Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
identifier `необовʼязкові` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
### Додаткові необовʼязкові залежності { #additional-optional-dependencies }
Є ще деякі додаткові залежності, які ви можете захотіти встановити.
-
identifier `необовʼязкові` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Додаткові необовʼязкові залежності Pydantic:
* [`pydantic-settings`](https://pydantic.dev/docs/validation/latest/concepts/pydantic_settings/) - для керування налаштуваннями.
-
identifier `необовʼязкові` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Додаткові необовʼязкові залежності FastAPI:
* [`orjson`](https://github.com/ijl/orjson) - потрібно, якщо ви хочете використовувати `ORJSONResponse`.
-
identifier `імʼям` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Скажімо, у вас є клас `Person` з імʼям:
{* ../../docs_src/python_types/tutorial010_py310.py hl[1:3] *}
-
identifier `прикладi` contains homoglyph candidates: р (0440)→p, а (0430)→a (raw pass, confidence 0.70)
У попередньому прикладi *операції шляху* очікували б JSON-тіло з атрибутами `Item`, наприклад:
```JSON
-
identifier `прикладi` mixes scripts: Cyrillic + Latin (raw pass, confidence 0.80)
У попередньому прикладi *операції шляху* очікували б JSON-тіло з атрибутами `Item`, наприклад:
```JSON
-
identifier `сирa` contains homoglyph candidates: с (0441)→c, р (0440)→p (raw pass, confidence 0.70)
Якщо вас цікавить, як виглядає «сирa» схема OpenAPI, FastAPI автоматично генерує JSON (схему) з описами всього вашого API.
-
identifier `сирa` mixes scripts: Cyrillic + Latin (raw pass, confidence 0.80)
Якщо вас цікавить, як виглядає «сирa» схема OpenAPI, FastAPI автоматично генерує JSON (схему) з описами всього вашого API.
-
identifier `обʼєкт` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Ви також можете передати шлях до файлу в команду `fastapi dev`, і вона вгадає обʼєкт FastAPI app, який слід використовувати:
```console
-
identifier `памʼятати` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Але вам доведеться щоразу памʼятати передавати правильний шлях\entrypoint під час виклику команди `fastapi`.
-
identifier `необовʼязково` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
### Розгорніть ваш застосунок (необовʼязково) { #deploy-your-app-optional }
За бажанням ви можете розгорнути ваш FastAPI-застосунок у [FastAPI Cloud](https://fastapicloud.com) однією командою. 🚀
-
identifier `Підібʼємо` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
## Підібʼємо підсумки, крок за кроком { #recap-step-by-step }
### Крок 1: імпортуємо `FastAPI` { #step-1-import-fastapi }
-
identifier `навʼязує` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
**FastAPI** не навʼязує жодного конкретного значення.
Наведена тут інформація подана як настанова, а не вимога.
-
identifier `обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Існує багато інших обʼєктів і моделей, які будуть автоматично конвертовані в JSON (зокрема ORM тощо). Спробуйте використати свої улюблені - велика ймовірність, що вони вже підтрим
-
identifier `Підібʼємо` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
## Підібʼємо підсумки { #recap }
* Імпортуйте `FastAPI`.
-
identifier `розвʼязати` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Існувала також специфікація «OpenID». Вона намагалася розвʼязати те саме, що й **OpenID Connect**, але не базувалась на OAuth2.
Тож це була повністю додаткова система.
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
-
string literal compression ratio 0.962 (132 bytes) (raw pass, confidence 0.60)
* <dfn title="被設定為連接並以某種方式一起工作的機器群組。">叢集</dfn>
* <dfn title="一種機器學習方法，使用具備多個隱藏層的人工神經網路，在輸入與輸出層之間建立完整的內部結構">深度學習</dfn>
## 標題 { #headings }
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
-
string literal compression ratio 0.975 (161 bytes) (raw pass, confidence 0.60)
QL 資料庫函式庫（有時稱為 <abbr title="Object Relational Mapper - 物件關聯對應器：一個用來描述某些類別代表 SQL 資料表且其實例代表資料表中資料列的函式庫的術語">"ORMs"</abbr>），FastAPI 不會強迫你使用特定工具。😎
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
-
file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
if "gzip" in self.headers.getlist("Content-Encoding"):
body = gzip.decompress(body)
self._body = body
return self._body
-
file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
if "gzip" in self.headers.getlist("Content-Encoding"):
body = gzip.decompress(body)
self._body = body
return self._body
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Default
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant
likely benign
LLM, confidence 0.90
A soft hyphen inside the German word Groß-/Kleinschreibung in a markdown doc.
Reasoning
Soft hyphens inside German words in a documentation markdown file; typical of text copied from editors or word processors. Not an attack vector in this context.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Default
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant
likely benign
LLM, confidence 0.90
A second soft hyphen in a German word in the same markdown line.
Reasoning
Same as the other soft hyphen in the same line; hyphenation hint in prose, no code execution or hidden instructions.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant
* die Anwendung bereitstellen
likely benign
LLM, confidence 0.90
Soft hyphen in German prose in a markdown doc.
Reasoning
Soft hyphen in German prose inside a markdown documentation list; benign text artifact.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant
* die Anwendung bereitstellen
likely benign
LLM, confidence 0.90
Second soft hyphen in German prose in a markdown doc.
Reasoning
Soft hyphen in German prose; benign text artifact with no functional effect on code.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
A PowerShell $Env assignment in a console code block of FastAPI settings docs.
Reasoning
PowerShell-style environment variable syntax shown in a console example in FastAPI docs. The variable is documentation illustration, not a malicious dropper; the flag is a generic embedded-shell heuristic.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Second PowerShell $Env assignment in the settings docs console example.
Reasoning
Same documentation example setting environment variables before running a FastAPI app; benign tutorial content.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
Außerdem ist Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung in HTTP-Headern nicht relevant, daher können Sie sie im Standard-Python-Stil (auch bekannt als „snake_case“) deklarieren.
likely benign
LLM, confidence 0.90
Soft hyphen in German prose in header parameters tutorial.
