Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
identifier `необовʼязкові` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
### Додаткові необовʼязкові залежності { #additional-optional-dependencies }
Є ще деякі додаткові залежності, які ви можете захотіти встановити.
-
identifier `необовʼязкові` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Додаткові необовʼязкові залежності Pydantic:
* [`pydantic-settings`](https://pydantic.dev/docs/validation/latest/concepts/pydantic_settings/) - для керування налаштуваннями.
-
identifier `необовʼязкові` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Додаткові необовʼязкові залежності FastAPI:
* [`orjson`](https://github.com/ijl/orjson) - потрібно, якщо ви хочете використовувати `ORJSONResponse`.
-
identifier `імʼям` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Скажімо, у вас є клас `Person` з імʼям:
{* ../../docs_src/python_types/tutorial010_py310.py hl[1:3] *}
-
identifier `прикладi` contains homoglyph candidates: р (0440)→p, а (0430)→a (raw pass, confidence 0.70)
У попередньому прикладi *операції шляху* очікували б JSON-тіло з атрибутами `Item`, наприклад:
```JSON
-
identifier `прикладi` mixes scripts: Cyrillic + Latin (raw pass, confidence 0.80)
У попередньому прикладi *операції шляху* очікували б JSON-тіло з атрибутами `Item`, наприклад:
```JSON
-
identifier `сирa` contains homoglyph candidates: с (0441)→c, р (0440)→p (raw pass, confidence 0.70)
Якщо вас цікавить, як виглядає «сирa» схема OpenAPI, FastAPI автоматично генерує JSON (схему) з описами всього вашого API.
-
identifier `сирa` mixes scripts: Cyrillic + Latin (raw pass, confidence 0.80)
Якщо вас цікавить, як виглядає «сирa» схема OpenAPI, FastAPI автоматично генерує JSON (схему) з описами всього вашого API.
-
identifier `обʼєкт` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Ви також можете передати шлях до файлу в команду `fastapi dev`, і вона вгадає обʼєкт FastAPI app, який слід використовувати:
```console
-
identifier `памʼятати` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Але вам доведеться щоразу памʼятати передавати правильний шлях\entrypoint під час виклику команди `fastapi`.
-
identifier `необовʼязково` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
### Розгорніть ваш застосунок (необовʼязково) { #deploy-your-app-optional }
За бажанням ви можете розгорнути ваш FastAPI-застосунок у [FastAPI Cloud](https://fastapicloud.com) однією командою. 🚀
-
identifier `Підібʼємо` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
## Підібʼємо підсумки, крок за кроком { #recap-step-by-step }
### Крок 1: імпортуємо `FastAPI` { #step-1-import-fastapi }
-
identifier `навʼязує` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
**FastAPI** не навʼязує жодного конкретного значення.
Наведена тут інформація подана як настанова, а не вимога.
-
identifier `обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Існує багато інших обʼєктів і моделей, які будуть автоматично конвертовані в JSON (зокрема ORM тощо). Спробуйте використати свої улюблені - велика ймовірність, що вони вже підтрим
-
identifier `Підібʼємо` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
## Підібʼємо підсумки { #recap }
* Імпортуйте `FastAPI`.
-
identifier `розвʼязати` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Існувала також специфікація «OpenID». Вона намагалася розвʼязати те саме, що й **OpenID Connect**, але не базувалась на OAuth2.
Тож це була повністю додаткова система.
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
-
string literal compression ratio 0.962 (132 bytes) (raw pass, confidence 0.60)
* <dfn title="被設定為連接並以某種方式一起工作的機器群組。">叢集</dfn>
* <dfn title="一種機器學習方法，使用具備多個隱藏層的人工神經網路，在輸入與輸出層之間建立完整的內部結構">深度學習</dfn>
## 標題 { #headings }
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
-
string literal compression ratio 0.975 (161 bytes) (raw pass, confidence 0.60)
QL 資料庫函式庫（有時稱為 <abbr title="Object Relational Mapper - 物件關聯對應器：一個用來描述某些類別代表 SQL 資料表且其實例代表資料表中資料列的函式庫的術語">"ORMs"</abbr>），FastAPI 不會強迫你使用特定工具。😎
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
-
file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
if "gzip" in self.headers.getlist("Content-Encoding"):
body = gzip.decompress(body)
self._body = body
return self._body
-
file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
if "gzip" in self.headers.getlist("Content-Encoding"):
body = gzip.decompress(body)
self._body = body
return self._body
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Default
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant
likely benign
LLM, confidence 0.90
A soft hyphen inside the German word Groß-/Kleinschreibung in a docs test file.
