Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
identifier `необовʼязкові` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
### Додаткові необовʼязкові залежності { #additional-optional-dependencies }
Є ще деякі додаткові залежності, які ви можете захотіти встановити.
-
identifier `необовʼязкові` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Додаткові необовʼязкові залежності Pydantic:
* [`pydantic-settings`](https://pydantic.dev/docs/validation/latest/concepts/pydantic_settings/) - для керування налаштуваннями.
-
identifier `необовʼязкові` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Додаткові необовʼязкові залежності FastAPI:
* [`orjson`](https://github.com/ijl/orjson) - потрібно, якщо ви хочете використовувати `ORJSONResponse`.
-
identifier `імʼям` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Скажімо, у вас є клас `Person` з імʼям:
{* ../../docs_src/python_types/tutorial010_py310.py hl[1:3] *}
-
identifier `прикладi` contains homoglyph candidates: р (0440)→p, а (0430)→a (raw pass, confidence 0.70)
У попередньому прикладi *операції шляху* очікували б JSON-тіло з атрибутами `Item`, наприклад:
```JSON
-
identifier `прикладi` mixes scripts: Cyrillic + Latin (raw pass, confidence 0.80)
У попередньому прикладi *операції шляху* очікували б JSON-тіло з атрибутами `Item`, наприклад:
```JSON
-
identifier `сирa` contains homoglyph candidates: с (0441)→c, р (0440)→p (raw pass, confidence 0.70)
Якщо вас цікавить, як виглядає «сирa» схема OpenAPI, FastAPI автоматично генерує JSON (схему) з описами всього вашого API.
-
identifier `сирa` mixes scripts: Cyrillic + Latin (raw pass, confidence 0.80)
Якщо вас цікавить, як виглядає «сирa» схема OpenAPI, FastAPI автоматично генерує JSON (схему) з описами всього вашого API.
-
identifier `обʼєкт` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Ви також можете передати шлях до файлу в команду `fastapi dev`, і вона вгадає обʼєкт FastAPI app, який слід використовувати:
```console
-
identifier `памʼятати` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Але вам доведеться щоразу памʼятати передавати правильний шлях\entrypoint під час виклику команди `fastapi`.
-
identifier `необовʼязково` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
### Розгорніть ваш застосунок (необовʼязково) { #deploy-your-app-optional }
За бажанням ви можете розгорнути ваш FastAPI-застосунок у [FastAPI Cloud](https://fastapicloud.com) однією командою. 🚀
-
identifier `Підібʼємо` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
## Підібʼємо підсумки, крок за кроком { #recap-step-by-step }
### Крок 1: імпортуємо `FastAPI` { #step-1-import-fastapi }
-
identifier `навʼязує` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
**FastAPI** не навʼязує жодного конкретного значення.
Наведена тут інформація подана як настанова, а не вимога.
-
identifier `обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Існує багато інших обʼєктів і моделей, які будуть автоматично конвертовані в JSON (зокрема ORM тощо). Спробуйте використати свої улюблені - велика ймовірність, що вони вже підтрим
-
identifier `Підібʼємо` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
## Підібʼємо підсумки { #recap }
* Імпортуйте `FastAPI`.
-
identifier `розвʼязати` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Існувала також специфікація «OpenID». Вона намагалася розвʼязати те саме, що й **OpenID Connect**, але не базувалась на OAuth2.
Тож це була повністю додаткова система.
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
-
string literal compression ratio 0.962 (132 bytes) (raw pass, confidence 0.60)
* <dfn title="被設定為連接並以某種方式一起工作的機器群組。">叢集</dfn>
* <dfn title="一種機器學習方法，使用具備多個隱藏層的人工神經網路，在輸入與輸出層之間建立完整的內部結構">深度學習</dfn>
## 標題 { #headings }
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
-
string literal compression ratio 0.975 (161 bytes) (raw pass, confidence 0.60)
QL 資料庫函式庫（有時稱為 <abbr title="Object Relational Mapper - 物件關聯對應器：一個用來描述某些類別代表 SQL 資料表且其實例代表資料表中資料列的函式庫的術語">"ORMs"</abbr>），FastAPI 不會強迫你使用特定工具。😎
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
-
file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
if "gzip" in self.headers.getlist("Content-Encoding"):
body = gzip.decompress(body)
self._body = body
return self._body
-
file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
if "gzip" in self.headers.getlist("Content-Encoding"):
body = gzip.decompress(body)
self._body = body
return self._body
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Default
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant
likely benign
LLM, confidence 0.93
Soft hyphen characters embedded in German prose in a docs test file.
Reasoning
Soft hyphens inside German words in a markdown documentation test file. Typical of hyphenation in German text; no code execution or hidden instruction. Benign.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Default
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant
likely benign
LLM, confidence 0.93
Second soft hyphen in German prose of the same docs test file.
Reasoning
Same file and pattern as the other soft hyphen finding; a second soft hyphen in a German compound word. Benign hyphenation artifact.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant
* die Anwendung bereitstellen
likely benign
LLM, confidence 0.93
Soft hyphen in a German word in the docs test file.
Reasoning
Soft hyphen in 'Groß-/Klein⟨U+00AD⟩schreibung' inside a markdown list of German documentation. Benign.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant
* die Anwendung bereitstellen
likely benign
LLM, confidence 0.93
Soft hyphen in a German word in the docs test file.
Reasoning
Soft hyphen in 'schreibung' within German documentation text. Benign.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Documentation example setting PowerShell environment variables before running fastapi.
Reasoning
PowerShell-style environment variable assignment shown in a console example in FastAPI docs. The variable-command flag is a false positive from a documentation code block; no real execution occurs in the repo.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Documentation console example setting env vars and running fastapi via uv.
Reasoning
Same console example with environment variable exports and a uv run command in a docs page. Benign documentation content.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
Außerdem ist Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung in HTTP-Headern nicht relevant, daher können Sie sie im Standard-Python-Stil (auch bekannt als „snake_case“) deklarieren.
likely benign
LLM, confidence 0.93
Soft hyphen in German tutorial text about header case-insensitivity.
Reasoning
Soft hyphen inside 'Groß-/Klein⟨U+00AD⟩schreibung' in German tutorial prose. Benign.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
Außerdem ist Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung in HTTP-Headern nicht relevant, daher können Sie sie im Standard-Python-Stil (auch bekannt als „snake_case“) deklarieren.
likely benign
LLM, confidence 0.93
Soft hyphen in German tutorial text about header case-insensitivity.