Reasoning
Soft hyphen inside German prose in a tutorial markdown file; benign.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
Außerdem ist Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung in HTTP-Headern nicht relevant, daher können Sie sie im Standard-Python-Stil (auch bekannt als „snake_case“) deklarieren.
likely benign
LLM, confidence 0.90
Second soft hyphen in German prose in header parameters tutorial.
Reasoning
Second soft hyphen in same German prose line; benign.
-
line length 725 characters (raw pass, confidence 0.50)
-
line length 930 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
The standard example JWT string in the OAuth2 JWT tutorial.
Reasoning
This is the widely used jwt.io example JWT token in documentation; base64url-encoded header and payload, not a payload hiding malicious code.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Starlette's Y: Starlettes Y
* X is case-sensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant in X
* X is case-insensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant in X
* standard Python: Standard-Python
likely benign
LLM, confidence 0.90
Soft hyphen in German glossary text in an LLM prompt doc.
Reasoning
Soft hyphen within German prose in a prompt/documentation file. Benign text artifact, though the file is an LLM prompt, the soft hyphen itself carries no instruction.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Starlette's Y: Starlettes Y
* X is case-sensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant in X
* X is case-insensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant in X
* standard Python: Standard-Python
likely benign
LLM, confidence 0.90
Second soft hyphen in German glossary text in an LLM prompt doc.
Reasoning
Second soft hyphen in the same glossary line; benign text artifact.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* X is case-sensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant in X
* X is case-insensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant in X
* standard Python: Standard-Python
* deprecated: deprecatet
likely benign
LLM, confidence 0.90
Soft hyphen in German glossary text in an LLM prompt doc.
Reasoning
Soft hyphen in German prose; benign text artifact with no hidden instructions.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* X is case-sensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant in X
* X is case-insensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant in X
* standard Python: Standard-Python
* deprecated: deprecatet
likely benign
LLM, confidence 0.90
Second soft hyphen in German glossary text in an LLM prompt doc.
Reasoning
Second soft hyphen in same line; benign.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
PowerShell $Env assignment in the English settings docs console example.
Reasoning
Same PowerShell $Env documentation example as the German copy; benign console illustration.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Second PowerShell $Env assignment in the English settings docs console example.
Reasoning
Same benign environment variable documentation example in the English settings page.
-
file mixes tab and space indentation (6 tab-indented and 172 space-indented lines) (raw pass, confidence 0.40)
class Termynal {
-
line length 508 characters (raw pass, confidence 0.50)
* ✨ Allow setting the `response_class` to `RedirectResponse` or `FileResponse` and returning the URL from the function. New and updated docs are in the tutorial section **Custom Response - HTML, Stream, File, others**, in [RedirectResponse](https://fastapi.tiangolo.com/advanced/custom-response/#redirectresponse) and
-
identifier `с` contains homoglyph candidates: с (0441)→c (raw pass, confidence 0.70)
* 📝 Add link to article in Russian "FastAPI: знакомимся с фреймворком". PR [#2564](https://github.com/tiangolo/fastapi/pull/2564) by [@trkohler](https://github.com/trkohler).
likely benign
LLM, confidence 0.97
Russian word 'с' (meaning 'with') in a release-notes link title.
Reasoning
Cyrillic с in a Russian article title is legitimate natural-language text in a changelog, not an identifier being used to disguise code.
-
line length 706 characters (raw pass, confidence 0.50)
-
line length 882 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.97
Well-known sample JWT in FastAPI OAuth2 tutorial.
Reasoning
This is the standard public JWT example token from jwt.io (header alg HS256, sub 1234567890, name John Doe), used as documentation sample data.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.97
Documentation example setting env vars in PowerShell before running fastapi.
Reasoning
PowerShell-style environment variable syntax in a documentation console example setting sample config values; the 'variable command' is just PowerShell notation in docs.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.97
Documentation example setting APP_NAME env var in PowerShell.
Reasoning
Same benign PowerShell env-var documentation example, duplicated context line.
-
line length 750 characters (raw pass, confidence 0.50)
-
line length 921 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.97
Well-known sample JWT in Spanish OAuth2 tutorial.
Reasoning
Same public jwt.io sample token used in the Spanish translation of the tutorial.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.97
Documentation example setting env vars in PowerShell.
Reasoning
Benign PowerShell env-var documentation example in the French translation.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.97
Documentation example setting APP_NAME env var in PowerShell.
Reasoning
Benign PowerShell env-var documentation example in the French translation.
-
compression ratio 0.850 is >2σ above file mean 0.736 (raw pass, confidence 0.50)
Si vous exécutez votre conteneur derrière un proxy de terminaison TLS (load balancer) comme Nginx ou Traefik, ajoutez l'option `--proxy-headers`, cela indiquera à Uvicorn (via la CLI FastAPI) de faire confiance aux en-têtes envoyés par ce proxy lui indiquant que l'application s'exécute derrière HTTPS, etc.
-
line length 725 characters (raw pass, confidence 0.50)
-
line length 918 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.97
Well-known sample JWT in French OAuth2 tutorial.
Reasoning
Same public sample JWT from jwt.io in the French tutorial.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.97
Documentation example setting env vars in PowerShell.
Reasoning
Benign PowerShell env-var documentation example in the Hindi translation.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.97
Documentation example setting APP_NAME env var in PowerShell.
Reasoning
Benign PowerShell env-var documentation example in the Hindi translation.
-
line length 674 characters (raw pass, confidence 0.50)
-
line length 871 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.97
Well-known sample JWT in Hindi OAuth2 tutorial.
Reasoning
Same public sample JWT from jwt.io in the Hindi tutorial.
-
identifier `時々いくつかランダムに見える変更を行うことがあります` mixes scripts: Han + Other + Hiragana + Katakana (raw pass, confidence 0.80)
�良であることを意味します（時々いくつかランダムに見える変更を行うことがあります。理由は [LLM は決定論的アルゴリズムではない](https://doublespeak.chat/#/handbook#deterministic-output) ためです）。
likely benign
LLM, confidence 0.95
Japanese prose sentence flagged for mixed scripts.
Reasoning
Mixed Japanese scripts are normal in Japanese prose; the flagged 'identifier' is just a sentence of natural text. The file name suggests an LLM test artifact but the snippet contains no hidden instructions.