Reasoning
Soft hyphens inside German words in a markdown doc; typical of copy-paste or hyphenation artifacts, not a hiding technique. Plain-text documentation has no execution path.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Default
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant
likely benign
LLM, confidence 0.90
Another soft hyphen in the German word Schreibung in the same docs line.
Reasoning
Second soft hyphen in the same benign German documentation line; same copy-paste or hyphenation artifact.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant
* die Anwendung bereitstellen
likely benign
LLM, confidence 0.90
Soft hyphen in a German documentation bullet about case sensitivity.
Reasoning
Same pattern of soft hyphens in German prose in a documentation file; no concealment of instructions evident.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant
* Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant
* die Anwendung bereitstellen
likely benign
LLM, confidence 0.90
Second soft hyphen in the same German documentation bullet.
Reasoning
Same benign soft-hyphen artifact in German prose.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Documentation console example setting environment variables for a FastAPI app in PowerShell syntax.
Reasoning
This is a PowerShell-style environment variable assignment shown in a console example in the FastAPI settings docs. The command is illustrative documentation, not an executed payload; the variable-command flag is a generic artifact of the embedded-bash parser on PowerShell syntax.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
Second line of the same documentation console example setting APP_NAME and running fastapi.
Reasoning
Same PowerShell environment setup example in documentation, with the same parser false positive on the $Env variable.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
Außerdem ist Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung in HTTP-Headern nicht relevant, daher können Sie sie im Standard-Python-Stil (auch bekannt als „snake_case“) deklarieren.
likely benign
LLM, confidence 0.90
Soft hyphen in the German word Groß-/Kleinschreibung in a header parameters tutorial.
Reasoning
Soft hyphen in German tutorial prose about HTTP header case insensitivity; benign formatting artifact.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
Außerdem ist Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung in HTTP-Headern nicht relevant, daher können Sie sie im Standard-Python-Stil (auch bekannt als „snake_case“) deklarieren.
likely benign
LLM, confidence 0.90
Second soft hyphen in the German header tutorial sentence.
Reasoning
Second soft hyphen in the same benign tutorial sentence.
-
line length 725 characters (raw pass, confidence 0.50)
-
line length 930 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
Sample JSON Web Token shown in an OAuth2 JWT tutorial.
Reasoning
This is the canonical JWT example from jwt.io, a documented sample token with header and payload, not an obfuscated payload. Base64url segments are expected in JWT docs.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Starlette's Y: Starlettes Y
* X is case-sensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant in X
* X is case-insensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant in X
* standard Python: Standard-Python
likely benign
LLM, confidence 0.90
Soft hyphen in the German word Groß-/Kleinschreibung in a translation glossary.
Reasoning
Soft hyphens in German prose inside a translation/prompt reference document. Not an instruction hidden from humans; a typographic artifact in a glossary-style list.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* Starlette's Y: Starlettes Y
* X is case-sensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant in X
* X is case-insensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant in X
* standard Python: Standard-Python
likely benign
LLM, confidence 0.90
Second soft hyphen in the same glossary entry.
Reasoning
Second soft hyphen in the same benign glossary line.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* X is case-sensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant in X
* X is case-insensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant in X
* standard Python: Standard-Python
* deprecated: deprecatet
likely benign
LLM, confidence 0.90
Soft hyphen in another German glossary bullet about case sensitivity.
Reasoning
Soft hyphen in the German glossary entry for case-sensitivity; no concealed instruction content visible.
-
U+00AD SOFT HYPHEN in source (raw pass, confidence 0.75)
* X is case-sensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist relevant in X
* X is case-insensitive: Groß-/Klein⟨U+00AD⟩schrei⟨U+00AD⟩bung ist nicht relevant in X
* standard Python: Standard-Python
* deprecated: deprecatet
likely benign
LLM, confidence 0.90
Second soft hyphen in the same German glossary bullet.
Reasoning
Second soft hyphen in the same glossary bullet; benign.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.93
Documentation example showing PowerShell environment variable assignments before starting a FastAPI app.
Reasoning
The snippet is a PowerShell-style example of setting environment variables before running a FastAPI app. The flagged '$Env' is a documentation placeholder shown in a console block, not executed code, and the pattern is common in tutorials. The rule fires on a variable command name in embedded shell text, which is a false positive here.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.93
Documentation snippet of PowerShell env var setup and a uv/FastAPI run command.
Reasoning
Same documentation example as line 102, repeated in an indented block. It sets demo environment variables and runs 'uv run fastapi run main.py'. Nothing here is obfuscated or malicious; the finding is a tutorial-context false positive.