Reasoning
Second soft hyphen in the same German tutorial sentence. Benign.
-
line length 725 characters (raw pass, confidence 0.50)
-
line length 930 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.93
Well-known sample JWT token in an OAuth2 tutorial.
Reasoning
This is the canonical JWT example token from jwt.io documentation, decoding to a standard sample header and payload. It is a public sample, not a secret or payload.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Starlette's Y: Starlettes Y
* X is case-sensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant in X
* X is case-insensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant in X
* standard Python: Standard-Python
likely benign
LLM, confidence 0.93
Soft hyphen in a German glossary entry in an LLM prompt doc.
Reasoning
Soft hyphen in German text within an LLM prompt documentation file. The text is a translation glossary, not a hidden instruction. Benign character artifact.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Starlette's Y: Starlettes Y
* X is case-sensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant in X
* X is case-insensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant in X
* standard Python: Standard-Python
likely benign
LLM, confidence 0.93
Soft hyphen in a German glossary entry in an LLM prompt doc.
Reasoning
Second soft hyphen in the same glossary line. Benign.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* X is case-sensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant in X
* X is case-insensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant in X
* standard Python: Standard-Python
* deprecated: deprecatet
likely benign
LLM, confidence 0.93
Soft hyphen in a German glossary line in an LLM prompt doc.
Reasoning
Soft hyphen in German glossary text. Benign hyphenation artifact.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* X is case-sensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant in X
* X is case-insensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant in X
* standard Python: Standard-Python
* deprecated: deprecatet
likely benign
LLM, confidence 0.93
Soft hyphen in a German glossary line in an LLM prompt doc.
Reasoning
Second soft hyphen in the same glossary line. Benign.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
English docs console example setting PowerShell env vars before running fastapi.
Reasoning
Same PowerShell environment variable console example as the German copy, in the English FastAPI docs. Benign documentation.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.97
Markdown docs example setting environment variables for a FastAPI app and launching it with uv.
Reasoning
This is a documentation code block in a FastAPI docs page showing PowerShell-style environment variable assignment ($Env:VAR = value) followed by a normal uv run command. The variable-as-command flag is a false positive from the bash-parsing of a PowerShell example; the snippet sets harmless example values and runs a standard app launcher.
-
file mixes tab and space indentation (6 tab-indented and 172 space-indented lines) (raw pass, confidence 0.40)
class Termynal {
-
line length 508 characters (raw pass, confidence 0.50)
* ✨ Allow setting the `response_class` to `RedirectResponse` or `FileResponse` and returning the URL from the function. New and updated docs are in the tutorial section **Custom Response - HTML, Stream, File, others**, in [RedirectResponse](https://fastapi.tiangolo.com/advanced/custom-response/#redirectresponse) and
-
identifier `с` contains homoglyph candidates: с (0441)→c (raw pass, confidence 0.70)
* 📝 Add link to article in Russian "FastAPI: знакомимся с фреймворком". PR [#2564](https://github.com/tiangolo/fastapi/pull/2564) by [@trkohler](https://github.com/trkohler).
likely benign
LLM, confidence 0.95
Russian prose in a changelog entry containing a Cyrillic letter.
Reasoning
Cyrillic с inside a Russian-language word in a prose sentence is natural text in a Russian article title, not an identifier used for deception.
-
line length 706 characters (raw pass, confidence 0.50)
-
line length 882 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
Documentation example JSON Web Token.
Reasoning
The blob is the standard jwt.io example JWT (header, payload with sub/name/iat, signature) used in FastAPI docs to illustrate token format; it is a public sample, not a payload.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
Docs showing PowerShell environment variable assignment before running fastapi.
Reasoning
This is PowerShell syntax for setting environment variables in a console example in documentation; the variable command name is normal for the PowerShell $Env: idiom and the example is harmless.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
Docs showing PowerShell environment variable assignment before running fastapi.
Reasoning
Same benign PowerShell environment variable example in documentation.
-
line length 750 characters (raw pass, confidence 0.50)
-
line length 921 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
Documentation example JSON Web Token.
Reasoning
Same public sample JWT used in FastAPI documentation, translated copy.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
Docs showing PowerShell environment variable assignment before running fastapi.
Reasoning
Benign PowerShell environment variable example in French docs.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
Docs showing PowerShell environment variable assignment before running fastapi.
Reasoning
Benign PowerShell environment variable example in French docs.
-
compression ratio 0.850 is >2σ above file mean 0.736 (raw pass, confidence 0.50)
Si vous exécutez votre conteneur derrière un proxy de terminaison TLS (load balancer) comme Nginx ou Traefik, ajoutez l'option `--proxy-headers`, cela indiquera à Uvicorn (via la CLI FastAPI) de faire confiance aux en-têtes envoyés par ce proxy lui indiquant que l'application s'exécute derrière HTTPS, etc.
-
line length 725 characters (raw pass, confidence 0.50)
-
line length 918 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
Documentation example JSON Web Token.
Reasoning
Same public sample JWT used in FastAPI documentation.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
Docs showing PowerShell environment variable assignment before running fastapi.
Reasoning
Benign PowerShell environment variable example in Hindi docs.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
Docs showing PowerShell environment variable assignment before running fastapi.
Reasoning
Benign PowerShell environment variable example in Hindi docs.
-
line length 674 characters (raw pass, confidence 0.50)
-
line length 871 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
Documentation example JSON Web Token.
Reasoning
Same public sample JWT used in FastAPI documentation.
-
identifier `時々いくつかランダムに見える変更を行うことがあります` mixes scripts: Han + Other + Hiragana + Katakana (raw pass, confidence 0.80)
�良であることを意味します（時々いくつかランダムに見える変更を行うことがあります。理由は [LLM は決定論的アルゴリズムではない](https://doublespeak.chat/#/handbook#deterministic-output) ためです）。
likely benign
LLM, confidence 0.93
Japanese prose sentence in a documentation translation test file.
Reasoning
Mixed Japanese scripts in ordinary prose text of a translation document; no identifier deception. The file name suggests an LLM test artifact, but the snippet is normal translated prose.