-
string literal compression ratio 0.962 (130 bytes) (raw pass, confidence 0.60)
* <abbr title="Mozilla Developer Network - Mozilla 開発者ネットワーク: 開発者向けドキュメント、Firefox の開発元が執筆">MDN</abbr>
* <abbr title="Input/Output - 入出力: ディスクの読み書き、ネットワーク通信。">I/O</abbr>.
likely benign
LLM, confidence 0.95
Japanese HTML abbr glossary entries for MDN and I/O.
Reasoning
Short Japanese glossary abbreviations with title attributes; high compression ratio on natural text is a false positive for a 130-byte literal in markdown.
-
identifier `リクエストごとやユーザーごとに別々のモデルを使うわけではありません` mixes scripts: Katakana + Hiragana + Han + Other (raw pass, confidence 0.80)
同じモデルをリクエスト間で共有するので、リクエストごとやユーザーごとに別々のモデルを使うわけではありません。
likely benign
LLM, confidence 0.97
Japanese documentation sentence flagged for mixed scripts.
Reasoning
Japanese prose in a markdown doc mixes Katakana, Hiragana and Han characters naturally; this is normal Japanese text, not identifier obfuscation.
-
identifier `共有するロジックや変数のない別々の関数でそれを行うのは難しく` mixes scripts: Han + Hiragana + Katakana + Other (raw pass, confidence 0.80)
共有するロジックや変数のない別々の関数でそれを行うのは難しく、グローバル変数などに値を保存する必要が出てきます。
そのため、現在は上で説明したとおり `lifespan` を使うことが推奨されています。
likely benign
LLM, confidence 0.97
Japanese prose sentence about shared variables and lifespan.
Reasoning
Ordinary Japanese sentence in documentation; mixed scripts are inherent to the language.
-
identifier `個々のリクエストと` mixes scripts: Han + Other + Hiragana + Katakana (raw pass, confidence 0.80)
- **トレース**: 個々のリクエストと、それを処理するために実行された操作の記録です。時間を計測する各操作を**スパン**と呼びます。
- **ログ**: アプリケーションの起動や操作の失敗など、イベントのタイムスタンプ付きの記録です。
likely benign
LLM, confidence 0.97
Japanese bullet describing traces in OpenTelemetry docs.
Reasoning
Normal Japanese bullet text describing traces and logs; the flag is a false positive from natural script mixing.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Documentation console example setting env vars in PowerShell syntax.
Reasoning
This is a PowerShell-style example in a console code block showing setting environment variables before running fastapi. The '$Env:' prefix is a PowerShell variable assignment in documentation, not executed code; the flagged dynamic command is a doc-rendering artifact.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Documentation console example setting env vars before running fastapi.
Reasoning
Same documentation example repeated: PowerShell environment variable setup shown in a console block before running fastapi; no malicious payload.
-
identifier `時々カウンターの表示を見て` mixes scripts: Han + Other + Katakana + Hiragana (raw pass, confidence 0.80)
時々カウンターの表示を見て、自分の番号になっているか確認します。
やがてあなたの番になります。カウンターに行き、ハンバーガーを受け取り、テーブルに戻ります。
likely benign
LLM, confidence 0.97
Japanese restaurant analogy text in async docs.
Reasoning
Japanese narrative prose from an async analogy in documentation; mixed scripts are normal.
-
identifier `家の別々のエリアを掃除できれば` mixes scripts: Han + Hiragana + Other + Katakana (raw pass, confidence 0.80)
しかしこの場合、8 人の元レジ係/料理人/現清掃員を連れてきて、それぞれ (あなたも加えて) 家の別々のエリアを掃除できれば、**並列** に作業でき、より早く終えられます。
likely benign
LLM, confidence 0.97
Japanese analogy sentence about parallel work.
Reasoning
Japanese prose about parallel cleaning analogy; natural script mixing.
-
identifier `我々は間違いを犯す` mixes scripts: Han + Other + Hiragana (raw pass, confidence 0.80)
### 我々は間違いを犯す { #we-make-mistakes }
私たち人間は常に**間違い**を犯します。ソフトウェアには、ほとんど常に**バグ**があらゆる箇所に隠されています。🐛
likely benign
LLM, confidence 0.97
Japanese heading about making mistakes in deployment docs.
Reasoning
Japanese heading and text about human mistakes and bugs; benign documentation.
-
identifier `他の人々のこれまでの働きがなければ存在しなかったでしょう` mixes scripts: Han + Hiragana + Other (raw pass, confidence 0.80)
**FastAPI**は、他の人々のこれまでの働きがなければ存在しなかったでしょう。
以前に作られた多くのツールが、作成における刺激として役立ってきました。
likely benign
LLM, confidence 0.97
Japanese history sentence about FastAPI's predecessors.
Reasoning
Ordinary Japanese sentence acknowledging prior work; false positive from script mixing.
-
identifier `を別々のモデルとして分けて使うことは可能です` mixes scripts: Hiragana + Han + Other + Katakana (raw pass, confidence 0.80)
...しかし、同じアプリ内で Pydantic v1 と v2 を別々のモデルとして分けて使うことは可能です。
```mermaid
likely benign
LLM, confidence 0.96
Japanese migration guide sentence about using both Pydantic versions.
Reasoning
Japanese prose about using Pydantic v1 and v2 models; natural mixed scripts in documentation.
-
identifier `徐々に` mixes scripts: Han + Other + Hiragana (raw pass, confidence 0.80)
`bump-pydantic` が適用できない場合は、同一アプリで v1 と v2 のモデルを併用できるサポートを利用して、徐々に v2 へ移行できます。
likely benign
LLM, confidence 0.97
Japanese migration guide sentence using the word 'gradually'.
Reasoning
Japanese prose word 'gradually' in a migration guide; benign.
-
string literal compression ratio 1.036 (140 bytes) (raw pass, confidence 0.70)
"_FastAPIライブラリを採用し、クエリで **予測値** を取得できる **REST** サーバを構築しました。 [for Ludwig]_"
likely benign
LLM, confidence 0.85
Japanese tagline in the FastAPI docs index with markdown emphasis.
Reasoning
A quoted Japanese marketing/tagline string with markdown emphasis; compression ratio of 1.036 on short natural text is expected and not indicative of obfuscation.
