature-list prose in markdown flagged as a highly compressible string literal.
Reasoning
The high-complexity flag fires on a Korean prose string literal with high compression ratio. This is a text-entropy artifact of markdown prose and says nothing about obfuscation.
-
string literal compression ratio 0.957 (162 bytes) (raw pass, confidence 0.60)
"_**FastAPI** 라이브러리를 채택하여 **예측**을 얻기 위해 쿼리를 실행할 수 있는 **REST** 서버를 생성했습니다. [Ludwig을 위해]_"
likely benign
LLM, confidence 0.90
A Korean testimonial quote in the index page flagged for string compressibility.
Reasoning
This is a quoted Korean testimonial in markdown. The compression-ratio heuristic is firing on natural-language text, a known false-positive pattern for raw-pass complexity checks.
-
string literal compression ratio 0.956 (183 bytes) (raw pass, confidence 0.60)
"_**Netflix**는 우리의 **위기 관리** 오케스트레이션 프레임워크인 **Dispatch**의 오픈 소스 공개를 발표하게 되어 기쁩니다! [**FastAPI**로 빌드]_"
likely benign
LLM, confidence 0.90
A Korean testimonial quote in the index page flagged for string compressibility.
Reasoning
This is a quoted Korean testimonial about the Dispatch project in markdown. The flag comes from the prose's compression ratio, not from any encoded or hidden content.
-
line length 514 characters (raw pass, confidence 0.50)
-
line length 719 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
A sample JWT from the jwt.io example in a Korean OAuth2 tutorial.
Reasoning
This is the same well-known jwt.io sample token as in the Japanese version of this page, used as an illustrative example in an authentication tutorial.
-
identifier `azərbaycan` mixes scripts: Latin + Other (raw pass, confidence 0.80)
ay: aymar aru
az: azərbaycan dili
ba: башҡорт теле
be: беларуская мова
likely benign
LLM, confidence 0.95
The native Azerbaijani language name in a YAML language-name mapping, flagged for a non-ASCII letter.
Reasoning
azərbaycan is the correct native name of the Azerbaijani language, which legitimately uses the Latin-script letter schwa. This is a language-name mapping file with no code or concealment.
-
identifier `Eʋegbe` mixes scripts: Latin + Other (raw pass, confidence 0.80)
dz: རྫོང་ཁ
ee: Eʋegbe
el: Ελληνικά
en: English
dismissed
LLM, confidence 0.95
Ewe language name 'Eʋegbe' in a YAML list of language names.
Reasoning
Ewe language name uses the legitimate IPA letter ʋ, which is a normal part of the Ewe orthography. The mixed-script flag is a false positive on an ordinary multilingual name list.
-
identifier `æвзаг` contains homoglyph candidates: а (0430)→a (raw pass, confidence 0.70)
or: ଓଡ଼ିଆ
os: ирон æвзаг
pa: ਪੰਜਾਬੀ
pi: पाऴि
dismissed
LLM, confidence 0.93
Ossetian language name 'ирон æвзаг' in a documentation YAML file.
Reasoning
Ossetian 'ирон æвзаг' is written with Cyrillic letters plus the legitimate Latin letter æ, which the Ossetian orthography uses. The homoglyph flag fires on a real language name, not a spoofed identifier.
-
identifier `æвзаг` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)
or: ଓଡ଼ିଆ
os: ирон æвзаг
pa: ਪੰਜਾਬੀ
pi: पाऴि
dismissed
LLM, confidence 0.93
Ossetian language name 'ирон æвзаг' mixing Latin æ with Cyrillic.
Reasoning
Same Ossetian name, flagged again for mixing Latin and Cyrillic. The mix is the native orthography of the language, so this is a legitimate pattern.
-
identifier `Saɯ` mixes scripts: Latin + Other (raw pass, confidence 0.80)
yo: Yorùbá
za: Saɯ cueŋƅ
zh: 简体中文
zh-hant: 繁體中文
dismissed
LLM, confidence 0.92
Zhuang language name 'Saɯ cueŋƅ' in a documentation YAML list.