-
string literal compression ratio 0.962 (130 bytes) (raw pass, confidence 0.60)
* <abbr title="Mozilla Developer Network - Mozilla 開発者ネットワーク: 開発者向けドキュメント、Firefox の開発元が執筆">MDN</abbr>
* <abbr title="Input/Output - 入出力: ディスクの読み書き、ネットワーク通信。">I/O</abbr>.
likely benign
LLM, confidence 0.95
Markdown glossary entries with Japanese abbreviation descriptions.
Reasoning
High compression ratio on a short natural-language Japanese string literal in a markdown glossary is expected and not a sign of obfuscation.
-
identifier `リクエストごとやユーザーごとに別々のモデルを使うわけではありません` mixes scripts: Katakana + Hiragana + Han + Other (raw pass, confidence 0.80)
同じモデルをリクエスト間で共有するので、リクエストごとやユーザーごとに別々のモデルを使うわけではありません。
dismissed
LLM, confidence 0.97
A Japanese sentence in the FastAPI events documentation flagged for mixed scripts.
Reasoning
Japanese prose mixing Katakana, Hiragana and Han is normal orthography. The 'identifier' is just a sentence in a Markdown doc, so the mixed-script signal is a false positive.
-
identifier `共有するロジックや変数のない別々の関数でそれを行うのは難しく` mixes scripts: Han + Hiragana + Katakana + Other (raw pass, confidence 0.80)
共有するロジックや変数のない別々の関数でそれを行うのは難しく、グローバル変数などに値を保存する必要が出てきます。
そのため、現在は上で説明したとおり `lifespan` を使うことが推奨されています。
dismissed
LLM, confidence 0.97
A Japanese documentation sentence about shared state in lifespan handling, flagged for mixed scripts.
Reasoning
Ordinary Japanese prose in a documentation file. Mixed scripts are expected in Japanese text and there is no code or hidden content.
-
identifier `個々のリクエストと` mixes scripts: Han + Other + Hiragana + Katakana (raw pass, confidence 0.80)
- **トレース**: 個々のリクエストと、それを処理するために実行された操作の記録です。時間を計測する各操作を**スパン**と呼びます。
- **ログ**: アプリケーションの起動や操作の失敗など、イベントのタイムスタンプ付きの記録です。
dismissed
LLM, confidence 0.97
A Japanese bullet list item defining traces in the OpenTelemetry docs.
Reasoning
A Japanese bullet describing traces and logs. The mixed-script flag reflects normal Japanese text with Han, Hiragana and Katakana.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
A documented PowerShell example setting ADMIN_EMAIL and APP_NAME before running fastapi.
Reasoning
This is a PowerShell console transcript in a documentation code block showing how to set environment variables. The '$Env:' form is PowerShell's environment variable syntax, and the 'command name is a variable' message is a parser artifact of that shell syntax, not a dropper or hidden execution.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
A second documented PowerShell example in the settings docs, setting environment variables before running fastapi.
Reasoning
Same benign PowerShell console example from the settings docs, repeated at a different line. Setting environment variables then running a documented command is ordinary documentation.
-
identifier `時々カウンターの表示を見て` mixes scripts: Han + Other + Katakana + Hiragana (raw pass, confidence 0.80)
時々カウンターの表示を見て、自分の番号になっているか確認します。
やがてあなたの番になります。カウンターに行き、ハンバーガーを受け取り、テーブルに戻ります。
dismissed
LLM, confidence 0.97
A Japanese sentence in the async tutorial about waiting for a counter number.
Reasoning
Japanese narrative prose from the async tutorial analogy. Mixed scripts are normal in Japanese, so the raw-pass signal is a false positive.
-
identifier `家の別々のエリアを掃除できれば` mixes scripts: Han + Hiragana + Other + Katakana (raw pass, confidence 0.80)
しかしこの場合、8 人の元レジ係/料理人/現清掃員を連れてきて、それぞれ (あなたも加えて) 家の別々のエリアを掃除できれば、**並列** に作業でき、より早く終えられます。
dismissed
LLM, confidence 0.97
A Japanese sentence in the async tutorial about parallel cleaning of house areas.
Reasoning
Japanese prose in the async documentation analogy about cleaning areas of a house. No code or obfuscation is present.
-
identifier `我々は間違いを犯す` mixes scripts: Han + Other + Hiragana (raw pass, confidence 0.80)
### 我々は間違いを犯す { #we-make-mistakes }
私たち人間は常に**間違い**を犯します。ソフトウェアには、ほとんど常に**バグ**があらゆる箇所に隠されています。🐛
dismissed
LLM, confidence 0.97
A Japanese heading in the deployment concepts doc about humans making mistakes.
Reasoning
A Japanese heading and paragraph about human error and bugs. The mixed-script flag is an artifact of normal Japanese orthography.
-
identifier `他の人々のこれまでの働きがなければ存在しなかったでしょう` mixes scripts: Han + Hiragana + Other (raw pass, confidence 0.80)
**FastAPI**は、他の人々のこれまでの働きがなければ存在しなかったでしょう。
以前に作られた多くのツールが、作成における刺激として役立ってきました。
dismissed
LLM, confidence 0.97
A Japanese sentence in the history doc crediting earlier contributors.
Reasoning
Japanese prose in the history document acknowledging earlier work. Nothing suspicious is present.
-
identifier `を別々のモデルとして分けて使うことは可能です` mixes scripts: Hiragana + Han + Other + Katakana (raw pass, confidence 0.80)
...しかし、同じアプリ内で Pydantic v1 と v2 を別々のモデルとして分けて使うことは可能です。
```mermaid
dismissed
LLM, confidence 0.96
A Japanese sentence in the Pydantic migration guide about coexisting v1 and v2 models.
Reasoning
Japanese explanatory text about using Pydantic v1 and v2 models side by side, followed by a mermaid fence. The mixed-script flag is normal for Japanese text.
-
identifier `徐々に` mixes scripts: Han + Other + Hiragana (raw pass, confidence 0.80)
`bump-pydantic` が適用できない場合は、同一アプリで v1 と v2 のモデルを併用できるサポートを利用して、徐々に v2 へ移行できます。
dismissed
LLM, confidence 0.96
A Japanese sentence in the Pydantic migration guide about migrating gradually.
Reasoning
Japanese prose about gradual migration to Pydantic v2. The word '徐々に' (gradually) is ordinary text with no obfuscation.
-
string literal compression ratio 1.036 (140 bytes) (raw pass, confidence 0.70)
"_FastAPIライブラリを採用し、クエリで **予測値** を取得できる **REST** サーバを構築しました。 [for Ludwig]_"
dismissed
LLM, confidence 0.90
A Japanese quoted caption in the index docs describing a REST server built with FastAPI, flagged for high string complexity.