-
identifier `様々な階層` mixes scripts: Han + Other + Hiragana (raw pass, confidence 0.80)
`BackgroundTasks` の使用は依存性注入システムでも機能し、様々な階層 (*path operation function*、依存性 (dependable)、サブ依存性など) で `BackgroundTasks` 型のパラメーターを宣言できます。
likely benign
LLM, confidence 0.93
Japanese documentation sentence containing ordinary mixed-script words.
Reasoning
Mixed Han and Hiragana in ordinary Japanese prose ('様々な階層') is normal natural-language text in a documentation file, not an identifier obfuscation attempt.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
**FastAPI** は、それぞれの場合の処理⟨U+200B⟩⟨U+200B⟩方法と同じオブジェクトの再利用方法を知っているため、すべてのバックグラウンドタスクがマージされ、バックグラウンドで後で実行されます:
likely benign
LLM, confidence 0.85
Zero-width space in a Japanese tutorial paragraph.
Reasoning
A zero-width space inside Japanese prose is a common artifact of copy-paste or translation tooling. It is a stray character in a docs file with no code execution path, so it is low-risk, though it could in principle hide text from readers.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
**FastAPI** は、それぞれの場合の処理⟨U+200B⟩⟨U+200B⟩方法と同じオブジェクトの再利用方法を知っているため、すべてのバックグラウンドタスクがマージされ、バックグラウンドで後で実行されます:
likely benign
LLM, confidence 0.85
Second zero-width space on the same Japanese line.
Reasoning
Same as the other zero-width space on the same line; a stray character from editing or translation in documentation prose, not an attack.
-
identifier `個々の` mixes scripts: Han + Other + Hiragana (raw pass, confidence 0.80)
`APIRouter` に `dependencies` を置くことで、*path operations* のグループ全体に認証を要求する、といった用途に使えます。個々の *path operation* に依存関係を追加していなくても構いません。
///
likely benign
LLM, confidence 0.93
Japanese documentation sentence with ordinary mixed-script text.
Reasoning
Normal Japanese prose mixing Han and Hiragana in '個々の', with no identifier or code construct involved.
-
line length 509 characters (raw pass, confidence 0.50)
-
line length 720 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
Documented example JSON Web Token in a tutorial.
Reasoning
This is the standard JWT example token from jwt.io, used to illustrate the format in documentation. It is not a payload or dropper.
-
identifier `同じデータベースを使用してDjangoアプリケーションを徐々に移行することもできます` mixes scripts: Han + Hiragana + Katakana + Latin + Other (raw pass, confidence 0.80)
例えば、Djangoアプリケーションからデータベース内の同じデータをFastAPIアプリケーションと共有できるだけではなく、同じデータベースを使用してDjangoアプリケーションを徐々に移行することもできます。
likely benign
LLM, confidence 0.93
Japanese documentation sentence about sharing a database with Django.
Reasoning
Ordinary Japanese prose with mixed scripts in a sentence about Django migration; no identifier or code obfuscation.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
PowerShell example setting environment variables before running a FastAPI app.
Reasoning
This is a PowerShell environment-variable example in a console block in documentation. The '$Env:' form is the normal PowerShell syntax for setting env vars, and the command is shown to the reader, not executed by the scanner or the page.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
PowerShell example setting APP_NAME and running a FastAPI app.
Reasoning
Same PowerShell environment-variable example as the neighboring line; a documentation illustration of setting configuration values.
-
string literal compression ratio 0.992 (128 bytes) (raw pass, confidence 0.70)
* 100% <dfn title="Python 타입 어노테이션으로, 이를 통해 편집기와 외부 도구가 더 나은 지원을 제공할 수 있습니다">타입 어노테이션</dfn> 코드 베이스.
* 프로덕션 애플리케이션에서 사용됩니다.
likely benign
LLM, confidence 0.88
Korean feature list bullet with inline HTML definition markup.
Reasoning
The flagged 'string literal' is a Korean prose bullet with HTML abbr-style markup in a docs file. High compression ratio on short text is a heuristic artifact of the raw pass, not obfuscation.
-
string literal compression ratio 0.957 (162 bytes) (raw pass, confidence 0.60)
"_**FastAPI** 라이브러리를 채택하여 **예측**을 얻기 위해 쿼리를 실행할 수 있는 **REST** 서버를 생성했습니다. [Ludwig을 위해]_"
likely benign
LLM, confidence 0.85
Korean testimonial quote in the index page.
Reasoning
A quoted Korean testimonial sentence in markdown. Compression ratio on natural-language text is a weak raw-pass heuristic with a high false-positive rate here.
-
string literal compression ratio 0.956 (183 bytes) (raw pass, confidence 0.60)
"_**Netflix**는 우리의 **위기 관리** 오케스트레이션 프레임워크인 **Dispatch**의 오픈 소스 공개를 발표하게 되어 기쁩니다! [**FastAPI**로 빌드]_"
likely benign
LLM, confidence 0.85
Korean testimonial quote about Netflix Dispatch.
Reasoning
A quoted Korean testimonial sentence in markdown; the flagged compression ratio reflects ordinary prose, not hidden content.
-
line length 514 characters (raw pass, confidence 0.50)
-
line length 719 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
Documented example JSON Web Token in the Korean tutorial.
Reasoning
Same standard jwt.io example token used in the Korean translation of the OAuth2 tutorial; documentation content, not a payload.
-
identifier `azərbaycan` mixes scripts: Latin + Other (raw pass, confidence 0.80)
ay: aymar aru
az: azərbaycan dili
ba: башҡорт теле
be: беларуская мова
likely benign
LLM, confidence 0.85
Language-name mapping entry for Azerbaijani in a YAML data file.
Reasoning
The value 'azərbaycan dili' is the native name of Azerbaijani, which legitimately uses the schwa character ə. This is a language-name data file, so the mixed-script flag is a false positive.
-
identifier `Eʋegbe` mixes scripts: Latin + Other (raw pass, confidence 0.80)
dz: རྫོང་ཁ
ee: Eʋegbe
el: Ελληνικά
en: English
likely benign
LLM, confidence 0.95
Ewe language display name containing an IPA letter.