Reasoning
'Saɯ cueŋƅ' is the Zhuang language name in its standard Latin orthography, which uses IPA-style letters ɯ, ŋ and ƅ. This is a legitimate language label in a documentation file.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
dismissed
LLM, confidence 0.90
PowerShell example setting ADMIN_EMAIL and APP_NAME before running fastapi in a Portuguese docs page.
Reasoning
This is a PowerShell environment-variable assignment in a console code block in a FastAPI tutorial. It is documentation showing how to set config, not code that executes or drops anything in the repo. The variable command name is a doc artifact.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
dismissed
LLM, confidence 0.90
Repeated PowerShell environment-variable example in a Portuguese docs page.
Reasoning
Same PowerShell example snippet repeated in another code block. It is an illustrative console session in documentation with no malicious payload.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
o tem suas próprias coisas, variáveis ⟨U+200B⟩⟨U+200B⟩e memória. E se você estiver consumindo uma grande quantidade de memória em seu código, **cada processo** consumirá uma quantidade equivalente de memória.
likely benign
LLM, confidence 0.85
Stray U+200B zero-width space in a Portuguese deployment-concepts paragraph.
Reasoning
A zero-width space sits next to 'variáveis' in Portuguese prose. This looks like a copy-paste or translation-tool artifact. It is invisible hygiene noise and not an obfuscated payload, though it is worth cleaning up.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
em suas próprias coisas, variáveis ⟨U+200B⟩⟨U+200B⟩e memória. E se você estiver consumindo uma grande quantidade de memória em seu código, **cada processo** consumirá uma quantidade equivalente de memória.
likely benign
LLM, confidence 0.85
Second stray U+200B in the same Portuguese deployment-concepts paragraph.
Reasoning
Another zero-width space in the same paragraph, near 'variáveis'. Consistent with a copy artifact from the translation workflow rather than deliberate hiding of code.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Esses processos de trabalho seriam aqueles que executariam sua aplicação, eles executariam os cálculos principais para receber uma **request** e retornar uma **resposta**, e carregariam qualquer coisa que você colocasse em variáveis ⟨U+200B⟩⟨U+200B⟩na RAM.
<img src="/img/deployment/concepts/process-ram.drawio.svg">
likely benign
LLM, confidence 0.85
Stray U+200B in a Portuguese paragraph about worker processes and RAM.
Reasoning
Zero-width space before 'variáveis' in a prose paragraph near an image tag. It is invisible text noise with no executable or hidden-logic effect.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Esses processos de trabalho seriam aqueles que executariam sua aplicação, eles executariam os cálculos principais para receber uma **request** e retornar uma **resposta**, e carregariam qualquer coisa que você colocasse em variáveis ⟨U+200B⟩⟨U+200B⟩na RAM.
<img src="/img/deployment/concepts/process-ram.drawio.svg">
likely benign
LLM, confidence 0.85
Second stray U+200B in the same Portuguese worker-process paragraph.
Reasoning
Another zero-width space in the same paragraph. The pattern matches an editing or translation artifact in documentation prose.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Para alterar as URLs usadas ⟨U+200B⟩⟨U+200B⟩para as interfaces de usuário da documentação gerada automaticamente, leia a documentação de [Tutorial - Metadados e URLs da Documentação](../tutorial/metadata.md#docs-urls).
likely benign
LLM, confidence 0.85
Stray U+200B in a Portuguese sentence about documentation URLs.
Reasoning
Zero-width space before 'usadas' in the Portuguese how-to text. It is invisible prose noise with no code-hiding effect in this context.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Para alterar as URLs usadas ⟨U+200B⟩⟨U+200B⟩para as interfaces de usuário da documentação gerada automaticamente, leia a documentação de [Tutorial - Metadados e URLs da Documentação](../tutorial/metadata.md#docs-urls).
likely benign
LLM, confidence 0.85
Second stray U+200B in the same Portuguese how-to sentence.