Reasoning
A short Japanese caption string of about 140 bytes. A compression ratio near 1.0 is what natural-language text compressed with a generic algorithm looks like at this length, and the content is a plain documentation caption with no code or encoded payload.
-
identifier `様々な階層` mixes scripts: Han + Other + Hiragana (raw pass, confidence 0.80)
`BackgroundTasks` の使用は依存性注入システムでも機能し、様々な階層 (*path operation function*、依存性 (dependable)、サブ依存性など) で `BackgroundTasks` 型のパラメーターを宣言できます。
dismissed
LLM, confidence 0.95
Japanese prose phrase '様々な階層' in the FastAPI background tasks tutorial.
Reasoning
Mixed Han and Hiragana in ordinary Japanese prose is normal. The raw-pass script heuristic misfires on natural-language text in a documentation file.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
**FastAPI** は、それぞれの場合の処理⟨U+200B⟩⟨U+200B⟩方法と同じオブジェクトの再利用方法を知っているため、すべてのバックグラウンドタスクがマージされ、バックグラウンドで後で実行されます:
likely benign
LLM, confidence 0.75
A zero-width space inside a Japanese sentence in the background tasks tutorial.
Reasoning
A zero-width space inside Japanese prose is a common translation or copy-paste artifact. It has no code effect here, but invisible characters in docs are worth a cleanup rather than a security concern.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
**FastAPI** は、それぞれの場合の処理⟨U+200B⟩⟨U+200B⟩方法と同じオブジェクトの再利用方法を知っているため、すべてのバックグラウンドタスクがマージされ、バックグラウンドで後で実行されます:
likely benign
LLM, confidence 0.75
A second zero-width space in the same Japanese sentence about merged background tasks.
Reasoning
Same sentence as the previous finding, with a second zero-width space in the same word. This is a translation artifact in prose, not an executable payload.
-
identifier `個々の` mixes scripts: Han + Other + Hiragana (raw pass, confidence 0.80)
`APIRouter` に `dependencies` を置くことで、*path operations* のグループ全体に認証を要求する、といった用途に使えます。個々の *path operation* に依存関係を追加していなくても構いません。
///
dismissed
LLM, confidence 0.95
Japanese sentence about APIRouter dependencies in the bigger applications tutorial.
Reasoning
Standard Japanese prose mixing Han and Hiragana, with an ordinary 'path operation' term. This is a false positive from the raw script check.
-
line length 509 characters (raw pass, confidence 0.50)
-
line length 720 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
dismissed
LLM, confidence 0.95
Documented example JWT in the OAuth2/JWT tutorial.
Reasoning
This is the widely published jwt.io example token, with a header, payload and signature shown in documentation. It is not a live secret or a payload.
-
identifier `同じデータベースを使用してDjangoアプリケーションを徐々に移行することもできます` mixes scripts: Han + Hiragana + Katakana + Latin + Other (raw pass, confidence 0.80)
例えば、Djangoアプリケーションからデータベース内の同じデータをFastAPIアプリケーションと共有できるだけではなく、同じデータベースを使用してDjangoアプリケーションを徐々に移行することもできます。
dismissed
LLM, confidence 0.95
Japanese sentence about migrating from Django in the OAuth2/JWT tutorial.
Reasoning
Japanese prose with mixed scripts, including Latin 'Django' and 'FastAPI'. Ordinary documentation text.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
dismissed
LLM, confidence 0.90
Documented PowerShell environment variable setup in the Korean settings guide.
Reasoning
This is a PowerShell-style '$Env:' assignment in a console example for setting environment variables before running fastapi. It is a documentation illustration, not an attack. The variable-command flag is a generic AST heuristic.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
dismissed
LLM, confidence 0.90
Second PowerShell environment-variable example in the Korean settings guide.
Reasoning
Same PowerShell environment-variable example as the previous finding, repeated in a second block. Benign documentation.
-
string literal compression ratio 0.992 (128 bytes) (raw pass, confidence 0.70)
* 100% <dfn title="Python 타입 어노테이션으로, 이를 통해 편집기와 외부 도구가 더 나은 지원을 제공할 수 있습니다">타입 어노테이션</dfn> 코드 베이스.
* 프로덕션 애플리케이션에서 사용됩니다.
dismissed
LLM, confidence 0.90
Korean feature-list prose with an HTML definition tag.
Reasoning
The high compression ratio is expected for Korean UTF-8 prose, which does not compress well. The text is an HTML-wrapped feature description, not an encoded payload.
-
string literal compression ratio 0.957 (162 bytes) (raw pass, confidence 0.60)
"_**FastAPI** 라이브러리를 채택하여 **예측**을 얻기 위해 쿼리를 실행할 수 있는 **REST** 서버를 생성했습니다. [Ludwig을 위해]_"
dismissed
LLM, confidence 0.92
Korean testimonial quote on the FastAPI home page.
Reasoning
A Korean testimonial quote. The compression metric reflects normal CJK text, and the content has no executable component.
-
string literal compression ratio 0.956 (183 bytes) (raw pass, confidence 0.60)
"_**Netflix**는 우리의 **위기 관리** 오케스트레이션 프레임워크인 **Dispatch**의 오픈 소스 공개를 발표하게 되어 기쁩니다! [**FastAPI**로 빌드]_"
dismissed
LLM, confidence 0.92
Second Korean testimonial quote on the FastAPI home page.
Reasoning
A Korean testimonial quote about the Dispatch project. Normal prose with a high compression ratio for the script.
-
line length 514 characters (raw pass, confidence 0.50)
-
line length 719 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
dismissed
LLM, confidence 0.95
Documented example JWT in the Korean OAuth2/JWT tutorial.
Reasoning
The same well-known jwt.io example token as in the Japanese copy of this tutorial, shown as documentation.
-
identifier `azərbaycan` mixes scripts: Latin + Other (raw pass, confidence 0.80)
ay: aymar aru
az: azərbaycan dili
ba: башҡорт теле
be: беларуская мова
dismissed
LLM, confidence 0.95
Azerbaijani language name 'azərbaycan dili' in a locale mapping file.
Reasoning
The Azerbaijani language name uses the legitimate schwa letter 'ə', a Latin letter with a non-ASCII diacritic form. This is a language-name table, not an identifier obfuscation.