-
file mixes tab and space indentation (6 tab-indented and 172 space-indented lines) (raw pass, confidence 0.40)
class Termynal {
-
line length 508 characters (raw pass, confidence 0.50)
* ✨ Allow setting the `response_class` to `RedirectResponse` or `FileResponse` and returning the URL from the function. New and updated docs are in the tutorial section **Custom Response - HTML, Stream, File, others**, in [RedirectResponse](https://fastapi.tiangolo.com/advanced/custom-response/#redirectresponse) and
-
identifier `с` contains homoglyph candidates: с (0441)→c (raw pass, confidence 0.70)
* 📝 Add link to article in Russian "FastAPI: знакомимся с фреймворком". PR [#2564](https://github.com/tiangolo/fastapi/pull/2564) by [@trkohler](https://github.com/trkohler).
likely benign
LLM, confidence 0.95
Russian word containing Cyrillic letter in a release-notes article title.
Reasoning
A Cyrillic 'с' inside Russian prose in a changelog entry is ordinary multilingual text, not an identifier used to disguise code.
-
line length 706 characters (raw pass, confidence 0.50)
-
line length 882 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
Sample JWT token shown in OAuth2 tutorial.
Reasoning
This is the well-known example JWT from jwt.io documentation (header, sub 1234567890, John Doe); it is a documentation sample token, not a payload.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
PowerShell console example setting env vars before running fastapi.
Reasoning
PowerShell environment variable syntax in a console example in docs; the $Env variable is the standard PowerShell env provider, not a dropper.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
PowerShell console example setting APP_NAME env var.
Reasoning
Same benign PowerShell documentation example setting environment variables for a demo app.
-
line length 750 characters (raw pass, confidence 0.50)
-
line length 921 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
Sample JWT token in Spanish OAuth2 tutorial.
Reasoning
Same well-known jwt.io sample token used as documentation example.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
PowerShell env var setup example in French settings docs.
Reasoning
Benign PowerShell console example in French docs for setting env vars.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
PowerShell env var example in French settings docs.
Reasoning
Benign PowerShell documentation example setting APP_NAME.
-
compression ratio 0.850 is >2σ above file mean 0.736 (raw pass, confidence 0.50)
Si vous exécutez votre conteneur derrière un proxy de terminaison TLS (load balancer) comme Nginx ou Traefik, ajoutez l'option `--proxy-headers`, cela indiquera à Uvicorn (via la CLI FastAPI) de faire confiance aux en-têtes envoyés par ce proxy lui indiquant que l'application s'exécute derrière HTTPS, etc.
-
line length 725 characters (raw pass, confidence 0.50)
-
line length 918 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
Sample JWT token in French OAuth2 tutorial.
Reasoning
Documentation sample JWT from jwt.io, not a live credential.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
PowerShell env var setup example in Hindi settings docs.
Reasoning
Benign PowerShell console example in Hindi docs.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
PowerShell env var example in Hindi settings docs.
Reasoning
Benign PowerShell documentation example setting APP_NAME.
-
line length 674 characters (raw pass, confidence 0.50)
-
line length 871 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
Sample JWT token in Hindi OAuth2 tutorial.
Reasoning
Documentation sample JWT from jwt.io, not a live credential.
-
identifier `時々いくつかランダムに見える変更を行うことがあります` mixes scripts: Han + Other + Hiragana + Katakana (raw pass, confidence 0.80)
�良であることを意味します（時々いくつかランダムに見える変更を行うことがあります。理由は [LLM は決定論的アルゴリズムではない](https://doublespeak.chat/#/handbook#deterministic-output) ためです）。
likely benign
LLM, confidence 0.90
Japanese prose flagged for mixed scripts in a test doc.
Reasoning
Mixed Japanese scripts in ordinary Japanese prose are expected; no identifier disguise. The file is an LLM test document but the text itself is benign and contains no hidden instructions.
-
string literal compression ratio 0.962 (130 bytes) (raw pass, confidence 0.60)
* <abbr title="Mozilla Developer Network - Mozilla 開発者ネットワーク: 開発者向けドキュメント、Firefox の開発元が執筆">MDN</abbr>
* <abbr title="Input/Output - 入出力: ディスクの読み書き、ネットワーク通信。">I/O</abbr>.
likely benign
LLM, confidence 0.90
Markdown abbreviation list in Japanese doc flagged for compression.
Reasoning
High compression ratio on a plain Markdown list of abbreviations is a false positive from natural-language text.