Reasoning
Second zero-width space in the same sentence. Consistent with translation or copy-paste residue, not an attack.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Mas isso só permitirá certos tipos de comunicação, excluindo tudo que envolva credenciais: cookies, cabeçalhos de autorização como aqueles usados ⟨U+200B⟩⟨U+200B⟩com Bearer Tokens, etc.
Então, para que tudo funcione corretamente, é melhor especificar explicitamente as origens permitidas.
likely benign
LLM, confidence 0.85
Stray U+200B in a Portuguese CORS tutorial paragraph.
Reasoning
Zero-width space before 'usadas' in a Portuguese CORS tutorial paragraph. Invisible text noise from editing, with no executable effect.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Mas isso só permitirá certos tipos de comunicação, excluindo tudo que envolva credenciais: cookies, cabeçalhos de autorização como aqueles usados ⟨U+200B⟩⟨U+200B⟩com Bearer Tokens, etc.
Então, para que tudo funcione corretamente, é melhor especificar explicitamente as origens permitidas.
likely benign
LLM, confidence 0.85
Second stray U+200B in the same Portuguese CORS tutorial paragraph.
Reasoning
Second zero-width space in the same CORS paragraph. This matches a translation-tool artifact in prose and carries no malicious intent.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Os parâmetros padrão usados ⟨U+200B⟩⟨U+200B⟩pela implementação `CORSMiddleware` são restritivos por padrão, então você precisará habilitar explicitamente as origens, métodos ou cabeçalhos específicos para que os navegadores tenham permissão para usá-los em um contexto cross domain.
likely benign
LLM, confidence 0.93
A zero-width space appears in Portuguese documentation prose.
Reasoning
Zero-width space before 'usados' in Portuguese prose; typographic artifact from translation, not used for code obfuscation.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Os parâmetros padrão usados ⟨U+200B⟩⟨U+200B⟩pela implementação `CORSMiddleware` são restritivos por padrão, então você precisará habilitar explicitamente as origens, métodos ou cabeçalhos específicos para que os navegadores tenham permissão para usá-los em um contexto cross domain.
likely benign
LLM, confidence 0.93
Another zero-width space in the same Portuguese CORS doc sentence.
Reasoning
Same stray zero-width space in translated markdown prose; no executable context.
-
line length 710 characters (raw pass, confidence 0.50)
-
line length 897 characters (raw pass, confidence 0.50)
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
E ambos os modelos serão usados ⟨U+200B⟩⟨U+200B⟩para a documentação interativa da API:
<img src="/img/tutorial/response-model/image02.png">
likely benign
LLM, confidence 0.93
Zero-width space in Portuguese response-model docs prose.
Reasoning
Zero-width space in Portuguese documentation prose between words; copy/translation artifact, no code effect.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
E ambos os modelos serão usados ⟨U+200B⟩⟨U+200B⟩para a documentação interativa da API:
<img src="/img/tutorial/response-model/image02.png">
likely benign
LLM, confidence 0.93
Zero-width space in Portuguese response-model docs prose.
Reasoning
Second stray zero-width space in same prose line; benign translation artifact.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
E as ferramentas também ficarão felizes porque `RedirectResponse` e ⟨U+200B⟩⟨U+200B⟩`JSONResponse` são subclasses de `Response`, então a anotação de tipo está correta.
### Anote uma subclasse de Response { #annotate-a-response-subclass }
likely benign
LLM, confidence 0.93
Zero-width space near RedirectResponse mention in Portuguese docs.
Reasoning
Zero-width space before a backticked identifier in markdown prose; benign.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
E as ferramentas também ficarão felizes porque `RedirectResponse` e ⟨U+200B⟩⟨U+200B⟩`JSONResponse` são subclasses de `Response`, então a anotação de tipo está correta.
### Anote uma subclasse de Response { #annotate-a-response-subclass }
likely benign
LLM, confidence 0.93
Second zero-width space near JSONResponse mention in Portuguese docs.