-
identifier `Eʋegbe` mixes scripts: Latin + Other (raw pass, confidence 0.80)
dz: རྫོང་ཁ
ee: Eʋegbe
el: Ελληνικά
en: English
likely benign
LLM, confidence 0.93
Ewe language name 'Eʋegbe' in a multilingual name list.
Reasoning
The identifier is the native name of the Ewe language, and the 'ʋ' is a standard IPA letter used in Ewe orthography. Mixed Latin and Other script is expected for a language-name table.
-
identifier `æвзаг` contains homoglyph candidates: а (0430)→a (raw pass, confidence 0.70)
or: ଓଡ଼ିଆ
os: ирон æвзаг
pa: ਪੰਜਾਬੀ
pi: पाऴि
likely benign
LLM, confidence 0.93
Ossetian language name written in Cyrillic with a Latin 'æ'.
Reasoning
The line is the Ossetian language name 'ирон æвзаг', where Cyrillic is the standard script and 'æ' is a legitimate Latin letter in Ossetian orthography. The homoglyph flag is a false positive on a natively written language name in a data file.
-
identifier `æвзаг` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)
or: ଓଡ଼ିଆ
os: ирон æвзаг
pa: ਪੰਜਾਬੀ
pi: पाऴि
likely benign
LLM, confidence 0.93
Same Ossetian language name flagged for mixed Latin and Cyrillic scripts.
Reasoning
This is the same line as the homoglyph finding. The mixed-script signal reflects the legitimate Ossetian name, which combines Cyrillic with the Latin-script letter æ.
-
identifier `Saɯ` mixes scripts: Latin + Other (raw pass, confidence 0.80)
yo: Yorùbá
za: Saɯ cueŋƅ
zh: 简体中文
zh-hant: 繁體中文
likely benign
LLM, confidence 0.92
Zhuang language name written with Latin-orthography IPA letters.
Reasoning
'Saɯ cueŋƅ' is the Zhuang language name in its Latin-based orthography, which uses IPA-style letters such as ɯ, ŋ and ƅ. This is expected in a language-name table.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Docs example setting PowerShell environment variables before running a FastAPI app.
Reasoning
This is a documentation console example showing PowerShell environment variable assignment ($Env:VAR = ...) followed by a normal fastapi command. The variable command name is a doc-rendering artifact of PowerShell syntax, not a dropper or attacker-controlled execution.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Same PowerShell environment-variable setup example in the settings docs.
Reasoning
This is the same PowerShell environment-variable example as the preceding finding, showing the same benign setup and run commands in a console code block.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
o tem suas próprias coisas, variáveis ⟨U+200B⟩⟨U+200B⟩e memória. E se você estiver consumindo uma grande quantidade de memória em seu código, **cada processo** consumirá uma quantidade equivalente de memória.
likely benign
LLM, confidence 0.85
Stray zero-width space in Portuguese deployment documentation prose.
Reasoning
A zero-width space sits between a word and a following character in Portuguese prose ('variáveis ⟨U+200B⟩⟨U+200B⟩e'). This is a common copy-paste or translation-tooling artifact and carries no hidden payload.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
em suas próprias coisas, variáveis ⟨U+200B⟩⟨U+200B⟩e memória. E se você estiver consumindo uma grande quantidade de memória em seu código, **cada processo** consumirá uma quantidade equivalente de memória.
likely benign
LLM, confidence 0.85
Second stray zero-width space in the same Portuguese paragraph.
Reasoning
Another stray zero-width space in the same Portuguese paragraph. It matches a copy-paste artifact pattern and does not hide executable content.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Esses processos de trabalho seriam aqueles que executariam sua aplicação, eles executariam os cálculos principais para receber uma **request** e retornar uma **resposta**, e carregariam qualquer coisa que você colocasse em variáveis ⟨U+200B⟩⟨U+200B⟩na RAM.
<img src="/img/deployment/concepts/process-ram.drawio.svg">
likely benign
LLM, confidence 0.85
Stray zero-width space in a Portuguese deployment doc near an image tag.
Reasoning
A zero-width space appears in Portuguese prose ('variáveis ⟨U+200B⟩⟨U+200B⟩na RAM') next to a normal image reference. Its placement fits a stray editing artifact, not steganography or a concealed instruction.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Esses processos de trabalho seriam aqueles que executariam sua aplicação, eles executariam os cálculos principais para receber uma **request** e retornar uma **resposta**, e carregariam qualquer coisa que você colocasse em variáveis ⟨U+200B⟩⟨U+200B⟩na RAM.
<img src="/img/deployment/concepts/process-ram.drawio.svg">
likely benign
LLM, confidence 0.85
Another stray zero-width space in the same Portuguese deployment passage.
Reasoning
This is another zero-width space in the same Portuguese passage, consistent with a copy-paste artifact in the translation.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Para alterar as URLs usadas ⟨U+200B⟩⟨U+200B⟩para as interfaces de usuário da documentação gerada automaticamente, leia a documentação de [Tutorial - Metadados e URLs da Documentação](../tutorial/metadata.md#docs-urls).
likely benign
LLM, confidence 0.85
Stray zero-width space in a Portuguese how-to document.
Reasoning
A zero-width space appears before 'Para alterar as URLs usadas ⟨U+200B⟩⟨U+200B⟩para' in Portuguese prose, typical of translation or copy-paste residue. It does not affect rendered meaning or carry code.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Para alterar as URLs usadas ⟨U+200B⟩⟨U+200B⟩para as interfaces de usuário da documentação gerada automaticamente, leia a documentação de [Tutorial - Metadados e URLs da Documentação](../tutorial/metadata.md#docs-urls).
likely benign
LLM, confidence 0.85
Second stray zero-width space in the same Portuguese how-to sentence.
Reasoning
A second zero-width space in the same Portuguese sentence, matching the same benign copy-paste artifact pattern.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Mas isso só permitirá certos tipos de comunicação, excluindo tudo que envolva credenciais: cookies, cabeçalhos de autorização como aqueles usados ⟨U+200B⟩⟨U+200B⟩com Bearer Tokens, etc.
Então, para que tudo funcione corretamente, é melhor especificar explicitamente as origens permitidas.
likely benign
LLM, confidence 0.85
Stray zero-width space in a Portuguese CORS tutorial paragraph.