Reasoning
The flagged identifier is the Ewe language name 'Eʋegbe' in a language-name table. The ʋ (U+028B) is a standard IPA letter used in Ewe orthography, so the Latin-plus-other mix is legitimate.
-
identifier `æвзаг` contains homoglyph candidates: а (0430)→a (raw pass, confidence 0.70)
or: ଓଡ଼ିଆ
os: ирон æвзаг
pa: ਪੰਜਾਬੀ
pi: पाऴि
likely benign
LLM, confidence 0.93
Ossetian language name written in its native Cyrillic-based orthography.
Reasoning
'æвзаг' is the Ossetian word for 'language', written in Ossetian Cyrillic with the Latin-looking æ. The homoglyph hit on Cyrillic а is a false positive for a natural-language name in a locale table.
-
identifier `æвзаг` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)
or: ଓଡ଼ିଆ
os: ирон æвзаг
pa: ਪੰਜਾਬੀ
pi: पाऴि
likely benign
LLM, confidence 0.93
Ossetian language name mixing æ with Cyrillic letters, as the native orthography does.
Reasoning
Same token as the homoglyph finding. The Latin æ combined with Cyrillic letters is the standard Ossetian orthography, so the mixed-script signal is a false positive in a language-name file.
-
identifier `Saɯ` mixes scripts: Latin + Other (raw pass, confidence 0.80)
yo: Yorùbá
za: Saɯ cueŋƅ
zh: 简体中文
zh-hant: 繁體中文
likely benign
LLM, confidence 0.92
Zhuang language display name using phonetic Latin letters.
Reasoning
'Saɯ cueŋƅ' is the Zhuang language name. The ɯ, ŋ and ƅ characters are standard letters in Zhuang orthography, so this is a legitimate localized display name.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Documentation example of setting PowerShell environment variables.
Reasoning
This is a PowerShell example in a documentation console block showing how to set environment variables. The 'variable command name' is just documentation of $Env: syntax, not a real dropper or dynamic execution in code.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Documentation example of setting PowerShell environment variables for an app.
Reasoning
Same PowerShell environment-variable example from the same docs page, repeated in a second console block. It is illustrative documentation with no executable payload.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
o tem suas próprias coisas, variáveis ⟨U+200B⟩⟨U+200B⟩e memória. E se você estiver consumindo uma grande quantidade de memória em seu código, **cada processo** consumirá uma quantidade equivalente de memória.
likely benign
LLM, confidence 0.85
Stray zero-width space in a Portuguese documentation sentence.
Reasoning
A zero-width space sits between 'variáveis' and 'e' in Portuguese prose. This is a typical copy-paste or translation artifact in Markdown docs, with no code-hiding effect.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
em suas próprias coisas, variáveis ⟨U+200B⟩⟨U+200B⟩e memória. E se você estiver consumindo uma grande quantidade de memória em seu código, **cada processo** consumirá uma quantidade equivalente de memória.
likely benign
LLM, confidence 0.85
Second stray zero-width space in a Portuguese documentation paragraph.
Reasoning
Another stray zero-width space in the same Portuguese paragraph, consistent with editing or translation residue rather than deliberate obfuscation.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Esses processos de trabalho seriam aqueles que executariam sua aplicação, eles executariam os cálculos principais para receber uma **request** e retornar uma **resposta**, e carregariam qualquer coisa que você colocasse em variáveis ⟨U+200B⟩⟨U+200B⟩na RAM.
<img src="/img/deployment/concepts/process-ram.drawio.svg">
likely benign
LLM, confidence 0.85
Zero-width space within Portuguese documentation prose.
Reasoning
A zero-width space appears in the middle of a Portuguese phrase ('variáveis ⟨U+200B⟩⟨U+200B⟩na RAM'). This is a common artifact in translated docs and does not hide executable content.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Esses processos de trabalho seriam aqueles que executariam sua aplicação, eles executariam os cálculos principais para receber uma **request** e retornar uma **resposta**, e carregariam qualquer coisa que você colocasse em variáveis ⟨U+200B⟩⟨U+200B⟩na RAM.
<img src="/img/deployment/concepts/process-ram.drawio.svg">
likely benign
LLM, confidence 0.85
Second zero-width space in the same Portuguese documentation passage.
Reasoning
Another zero-width space in the same Portuguese text. Repeated occurrences fit translation residue rather than deliberate concealment.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Para alterar as URLs usadas ⟨U+200B⟩⟨U+200B⟩para as interfaces de usuário da documentação gerada automaticamente, leia a documentação de [Tutorial - Metadados e URLs da Documentação](../tutorial/metadata.md#docs-urls).
likely benign
LLM, confidence 0.85
Stray zero-width space in a Portuguese how-to sentence.
Reasoning
A zero-width space between 'usadas' and 'para' in Portuguese documentation prose. This is a benign typesetting or copy artifact.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Para alterar as URLs usadas ⟨U+200B⟩⟨U+200B⟩para as interfaces de usuário da documentação gerada automaticamente, leia a documentação de [Tutorial - Metadados e URLs da Documentação](../tutorial/metadata.md#docs-urls).
likely benign
LLM, confidence 0.85
Second stray zero-width space in a Portuguese how-to sentence.
Reasoning
A second zero-width space in the same Portuguese sentence, consistent with translation or editing residue and not with hidden instructions.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Mas isso só permitirá certos tipos de comunicação, excluindo tudo que envolva credenciais: cookies, cabeçalhos de autorização como aqueles usados ⟨U+200B⟩⟨U+200B⟩com Bearer Tokens, etc.
Então, para que tudo funcione corretamente, é melhor especificar explicitamente as origens permitidas.
likely benign
LLM, confidence 0.85
Stray zero-width space in a Portuguese CORS tutorial paragraph.
Reasoning
A zero-width space in Portuguese CORS tutorial prose between 'usados' and 'com'. It is a harmless artifact of the translated Markdown.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Mas isso só permitirá certos tipos de comunicação, excluindo tudo que envolva credenciais: cookies, cabeçalhos de autorização como aqueles usados ⟨U+200B⟩⟨U+200B⟩com Bearer Tokens, etc.
Então, para que tudo funcione corretamente, é melhor especificar explicitamente as origens permitidas.
likely benign
LLM, confidence 0.85
Second stray zero-width space in a Portuguese CORS tutorial paragraph.