Reasoning
Repeat zero-width space in same docs sentence; benign typographic artifact.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
...isso falha porque a anotação de tipo não é um tipo Pydantic e não é apenas uma única classe ou subclasse `Response`, é uma união (qualquer uma das duas) entre um `Response` e ⟨U+200B⟩⟨U+200B⟩um `dict`.
### Desative o modelo de resposta { #disable-response-model }
likely benign
LLM, confidence 0.93
Zero-width space in Portuguese response-model explanation.
Reasoning
Zero-width space in Portuguese prose before a backticked word; no code impact.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
...isso falha porque a anotação de tipo não é um tipo Pydantic e não é apenas uma única classe ou subclasse `Response`, é uma união (qualquer uma das duas) entre um `Response` e ⟨U+200B⟩⟨U+200B⟩um `dict`.
### Desative o modelo de resposta { #disable-response-model }
likely benign
LLM, confidence 0.93
Second zero-width space in Portuguese response-model explanation.
Reasoning
Repeated zero-width space in same prose; benign.
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
Documentation example JSON Web Token string in a code fence.
Reasoning
This is the widely published example JWT from jwt.io documentation, shown as a sample token in a markdown code block; not a payload or dropper.
-
identifier `Pythonу` contains homoglyph candidates: у (0443)→y (raw pass, confidence 0.70)
Pythonу придётся сравнить весь общий префикс `stanleyjobso` в `stanleyjobsox` и `stanleyjobson`, прежде чем понять, что строки отличаются. Поэтому на ответ «Неверное имя пользователя или пароль» уйдё
likely benign
LLM, confidence 0.85
Russian prose word containing a Cyrillic letter that looks like Latin y.
Reasoning
Token 'Pythonу' has a Cyrillic у inside a Russian prose word where the text is mixed-language; this is a typo-level homoglyph in documentation, not an identifier in code, so it has no execution effect.
-
identifier `Pythonу` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)
Pythonу придётся сравнить весь общий префикс `stanleyjobso` в `stanleyjobsox` и `stanleyjobson`, прежде чем понять, что строки отличаются. Поэтому на ответ «Неверное имя пользователя или пароль» уйдё
likely benign
LLM, confidence 0.85
Mixed Latin and Cyrillic script in the word Pythonу in Russian docs.
Reasoning
Same Latin+Cyrillic word in Russian prose; mixed-script in markdown text is a typing artifact, not code obfuscation.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
PowerShell environment variable assignment shown in a console doc example for FastAPI settings.
Reasoning
Embedded console example in markdown sets environment variables and runs uv; the command name $Env is a PowerShell-style variable in a documentation illustration, not an attack. Flagged only because the shell is documented as a variable.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
dismissed
LLM, confidence 0.90
Documentation example showing PowerShell environment variable assignments before starting an app.
Reasoning
This is a PowerShell example in a documentation code block that sets environment variables before running a FastAPI app. The flagged '$Env' is PowerShell's environment variable syntax, not a dynamic command, so the bash-oriented analyzer misread it.
-
line length 666 characters (raw pass, confidence 0.50)
-
line length 890 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
dismissed
LLM, confidence 0.95
Sample JSON Web Token in a tutorial about OAuth2 and JWT.
Reasoning
The blob is the standard three-part JWT example (header, payload with sub/name/iat, signature) from jwt.io-style documentation. It is a sample token in a tutorial, not a payload or hidden data.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
dismissed
LLM, confidence 0.90
Documentation console example setting PowerShell environment variables.
Reasoning
This is a console block in Turkish documentation showing PowerShell environment variable setup for a FastAPI app. The '$Env' variable is normal PowerShell syntax in a doc example.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
dismissed
LLM, confidence 0.90
Documentation example setting PowerShell environment variables before running an app.
Reasoning
Same PowerShell environment variable example in the Turkish settings docs. It is illustrative documentation with no executed or obfuscated payload.