Reasoning
A zero-width space appears in Portuguese CORS tutorial prose ('usados ⟨U+200B⟩⟨U+200B⟩com Bearer Tokens'). It is a translation or copy-paste artifact with no executable or hidden instruction content.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Mas isso só permitirá certos tipos de comunicação, excluindo tudo que envolva credenciais: cookies, cabeçalhos de autorização como aqueles usados ⟨U+200B⟩⟨U+200B⟩com Bearer Tokens, etc.
Então, para que tudo funcione corretamente, é melhor especificar explicitamente as origens permitidas.
likely benign
LLM, confidence 0.85
Second stray zero-width space in the same Portuguese CORS paragraph.
Reasoning
Another zero-width space in the same CORS tutorial paragraph, consistent with benign editing residue.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Os parâmetros padrão usados ⟨U+200B⟩⟨U+200B⟩pela implementação `CORSMiddleware` são restritivos por padrão, então você precisará habilitar explicitamente as origens, métodos ou cabeçalhos específicos para que os navegadores tenham permissão para usá-los em um contexto cross domain.
likely benign
LLM, confidence 0.97
A zero-width space appears in a Portuguese tutorial sentence about CORSMiddleware defaults.
Reasoning
Zero-width space inside Portuguese prose before 'usados'; typographic artifact from translation, no code execution or hidden payload.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Os parâmetros padrão usados ⟨U+200B⟩⟨U+200B⟩pela implementação `CORSMiddleware` são restritivos por padrão, então você precisará habilitar explicitamente as origens, métodos ou cabeçalhos específicos para que os navegadores tenham permissão para usá-los em um contexto cross domain.
likely benign
LLM, confidence 0.97
Another zero-width space in the same CORS documentation sentence.
Reasoning
Second zero-width space in the same sentence, consistent with copy-paste or translation tooling artifacts in docs prose.
-
line length 710 characters (raw pass, confidence 0.50)
-
line length 897 characters (raw pass, confidence 0.50)
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
E ambos os modelos serão usados ⟨U+200B⟩⟨U+200B⟩para a documentação interativa da API:
<img src="/img/tutorial/response-model/image02.png">
likely benign
LLM, confidence 0.97
Zero-width space in a Portuguese response-model tutorial sentence.
Reasoning
Zero-width space in Portuguese documentation prose before 'serão'; no functional or hidden content.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
E ambos os modelos serão usados ⟨U+200B⟩⟨U+200B⟩para a documentação interativa da API:
<img src="/img/tutorial/response-model/image02.png">
likely benign
LLM, confidence 0.97
Another zero-width space in the same response-model sentence.
Reasoning
Second zero-width space in the same docs sentence; benign typographic artifact.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
E as ferramentas também ficarão felizes porque `RedirectResponse` e ⟨U+200B⟩⟨U+200B⟩`JSONResponse` são subclasses de `Response`, então a anotação de tipo está correta.
### Anote uma subclasse de Response { #annotate-a-response-subclass }
likely benign
LLM, confidence 0.96
Zero-width space before a JSONResponse mention in Portuguese docs.
Reasoning
Zero-width space in translated prose around RedirectResponse; no code effect in documentation.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
E as ferramentas também ficarão felizes porque `RedirectResponse` e ⟨U+200B⟩⟨U+200B⟩`JSONResponse` são subclasses de `Response`, então a anotação de tipo está correta.
### Anote uma subclasse de Response { #annotate-a-response-subclass }
likely benign
LLM, confidence 0.96
Second zero-width space in the same Portuguese docs paragraph.
Reasoning
Same benign zero-width space artifact in the same paragraph.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
...isso falha porque a anotação de tipo não é um tipo Pydantic e não é apenas uma única classe ou subclasse `Response`, é uma união (qualquer uma das duas) entre um `Response` e ⟨U+200B⟩⟨U+200B⟩um `dict`.
### Desative o modelo de resposta { #disable-response-model }
likely benign
LLM, confidence 0.96
Zero-width space in Portuguese prose about response model type annotations.
Reasoning
Zero-width space in documentation prose describing a union annotation; harmless.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
...isso falha porque a anotação de tipo não é um tipo Pydantic e não é apenas uma única classe ou subclasse `Response`, é uma união (qualquer uma das duas) entre um `Response` e ⟨U+200B⟩⟨U+200B⟩um `dict`.
### Desative o modelo de resposta { #disable-response-model }
likely benign
LLM, confidence 0.96
Another zero-width space in the same response-model prose.
Reasoning
Second zero-width space in the same sentence; benign.
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
A sample JWT token used as an example in the OAuth2 JWT tutorial.
Reasoning
The blob is the canonical JWT example from jwt.io (header, payload with 'John Doe', signature), shown as an illustrative token in a markdown tutorial; not a payload.
-
identifier `Pythonу` contains homoglyph candidates: у (0443)→y (raw pass, confidence 0.70)
Pythonу придётся сравнить весь общий префикс `stanleyjobso` в `stanleyjobsox` и `stanleyjobson`, прежде чем понять, что строки отличаются. Поэтому на ответ «Неверное имя пользователя или пароль» уйдё
likely benign
LLM, confidence 0.90
Russian docs sentence where the word Python ends in a Cyrillic letter that looks like y.
Reasoning
The word 'Pythonу' ends with Cyrillic у which is a homoglyph of y; this is a Russian translation typo or mixed-script artifact in prose, not an identifier used in code, so no deceptive effect.
-
identifier `Pythonу` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)
Pythonу придётся сравнить весь общий префикс `stanleyjobso` в `stanleyjobsox` и `stanleyjobson`, прежде чем понять, что строки отличаются. Поэтому на ответ «Неверное имя пользователя или пароль» уйдё
likely benign
LLM, confidence 0.85
Mixed Latin and Cyrillic script within the word Pythonу in Russian docs.
Reasoning
Same word mixing Latin and Cyrillic in Russian prose; a benign typing artifact in documentation, though it is the same word flagged for homoglyphs.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
PowerShell environment variable assignment shown in a console example in the settings docs.
Reasoning
Console transcript in docs where $Env: is PowerShell syntax for setting environment variables, shown as an example command; the variable is a documented shell prompt construct, not attacker-controlled execution.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
dismissed
LLM, confidence 0.93
Documentation example setting PowerShell environment variables before running a FastAPI app.
Reasoning
This is a PowerShell example in a documentation tutorial that sets environment variables before running a FastAPI app. The `$Env:` prefix is ordinary PowerShell syntax for setting env vars, and the markdown document shows a user what to type. No payload or hidden execution is present.