Reasoning
Another zero-width space in the same paragraph, matching the same translation-artifact pattern. It carries no executable or concealed content.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Os parâmetros padrão usados ⟨U+200B⟩⟨U+200B⟩pela implementação `CORSMiddleware` são restritivos por padrão, então você precisará habilitar explicitamente as origens, métodos ou cabeçalhos específicos para que os navegadores tenham permissão para usá-los em um contexto cross domain.
likely benign
LLM, confidence 0.97
Portuguese FastAPI CORS tutorial paragraph containing a U+200B zero-width space.
Reasoning
Zero-width spaces inserted around 'ser' Portuguese prose in a documentation markdown file. Likely a translation/editor artifact; no code execution or hidden instruction. Benign typographic artifact, though it is an unusual invisible character.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Os parâmetros padrão usados ⟨U+200B⟩⟨U+200B⟩pela implementação `CORSMiddleware` são restritivos por padrão, então você precisará habilitar explicitamente as origens, métodos ou cabeçalhos específicos para que os navegadores tenham permissão para usá-los em um contexto cross domain.
likely benign
LLM, confidence 0.97
Second U+200B in the same Portuguese CORS paragraph.
Reasoning
Same paragraph, second zero-width space adjacent to the first; consistent with copy-paste or translation tooling artifacts in docs prose.
-
line length 710 characters (raw pass, confidence 0.50)
-
line length 897 characters (raw pass, confidence 0.50)
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
E ambos os modelos serão usados ⟨U+200B⟩⟨U+200B⟩para a documentação interativa da API:
<img src="/img/tutorial/response-model/image02.png">
likely benign
LLM, confidence 0.96
Portuguese response-model tutorial sentence with a zero-width space.
Reasoning
Zero-width space inside Portuguese prose ('usados ⟨U+200B⟩⟨U+200B⟩pela') in documentation; no functional or hidden-instruction content.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
E ambos os modelos serão usados ⟨U+200B⟩⟨U+200B⟩para a documentação interativa da API:
<img src="/img/tutorial/response-model/image02.png">
likely benign
LLM, confidence 0.96
Second U+200B in the same Portuguese response-model line.
Reasoning
Second zero-width space in the same prose line; benign docs artifact.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
E as ferramentas também ficarão felizes porque `RedirectResponse` e ⟨U+200B⟩⟨U+200B⟩`JSONResponse` são subclasses de `Response`, então a anotação de tipo está correta.
### Anote uma subclasse de Response { #annotate-a-response-subclass }
likely benign
LLM, confidence 0.96
Portuguese text mentioning RedirectResponse and JSONResponse with a zero-width space.
Reasoning
Zero-width space before a code span in Portuguese documentation prose; benign translation artifact.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
E as ferramentas também ficarão felizes porque `RedirectResponse` e ⟨U+200B⟩⟨U+200B⟩`JSONResponse` são subclasses de `Response`, então a anotação de tipo está correta.
### Anote uma subclasse de Response { #annotate-a-response-subclass }
likely benign
LLM, confidence 0.96
Second U+200B in the same Portuguese response-model paragraph.
Reasoning
Second zero-width space in the same line of documentation prose; benign.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
...isso falha porque a anotação de tipo não é um tipo Pydantic e não é apenas uma única classe ou subclasse `Response`, é uma união (qualquer uma das duas) entre um `Response` e ⟨U+200B⟩⟨U+200B⟩um `dict`.
### Desative o modelo de resposta { #disable-response-model }
likely benign
LLM, confidence 0.96
Portuguese union-type explanation with a zero-width space.
Reasoning
Zero-width space in Portuguese documentation prose before a code span; benign artifact.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
...isso falha porque a anotação de tipo não é um tipo Pydantic e não é apenas uma única classe ou subclasse `Response`, é uma união (qualquer uma das duas) entre um `Response` e ⟨U+200B⟩⟨U+200B⟩um `dict`.
### Desative o modelo de resposta { #disable-response-model }
likely benign
LLM, confidence 0.96
Second U+200B in the same Portuguese union-type paragraph.
Reasoning
Second zero-width space in the same documentation line; benign.
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
Standard sample JWT token shown in OAuth2/JWT tutorial documentation.
Reasoning
The blob is the canonical JWT example from jwt.io (header.payload.signature), well-known sample token, documented in a tutorial. Not a payload or dropper.
-
identifier `Pythonу` contains homoglyph candidates: у (0443)→y (raw pass, confidence 0.70)
Pythonу придётся сравнить весь общий префикс `stanleyjobso` в `stanleyjobsox` и `stanleyjobson`, прежде чем понять, что строки отличаются. Поэтому на ответ «Неверное имя пользователя или пароль» уйдё
likely benign
LLM, confidence 0.95
Russian prose where the word 'Python' takes a Cyrillic case ending, flagged as a homoglyph.
Reasoning
The Cyrillic 'у' in 'Pythonу' is a Russian-language translation word-ending (Python + genitive suffix 'у'), not a spoofed identifier. The flagged token is prose in Russian documentation, not code.
-
identifier `Pythonу` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)
Pythonу придётся сравнить весь общий префикс `stanleyjobso` в `stanleyjobsox` и `stanleyjobson`, прежде чем понять, что строки отличаются. Поэтому на ответ «Неверное имя пользователя или пароль» уйдё
likely benign
LLM, confidence 0.95
Same Russian prose word 'Pythonу' flagged for mixing Latin and Cyrillic.
Reasoning
Mixed script arises from the Russian case ending on the Latin word 'Python' in ordinary Russian prose; not an identifier spoofing attack.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
PowerShell-style environment variable setup in a FastAPI settings docs console block.
Reasoning
This is a console example in documentation showing PowerShell environment variable assignment ($Env:ADMIN_EMAIL) followed by running uvicorn/fastapi. The variable command-name flag is a false positive from the embedded-bash parser on PowerShell syntax; no malicious execution.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Russian docs page showing PowerShell environment variable assignments before starting a FastAPI app.
Reasoning
The snippet is a documentation example that sets PowerShell environment variables ($Env:ADMIN_EMAIL, $Env:APP_NAME) and then runs a normal uv command. The $Env: prefix is ordinary PowerShell syntax for environment variables, so the variable-command-name signal is a false positive from a markdown tutorial.