-
line length 654 characters (raw pass, confidence 0.50)
-
line length 899 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
dismissed
LLM, confidence 0.95
Sample JWT string in the Turkish OAuth2/JWT tutorial.
Reasoning
This is the well-known sample JWT used in the FastAPI tutorial. The base64url segments decode to a standard header and payload, so it is a documentation example.
-
identifier `необовʼязковою` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Властивість `servers` у специфікації OpenAPI є необовʼязковою.
dismissed
LLM, confidence 0.90
Ukrainian prose word using the standard modifier apostrophe character.
Reasoning
The word contains U+02BC (modifier letter apostrophe), which is the standard Ukrainian apostrophe. Mixing it with Cyrillic letters is normal Ukrainian orthography, not an obfuscated identifier.
-
identifier `обʼєкті` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Потім ви можете встановлювати заголовки в цьому *тимчасовому* обʼєкті відповіді.
{* ../../docs_src/response_headers/tutorial002_py310.py hl[1, 7:8] *}
dismissed
LLM, confidence 0.90
Ukrainian prose containing the word 'обʼєкті' with the standard apostrophe.
Reasoning
The flagged word uses the modifier-letter apostrophe, correct Ukrainian spelling for 'обʼєкті'. The mixed-script warning is a false positive from ordinary documentation text.
-
identifier `обʼєкт` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Далі ви можете повернути будь-який потрібний обʼєкт, як зазвичай (наприклад, `dict`, модель бази даних тощо).
dismissed
LLM, confidence 0.90
Ukrainian prose word 'обʼєкт' with the standard apostrophe.
Reasoning
'обʼєкт' is standard Ukrainian written with U+02BC. The flag reflects the apostrophe character, not malicious or deceptive identifier content.
-
identifier `обʼєкта` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Якщо ви оголосили `response_model`, його все одно буде використано для фільтрації та перетворення поверненого обʼєкта.
dismissed
LLM, confidence 0.90
Ukrainian prose word 'обʼєкта' with the standard apostrophe.
Reasoning
'обʼєкта' is correct Ukrainian with the modifier apostrophe. The finding is a false positive from ordinary translated documentation.
-
identifier `обʼєкт` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
�стає цей *тимчасовий* обʼєкт відповіді, щоб витягти заголовки (а також кукі та код статусу) і помістить їх у кінцеву відповідь, яка міститиме повернуте вами значення, відфіль… (340 bytes total)
dismissed
LLM, confidence 0.85
Ukrainian documentation prose with the word 'обʼєкт' and a modifier apostrophe.
Reasoning
The snippet is truncated and the flagged token is 'обʼєкт' in Ukrainian prose. The apostrophe is standard orthography, so this is benign text.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
dismissed
LLM, confidence 0.90
Ukrainian documentation console example setting PowerShell environment variables.
Reasoning
This Ukrainian docs console block shows PowerShell environment variable setup for a FastAPI app. The '$Env' syntax is ordinary PowerShell in a documentation example.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
dismissed
LLM, confidence 0.90
Documentation example setting PowerShell environment variables before running an app.
Reasoning
Same PowerShell environment variable example as the other localized settings pages. It is documentation with no executed payload.
-
identifier `необовʼязковий` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* _Шлях_ `/items/{item_id}` містить _параметр шляху_ `item_id`, який має бути типу `int`.
* _Шлях_ `/items/{item_id}` містить необовʼязковий `str` _параметр запиту_ `q`.
dismissed
LLM, confidence 0.90
Ukrainian index page bullet containing the word 'необовʼязковий' with the standard apostrophe.
Reasoning
'необовʼязковий' is correct Ukrainian with the modifier apostrophe in an API description list. The mixed-script flag is a false positive from natural-language text.
-
identifier `обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Автоматичні та зрозумілі помилки, коли дані некоректні.
* Валідацію навіть для глибоко вкладених JSON-обʼєктів.
dismissed
LLM, confidence 0.95
Ukrainian prose word using the modifier letter apostrophe in a FastAPI docs page.