-
line length 666 characters (raw pass, confidence 0.50)
-
line length 890 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
dismissed
LLM, confidence 0.97
Well-known example JWT string in a Russian OAuth2 tutorial.
Reasoning
The blob is the standard JWT example from the jwt.io documentation (header, payload with sub 1234567890 and name John Doe, and a signature). It is a public illustrative token in a tutorial, not an encoded payload.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
dismissed
LLM, confidence 0.93
Turkish docs console block setting PowerShell environment variables for a FastAPI app.
Reasoning
This is a console code block in a documentation page that sets PowerShell environment variables and runs a FastAPI app. It is a normal tutorial command with no hidden or malicious behavior.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
dismissed
LLM, confidence 0.93
Turkish docs example setting PowerShell environment variables before running a FastAPI app.
Reasoning
The same benign PowerShell environment-variable example as the other translations, shown as instructions to the reader in documentation.
-
line length 654 characters (raw pass, confidence 0.50)
-
line length 899 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
dismissed
LLM, confidence 0.97
Well-known example JWT string in a Turkish OAuth2 tutorial.
Reasoning
This is the standard public jwt.io example JWT, used as an illustration in a tutorial. It is not an encoded dropper or hidden payload.
-
identifier `необовʼязковою` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Властивість `servers` у специфікації OpenAPI є необовʼязковою.
dismissed
LLM, confidence 0.90
Ukrainian prose word containing a modifier-letter apostrophe that triggers a mixed-script flag.
Reasoning
The flagged word is Ukrainian 'необовʼязковою', which uses U+02BC MODIFIER LETTER APOSTROPHE as the standard Ukrainian apostrophe. The apostrophe is classified as a different script, so the mixed-script alarm is a false positive from ordinary Ukrainian orthography.
-
identifier `обʼєкті` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Потім ви можете встановлювати заголовки в цьому *тимчасовому* обʼєкті відповіді.
{* ../../docs_src/response_headers/tutorial002_py310.py hl[1, 7:8] *}
dismissed
LLM, confidence 0.90
Ukrainian prose word with a modifier-letter apostrophe flagged as mixed script.
Reasoning
The flagged word 'обʼєкті' is correct Ukrainian with the standard U+02BC apostrophe. The mixed-script flag comes from that punctuation character, not from homoglyph spoofing.
-
identifier `обʼєкт` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Далі ви можете повернути будь-який потрібний обʼєкт, як зазвичай (наприклад, `dict`, модель бази даних тощо).
dismissed
LLM, confidence 0.90
Ukrainian prose word with a modifier-letter apostrophe flagged as mixed script.
Reasoning
'обʼєкт' is ordinary Ukrainian spelling using U+02BC. There is no identifier-level obfuscation or spoofing in documentation prose.
-
identifier `обʼєкта` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Якщо ви оголосили `response_model`, його все одно буде використано для фільтрації та перетворення поверненого обʼєкта.
dismissed
LLM, confidence 0.90
Ukrainian prose word in genitive form with a modifier-letter apostrophe flagged as mixed script.
Reasoning
'обʼєкта' is the genitive form of the same Ukrainian word and uses the legitimate apostrophe character. The finding is a false positive from orthography.
-
identifier `обʼєкт` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
�стає цей *тимчасовий* обʼєкт відповіді, щоб витягти заголовки (а також кукі та код статусу) і помістить їх у кінцеву відповідь, яка міститиме повернуте вами значення, відфіль… (340 bytes total)
dismissed
LLM, confidence 0.90
Ukrainian documentation prose flagged for a modifier-letter apostrophe.
Reasoning
The snippet is Ukrainian documentation prose with the standard apostrophe in 'обʼєкт'. The mixed-script detection is triggered by orthography, not malicious character substitution.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
dismissed
LLM, confidence 0.93
Ukrainian docs console block setting PowerShell environment variables for a FastAPI app.
Reasoning
This is the same benign PowerShell environment-variable console example in Ukrainian documentation. It shows users how to configure env vars before running the app.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
dismissed
LLM, confidence 0.93
Ukrainian docs example setting PowerShell environment variables before running a FastAPI app.
Reasoning
The same benign PowerShell environment-variable example as the other settings.md findings, presented as a tutorial command.
-
identifier `необовʼязковий` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* _Шлях_ `/items/{item_id}` містить _параметр шляху_ `item_id`, який має бути типу `int`.
* _Шлях_ `/items/{item_id}` містить необовʼязковий `str` _параметр запиту_ `q`.
dismissed
LLM, confidence 0.90
Ukrainian documentation word containing a modifier-letter apostrophe flagged as mixed script.
Reasoning
'необовʼязковий' is Ukrainian for 'optional' and uses the standard U+02BC apostrophe. The flag comes from orthography, and the surrounding text is ordinary FastAPI documentation.
-
identifier `обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Автоматичні та зрозумілі помилки, коли дані некоректні.
* Валідацію навіть для глибоко вкладених JSON-обʼєктів.
dismissed
LLM, confidence 0.93
Ukrainian prose in the FastAPI docs using the standard apostrophe character in the word 'обʼєктів'.
Reasoning
The flagged token uses U+02BC (modifier letter apostrophe), which is standard Ukrainian orthography inside words like обʼєктів. It is ordinary prose in a markdown doc, and the raw-pass mixed-script heuristic misreads the apostrophe as a foreign script.
-
identifier `Обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Перетворення типів Python (`str`, `int`, `float`, `bool`, `list`, тощо).
* Обʼєктів `datetime`.
* Обʼєктів `UUID`.
* Моделей бази даних.
dismissed
LLM, confidence 0.93
Ukrainian docs bullet using 'Обʼєктів' with the standard apostrophe.
Reasoning
Same Ukrainian apostrophe (U+02BC) orthography in a capitalized word within a bullet list of documentation text. No code or obfuscation is present.
-
identifier `Обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Обʼєктів `datetime`.
* Обʼєктів `UUID`.
* Моделей бази даних.
* ...та багато іншого.
dismissed
LLM, confidence 0.93
Ukrainian docs bullet with 'Обʼєктів' using U+02BC apostrophe.
Reasoning
Same Ukrainian apostrophe orthography in a plain documentation list. The mixed-script flag is a false positive from a legitimate letter.
-
identifier `обовʼязковий` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Перевірить, що є обовʼязковий атрибут `name`, який має бути типу `str`.