-
line length 666 characters (raw pass, confidence 0.50)
-
line length 890 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
dismissed
LLM, confidence 0.93
Sample JSON Web Token used as an example in the Russian OAuth2/JWT tutorial.
Reasoning
The blob is the three-part JWT example with a header, payload and signature, and the payload decodes to the well-known sample claims (sub 1234567890, name John Doe). This is a standard illustrative token in JWT documentation, not an encoded payload.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Turkish docs page showing PowerShell environment variable setup for a FastAPI app.
Reasoning
The snippet is the same PowerShell documentation example setting $Env: variables and running uv. Environment variable assignment in a code block in a tutorial is legitimate, so the dynamic-execution flag is a false positive.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Turkish docs page with PowerShell environment variable assignments and a uv run command.
Reasoning
This is the same PowerShell $Env: example in the Turkish translation, a normal environment-variable setup in documentation with no hidden or remote execution.
-
line length 654 characters (raw pass, confidence 0.50)
-
line length 899 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
dismissed
LLM, confidence 0.93
Sample JWT example in the Turkish OAuth2 tutorial.
Reasoning
The same standard sample JWT from the jwt.io example appears in the Turkish translation. It is a public illustrative token, and the raw base64 flag is a known false positive for JWT examples.
-
identifier `необовʼязковою` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Властивість `servers` у специфікації OpenAPI є необовʼязковою.
dismissed
LLM, confidence 0.90
Ukrainian prose about the optional 'servers' field in OpenAPI, with a normal apostrophe in the word.
Reasoning
The flagged word 'необовʼязковою' uses the Ukrainian apostrophe U+02BC, which is standard Ukrainian orthography. Mixing Cyrillic with this apostrophe is expected, so the mixed-script flag is a false positive.
-
identifier `обʼєкті` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Потім ви можете встановлювати заголовки в цьому *тимчасовому* обʼєкті відповіді.
{* ../../docs_src/response_headers/tutorial002_py310.py hl[1, 7:8] *}
dismissed
LLM, confidence 0.90
Ukrainian prose about setting headers on the temporary response object.
Reasoning
'обʼєкті' uses the modifier letter apostrophe U+02BC, the normal Ukrainian spelling for 'об'єкті'. The mixed-script finding comes from that orthographic character, not from spoofing.
-
identifier `обʼєкт` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Далі ви можете повернути будь-який потрібний обʼєкт, як зазвичай (наприклад, `dict`, модель бази даних тощо).
dismissed
LLM, confidence 0.90
Ukrainian documentation text mentioning returning objects.
Reasoning
'обʼєкт' is ordinary Ukrainian written with the U+02BC apostrophe. No identifier spoofing or hidden content is present.
-
identifier `обʼєкта` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Якщо ви оголосили `response_model`, його все одно буде використано для фільтрації та перетворення поверненого обʼєкта.
dismissed
LLM, confidence 0.90
Ukrainian documentation text about response_model filtering the returned object.
Reasoning
'обʼєкта' is the standard Ukrainian genitive form written with U+02BC. The flag reflects a legitimate orthographic apostrophe in prose.
-
identifier `обʼєкт` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
�стає цей *тимчасовий* обʼєкт відповіді, щоб витягти заголовки (а також кукі та код статусу) і помістить їх у кінцеву відповідь, яка міститиме повернуте вами значення, відфіль… (340 bytes total)
dismissed
LLM, confidence 0.88
Ukrainian documentation paragraph describing the temporary response object.
Reasoning
The snippet is truncated and contains a replacement character, but the flagged word 'обʼєкт' is the same Ukrainian spelling with U+02BC. The raw mixed-script signal is a false positive on normal prose.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Ukrainian settings page with PowerShell environment variable assignments and uv run.
Reasoning
This is the same PowerShell $Env: environment-variable example in the Ukrainian docs. Setting environment variables before running an app is a standard documentation pattern.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Ukrainian settings page showing environment variable setup for FastAPI.
Reasoning
The snippet repeats the PowerShell $Env: assignments and uv run command from the Ukrainian settings docs. It is a normal environment configuration example.
-
identifier `необовʼязковий` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* _Шлях_ `/items/{item_id}` містить _параметр шляху_ `item_id`, який має бути типу `int`.
* _Шлях_ `/items/{item_id}` містить необовʼязковий `str` _параметр запиту_ `q`.
dismissed
LLM, confidence 0.90
Ukrainian index page describing an optional str query parameter.
Reasoning
'необовʼязковий' uses the Ukrainian apostrophe U+02BC, which is correct Ukrainian spelling. The mixed-script flag is a false positive on natural-language text in the index page.
-
identifier `обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Автоматичні та зрозумілі помилки, коли дані некоректні.
* Валідацію навіть для глибоко вкладених JSON-обʼєктів.
dismissed
LLM, confidence 0.93
Ukrainian documentation word 'обʼєктів' using the standard Ukrainian apostrophe.
Reasoning
The flagged word uses U+02BC (modifier letter apostrophe), which Ukrainian orthography uses in words like обʼєкт. This is ordinary Ukrainian prose in a documentation file, not an identifier being obfuscated.
-
identifier `Обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Перетворення типів Python (`str`, `int`, `float`, `bool`, `list`, тощо).
* Обʼєктів `datetime`.
* Обʼєктів `UUID`.
* Моделей бази даних.
dismissed
LLM, confidence 0.93
Capitalized Ukrainian word 'Обʼєктів' in a documentation list.
Reasoning
Same Ukrainian apostrophe orthography (Обʼєктів) in a bulleted list of a markdown doc. Legitimate natural-language text.
-
identifier `Обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Обʼєктів `datetime`.
* Обʼєктів `UUID`.
* Моделей бази даних.
* ...та багато іншого.
dismissed
LLM, confidence 0.93
Ukrainian documentation bullet using 'Обʼєктів' with standard apostrophe.
Reasoning
Repeated Ukrainian apostrophe orthography in documentation prose; no code execution or identifier context.
-
identifier `обовʼязковий` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Перевірить, що є обовʼязковий атрибут `name`, який має бути типу `str`.