Reasoning
The flagged word uses U+02BC (modifier letter apostrophe), which Ukrainian orthography uses in words like "обʼєктів". The file is Markdown documentation, and the script mix is a normal typographic choice, not an identifier being spoofed.
-
identifier `Обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Перетворення типів Python (`str`, `int`, `float`, `bool`, `list`, тощо).
* Обʼєктів `datetime`.
* Обʼєктів `UUID`.
* Моделей бази даних.
dismissed
LLM, confidence 0.95
Ukrainian bullet text with the modifier apostrophe in a documentation page.
Reasoning
Same Ukrainian apostrophe usage ("Обʼєктів") in a bullet list of documentation text. Not code, not an identifier, and no malicious signal.
-
identifier `Обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Обʼєктів `datetime`.
* Обʼєктів `UUID`.
* Моделей бази даних.
* ...та багато іншого.
dismissed
LLM, confidence 0.95
Ukrainian documentation bullet with the modifier apostrophe.
Reasoning
Same Ukrainian apostrophe usage ("Обʼєктів") in documentation prose. The mixed-script flag is a false positive from the language's orthography.
-
identifier `обовʼязковий` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Перевірить, що є обовʼязковий атрибут `name`, який має бути типу `str`.
* Перевірить, що є обовʼязковий атрибут `price`, який має бути типу `float`.
dismissed
LLM, confidence 0.95
Ukrainian word "обовʼязковий" (required) in documentation prose.
Reasoning
"обовʼязковий" is the standard Ukrainian spelling with U+02BC. It appears in Markdown prose, so this is legitimate language text.
-
identifier `обовʼязковий` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Перевірить, що є обовʼязковий атрибут `price`, який має бути типу `float`.
* Перевірить, що є необовʼязковий атрибут `is_offer`, який має бути типу `bool`, якщо він присутній.
dismissed
LLM, confidence 0.95
Ukrainian documentation text with the modifier apostrophe in "обовʼязковий".
Reasoning
Same Ukrainian orthographic apostrophe in a documentation list item. No code execution or hidden content.
-
identifier `необовʼязковий` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Перевірить, що є необовʼязковий атрибут `is_offer`, який має бути типу `bool`, якщо він присутній.
* Усе це також працюватиме для глибоко вкладених JSON-обʼєктів.
dismissed
LLM, confidence 0.95
Ukrainian word "необовʼязковий" (optional) in documentation prose.
Reasoning
"необовʼязковий" is the normal Ukrainian spelling (optional). The raw pass flags a natural-language apostrophe in Markdown.
-
identifier `обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Усе це також працюватиме для глибоко вкладених JSON-обʼєктів.
* Автоматично перетворюватиме з та в JSON.
* Документуватиме все за допомогою OpenAPI, який може бути використано в:
dismissed
LLM, confidence 0.95
Ukrainian documentation bullet using the modifier apostrophe in "обʼєктів".
Reasoning
Ukrainian prose with the standard modifier apostrophe in "JSON-обʼєктів". Benign documentation text.
-
identifier `необовʼязково` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
### Розгортання застосунку (необовʼязково) { #deploy-your-app-optional }
За бажання ви можете розгорнути ваш застосунок FastAPI у [FastAPI Cloud](https://fastapicloud.com) однією командою. 🚀
dismissed
LLM, confidence 0.95
Ukrainian section heading containing "необовʼязково" (optional).
Reasoning
The heading "Розгортання застосунку (необовʼязково)" is ordinary Ukrainian with the orthographic apostrophe. It has no code or identifier context.
-
identifier `необовʼязкових` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Коли ви встановлюєте FastAPI за допомогою `uv add "fastapi[standard]"`, ви отримуєте групу необовʼязкових залежностей `standard`:
Використовується Pydantic:
dismissed
LLM, confidence 0.95
Ukrainian sentence mentioning optional dependencies with the modifier apostrophe.