* Перевірить, що є обовʼязковий атрибут `price`, який має бути типу `float`.
dismissed
LLM, confidence 0.93
Ukrainian documentation text containing 'обовʼязковий' (mandatory).
Reasoning
'обовʼязковий' is correct Ukrainian spelling with the modifier apostrophe. It appears in normal prose in a markdown documentation file.
-
identifier `обовʼязковий` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Перевірить, що є обовʼязковий атрибут `price`, який має бути типу `float`.
* Перевірить, що є необовʼязковий атрибут `is_offer`, який має бути типу `bool`, якщо він присутній.
dismissed
LLM, confidence 0.93
Ukrainian docs line with 'обовʼязковий' using the modifier apostrophe.
Reasoning
Same standard Ukrainian apostrophe usage in ordinary documentation prose. Not an identifier in code and not obfuscation.
-
identifier `необовʼязковий` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Перевірить, що є необовʼязковий атрибут `is_offer`, який має бути типу `bool`, якщо він присутній.
* Усе це також працюватиме для глибоко вкладених JSON-обʼєктів.
dismissed
LLM, confidence 0.93
Ukrainian docs text with 'необовʼязковий' (optional).
Reasoning
'необовʼязковий' is a normal Ukrainian word with the standard apostrophe. The finding is a raw-pass false positive on prose.
-
identifier `обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Усе це також працюватиме для глибоко вкладених JSON-обʼєктів.
* Автоматично перетворюватиме з та в JSON.
* Документуватиме все за допомогою OpenAPI, який може бути використано в:
dismissed
LLM, confidence 0.93
Ukrainian docs sentence containing 'обʼєктів' after JSON.
Reasoning
Ukrainian prose 'JSON-обʼєктів' with the standard modifier apostrophe. Legitimate language orthography in a documentation file.
-
identifier `необовʼязково` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
### Розгортання застосунку (необовʼязково) { #deploy-your-app-optional }
За бажання ви можете розгорнути ваш застосунок FastAPI у [FastAPI Cloud](https://fastapicloud.com) однією командою. 🚀
dismissed
LLM, confidence 0.93
Ukrainian heading 'Розгортання застосунку (необовʼязково)' in the docs.
Reasoning
'необовʼязково' is correct Ukrainian with the apostrophe in a heading and prose. The mixed-script signal is a false positive.
-
identifier `необовʼязкових` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Коли ви встановлюєте FastAPI за допомогою `uv add "fastapi[standard]"`, ви отримуєте групу необовʼязкових залежностей `standard`:
Використовується Pydantic:
dismissed
LLM, confidence 0.93
Ukrainian docs sentence about optional dependencies using 'необовʼязкових'.
Reasoning
'необовʼязкових' is standard Ukrainian orthography in documentation prose about optional dependencies. No code-level obfuscation.
-
identifier `необовʼязкові` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Якщо ви не хочете включати необовʼязкові залежності `standard`, ви можете встановити через `uv add fastapi` замість `uv add "fastapi[standard]"`.
### Без `fastapi-cloud-cli` { #without-fastapi-cloud-cli }
dismissed
LLM, confidence 0.93
Ukrainian docs text with 'необовʼязкові' near a fastapi install example.
Reasoning
Standard Ukrainian apostrophe usage in documentation prose describing optional standard dependencies.
-
line length 717 characters (raw pass, confidence 0.50)
-
line length 857 characters (raw pass, confidence 0.50)
-
string literal compression ratio 0.993 (153 bytes) (raw pass, confidence 0.70)
你的 API 現在也能掌控自己的 <dfn title="這只是個玩笑，提醒一下。這與 Cookie 同意無關，但有趣的是連 API 現在也能拒絕可憐的 Cookie。請收下這塊餅乾。🍪">Cookie 同意</dfn>。🤪🍪
你可以使用 Pydantic 的模型設定來 `forbid` 任何 `extra` 欄位：
dismissed
LLM, confidence 0.93
A joking tooltip in Chinese FastAPI tutorial docs about cookie consent and an emoji cookie.
Reasoning
The flagged string is a humorous Traditional Chinese documentation aside, a title attribute joking about cookie consent with emoji. The high compression ratio comes from repetitive emoji and playful text, not from any hidden payload. It sits in a markdown docs file, so it is a false positive from the raw pass.
-
line length 655 characters (raw pass, confidence 0.50)
-
string literal compression ratio 0.987 (153 bytes) (raw pass, confidence 0.70)
你的 API 现在可以控制自己的 <dfn title="只是个玩笑，别当真。和 cookie 同意无关，不过连 API 现在都能拒绝可怜的 cookie，挺好玩的。来，吃块小饼干吧。🍪">cookie 同意</dfn>。🤪🍪
dismissed
LLM, confidence 0.90
Chinese tutorial markdown with an abbr/dfn title attribute containing a joke about cookie consent.
Reasoning
The flagged 'high-complexity' signal is a compression ratio on a Chinese prose HTML title attribute containing a joke about cookie consent and emoji. Short natural-language text compresses poorly, and it is a markdown doc with no executable code. The critical severity is an overreaction.
-
line length 665 characters (raw pass, confidence 0.50)
-
string literal compression ratio 1.032 (154 bytes) (raw pass, confidence 0.70)
库类库（在某些情况下称为 <abbr title="Object Relational Mapper - 对象关系映射器: 一个花哨的术语，指一种库，其中某些类表示 SQL 表，而实例表示这些表中的行">"ORMs"</abbr>），FastAPI 不会强迫你使用任何东西。😎
dismissed
LLM, confidence 0.90
Chinese SQL tutorial markdown with an abbr title defining ORM in prose.
Reasoning
The flagged text is a Chinese prose explanation of ORMs inside an abbr title attribute. Its compression ratio is high only because of the short mixed-script content, so it is a false positive on documentation.
-
`__import__` called on a non-literal expression (ast pass, confidence 0.70)
try:
Color = __import__(module_path, fromlist=["Color"]).Color
except ImportError: pytest.skip(f"{module_path} not available")
likely benign
LLM, confidence 0.90
A test helper dynamically imports a Color class from a parameterized module path, skipping if unavailable.
Reasoning
This is a test-suite pattern that imports an optional module path (likely a Color type from a compatibility module) and skips the test on ImportError. The module path is a test-controlled variable, not attacker input, and the import is confined to a pytest test. It is a common way to exercise optional dependencies and carries no sign of malicious intent.
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
disclude.io