* Перевірить, що є обовʼязковий атрибут `price`, який має бути типу `float`.
dismissed
LLM, confidence 0.93
Ukrainian word 'обовʼязковий' (mandatory) in documentation.
Reasoning
'обовʼязковий' is standard Ukrainian spelling with U+02BC. The surrounding text is a normal feature description.
-
identifier `обовʼязковий` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Перевірить, що є обовʼязковий атрибут `price`, який має бути типу `float`.
* Перевірить, що є необовʼязковий атрибут `is_offer`, який має бути типу `bool`, якщо він присутній.
dismissed
LLM, confidence 0.93
Ukrainian documentation text with 'обовʼязковий' next to code-formatted attribute names.
Reasoning
Standard Ukrainian apostrophe usage in prose; the attribute names in backticks are plain ASCII and benign.
-
identifier `необовʼязковий` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Перевірить, що є необовʼязковий атрибут `is_offer`, який має бути типу `bool`, якщо він присутній.
* Усе це також працюватиме для глибоко вкладених JSON-обʼєктів.
dismissed
LLM, confidence 0.93
Ukrainian word 'необовʼязковий' (optional) in documentation.
Reasoning
'необовʼязковий' is legitimate Ukrainian orthography in documentation prose.
-
identifier `обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Усе це також працюватиме для глибоко вкладених JSON-обʼєктів.
* Автоматично перетворюватиме з та в JSON.
* Документуватиме все за допомогою OpenAPI, який може бути використано в:
dismissed
LLM, confidence 0.93
Ukrainian documentation sentence containing 'JSON-обʼєктів'.
Reasoning
Ordinary Ukrainian sentence with the standard apostrophe in 'обʼєктів'. No code or hidden content.
-
identifier `необовʼязково` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
### Розгортання застосунку (необовʼязково) { #deploy-your-app-optional }
За бажання ви можете розгорнути ваш застосунок FastAPI у [FastAPI Cloud](https://fastapicloud.com) однією командою. 🚀
dismissed
LLM, confidence 0.93
Ukrainian section heading 'Розгортання застосунку (необовʼязково)'.
Reasoning
Heading text '(необовʼязково)' in Ukrainian with standard apostrophe; plain documentation.
-
identifier `необовʼязкових` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Коли ви встановлюєте FastAPI за допомогою `uv add "fastapi[standard]"`, ви отримуєте групу необовʼязкових залежностей `standard`:
Використовується Pydantic:
dismissed
LLM, confidence 0.93
Ukrainian documentation sentence about optional dependency group.
Reasoning
Standard Ukrainian orthography for 'необовʼязкових' in a documentation sentence about optional dependencies.
-
identifier `необовʼязкові` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Якщо ви не хочете включати необовʼязкові залежності `standard`, ви можете встановити через `uv add fastapi` замість `uv add "fastapi[standard]"`.
### Без `fastapi-cloud-cli` { #without-fastapi-cloud-cli }
dismissed
LLM, confidence 0.93
Ukrainian documentation sentence about optional standard dependencies.
Reasoning
'необовʼязкові' is correct Ukrainian spelling; the surrounding text is normal install instructions.
-
line length 717 characters (raw pass, confidence 0.50)
-
line length 857 characters (raw pass, confidence 0.50)
-
string literal compression ratio 0.993 (153 bytes) (raw pass, confidence 0.70)
你的 API 現在也能掌控自己的 <dfn title="這只是個玩笑，提醒一下。這與 Cookie 同意無關，但有趣的是連 API 現在也能拒絕可憐的 Cookie。請收下這塊餅乾。🍪">Cookie 同意</dfn>。🤪🍪
你可以使用 Pydantic 的模型設定來 `forbid` 任何 `extra` 欄位：
likely benign
LLM, confidence 0.93
A humorous Chinese documentation tooltip about cookie consent in a FastAPI tutorial markdown file.
Reasoning
The snippet is a Traditional Chinese FastAPI docs sentence with a joke tooltip inside an dfn title attribute, plus emoji. The high compression ratio of 0.993 reflects repeated emoji and the long title string, not an encoded payload. It is a harmless documentation joke with no code execution or hidden instruction to a model.
-
line length 655 characters (raw pass, confidence 0.50)
-
string literal compression ratio 0.987 (153 bytes) (raw pass, confidence 0.70)
你的 API 现在可以控制自己的 <dfn title="只是个玩笑，别当真。和 cookie 同意无关，不过连 API 现在都能拒绝可怜的 cookie，挺好玩的。来，吃块小饼干吧。🍪">cookie 同意</dfn>。🤪🍪
dismissed
LLM, confidence 0.92
Chinese tutorial sentence with an HTML <dfn> title attribute containing a joke about cookie consent.
Reasoning
Raw-pass high-complexity hit on a long Chinese HTML title attribute in a tutorial. The compression ratio is an artifact of short natural-language text in a dfn tag; the content is a joke about cookie consent with no executable or encoded payload.
-
line length 665 characters (raw pass, confidence 0.50)
-
string literal compression ratio 1.032 (154 bytes) (raw pass, confidence 0.70)
库类库（在某些情况下称为 <abbr title="Object Relational Mapper - 对象关系映射器: 一个花哨的术语，指一种库，其中某些类表示 SQL 表，而实例表示这些表中的行">"ORMs"</abbr>），FastAPI 不会强迫你使用任何东西。😎
dismissed
LLM, confidence 0.92
Chinese tutorial sentence with an abbr title attribute defining ORM.
Reasoning
Raw-pass high-complexity hit on a Chinese abbr title explaining ORM. Ordinary prose in a documentation file; the compression ratio reflects CJK text, not obfuscation.
-
`__import__` called on a non-literal expression (ast pass, confidence 0.70)
try:
Color = __import__(module_path, fromlist=["Color"]).Color
except ImportError: pytest.skip(f"{module_path} not available")
likely benign
LLM, confidence 0.90
A test helper dynamically importing an optional module's Color class, skipping if unavailable.
Reasoning
This is a test file in the FastAPI test suite. The __import__ call loads a module path parameterized by a test fixture or loop variable, wrapped in try/except ImportError with pytest.skip and a pragma no cover marker. This is a standard pattern for optional-dependency tests, with no network, shell, or encoded payload involvement.
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
disclude.io