Reasoning
"необовʼязкових" is correct Ukrainian spelling in a sentence about optional dependencies. Markdown prose, no obfuscation.
-
identifier `необовʼязкові` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Якщо ви не хочете включати необовʼязкові залежності `standard`, ви можете встановити через `uv add fastapi` замість `uv add "fastapi[standard]"`.
### Без `fastapi-cloud-cli` { #without-fastapi-cloud-cli }
dismissed
LLM, confidence 0.95
Ukrainian documentation sentence with "необовʼязкові" (optional).
Reasoning
Ukrainian prose about optional dependencies using standard orthography. The mixed-script flag is a false positive.
-
line length 717 characters (raw pass, confidence 0.50)
-
line length 857 characters (raw pass, confidence 0.50)
-
string literal compression ratio 0.993 (153 bytes) (raw pass, confidence 0.70)
你的 API 現在也能掌控自己的 <dfn title="這只是個玩笑，提醒一下。這與 Cookie 同意無關，但有趣的是連 API 現在也能拒絕可憐的 Cookie。請收下這塊餅乾。🍪">Cookie 同意</dfn>。🤪🍪
你可以使用 Pydantic 的模型設定來 `forbid` 任何 `extra` 欄位：
dismissed
LLM, confidence 0.95
Markdown documentation text with a humorous HTML title attribute containing emoji, flagged by a raw-pass compression heuristic.
Reasoning
This is a raw-pass high-complexity flag on a Traditional Chinese markdown documentation string containing a joke tooltip with emoji. The compression ratio reflects ordinary prose with emoji and CJK characters, not obfuscated code. It is a documentation file with no executable behavior.
-
line length 655 characters (raw pass, confidence 0.50)
-
string literal compression ratio 0.987 (153 bytes) (raw pass, confidence 0.70)
你的 API 现在可以控制自己的 <dfn title="只是个玩笑，别当真。和 cookie 同意无关，不过连 API 现在都能拒绝可怜的 cookie，挺好玩的。来，吃块小饼干吧。🍪">cookie 同意</dfn>。🤪🍪
likely benign
LLM, confidence 0.93
Chinese tutorial prose with a <dfn> tooltip containing a joke and emoji, flagged for compression ratio.
Reasoning
The high compression ratio comes from a short Chinese HTML title attribute containing jokey prose and an emoji in a Markdown docs file. The text is natural-language content, not encoded or obfuscated payload, and the file is documentation.
-
line length 665 characters (raw pass, confidence 0.50)
-
string literal compression ratio 1.032 (154 bytes) (raw pass, confidence 0.70)
库类库（在某些情况下称为 <abbr title="Object Relational Mapper - 对象关系映射器: 一个花哨的术语，指一种库，其中某些类表示 SQL 表，而实例表示这些表中的行">"ORMs"</abbr>），FastAPI 不会强迫你使用任何东西。😎
likely benign
LLM, confidence 0.93
Chinese documentation sentence with an abbr tooltip explaining ORMs, flagged for compression ratio.
Reasoning
The flagged span is a Chinese explanation of ORMs inside an HTML abbr title in Markdown. The compression ratio reflects ordinary CJK prose plus emoji, not a hidden payload.
-
`__import__` called on a non-literal expression (ast pass, confidence 0.70)
try:
Color = __import__(module_path, fromlist=["Color"]).Color
except ImportError: pytest.skip(f"{module_path} not available")
likely benign
LLM, confidence 0.85
A pytest test that uses __import__ with a variable module path to optionally load a Color class and skips if the import fails.
Reasoning
This is a test in FastAPI's test suite that dynamically imports an optional module (Color from pydantic or a similar library) by a module path, catching ImportError and skipping when unavailable. The module_path is parameterized by the test rather than attacker-controlled input, and the pattern is a common idiom for optional-dependency tests. Dynamic import on a non-literal is a valid signal in general, but here the context is benign and the severity is overstated.
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
disclude.io