-
identifier `リクエストごとやユーザーごとに別々のモデルを使うわけではありません` mixes scripts: Katakana + Hiragana + Han + Other (raw pass, confidence 0.80)
同じモデルをリクエスト間で共有するので、リクエストごとやユーザーごとに別々のモデルを使うわけではありません。
dismissed
LLM, confidence 0.90
Japanese documentation sentence about shared models across requests.
Reasoning
Japanese prose mixing katakana, hiragana and kanji is normal; the raw unicode-mixed-script signal fires on natural-language text in a markdown documentation file.
-
identifier `共有するロジックや変数のない別々の関数でそれを行うのは難しく` mixes scripts: Han + Hiragana + Katakana + Other (raw pass, confidence 0.80)
共有するロジックや変数のない別々の関数でそれを行うのは難しく、グローバル変数などに値を保存する必要が出てきます。
そのため、現在は上で説明したとおり `lifespan` を使うことが推奨されています。
dismissed
LLM, confidence 0.97
Japanese documentation paragraph about shared logic and lifespan usage in FastAPI.
Reasoning
The flagged identifier is ordinary Japanese prose mixing Han kanji, Hiragana, and Katakana, plus punctuation. Japanese text routinely mixes these scripts, so the unicode-mixed-script signal is a false positive on a raw pass.
-
identifier `個々のリクエストと` mixes scripts: Han + Other + Hiragana + Katakana (raw pass, confidence 0.80)
- **トレース**: 個々のリクエストと、それを処理するために実行された操作の記録です。時間を計測する各操作を**スパン**と呼びます。
- **ログ**: アプリケーションの起動や操作の失敗など、イベントのタイムスタンプ付きの記録です。
dismissed
LLM, confidence 0.97
Japanese documentation bullet defining traces and logs for OpenTelemetry.
Reasoning
The identifier is normal Japanese prose in a bulleted list describing traces and logs. Mixed Han and Kana is standard orthography, so this is a false positive.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.93
Japanese documentation example of PowerShell env var setup before running a FastAPI app.
Reasoning
This is the Japanese translation of the same PowerShell env var example. The '$Env' token is a documentation placeholder in a console block, not executed code, so the dynamic-execution finding is a false positive.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.93
Japanese documentation snippet with PowerShell env vars and a FastAPI run command.
Reasoning
Repeated documentation example of setting demo environment variables and running fastapi. It is tutorial text in an indented block, not an execution path, so the rule's concern does not apply.
-
identifier `時々カウンターの表示を見て` mixes scripts: Han + Other + Katakana + Hiragana (raw pass, confidence 0.80)
時々カウンターの表示を見て、自分の番号になっているか確認します。
やがてあなたの番になります。カウンターに行き、ハンバーガーを受け取り、テーブルに戻ります。
dismissed
LLM, confidence 0.97
Japanese async tutorial narrative about waiting at a counter for a burger.
Reasoning
The identifier is ordinary Japanese prose about waiting for a number at a counter. Mixed Han, Hiragana, and Katakana is normal, so the finding is a false positive.
-
identifier `家の別々のエリアを掃除できれば` mixes scripts: Han + Hiragana + Other + Katakana (raw pass, confidence 0.80)
しかしこの場合、8 人の元レジ係/料理人/現清掃員を連れてきて、それぞれ (あなたも加えて) 家の別々のエリアを掃除できれば、**並列** に作業でき、より早く終えられます。
dismissed
LLM, confidence 0.97
Japanese async tutorial paragraph describing parallel work on cleaning tasks.
Reasoning
This is ordinary Japanese explanatory text about parallel cleaning. Mixed scripts are standard in Japanese, so the raw-pass signal is a false positive.
-
identifier `我々は間違いを犯す` mixes scripts: Han + Other + Hiragana (raw pass, confidence 0.80)
### 我々は間違いを犯す { #we-make-mistakes }
私たち人間は常に**間違い**を犯します。ソフトウェアには、ほとんど常に**バグ**があらゆる箇所に隠されています。🐛
dismissed
LLM, confidence 0.97
Japanese deployment docs heading about humans making mistakes and bugs.
Reasoning
The flagged heading is a normal Japanese sentence with kanji and hiragana, typical of the translated docs. No obfuscation is present.
-
identifier `他の人々のこれまでの働きがなければ存在しなかったでしょう` mixes scripts: Han + Hiragana + Other (raw pass, confidence 0.80)
**FastAPI**は、他の人々のこれまでの働きがなければ存在しなかったでしょう。
以前に作られた多くのツールが、作成における刺激として役立ってきました。
dismissed
LLM, confidence 0.97
Japanese history page sentence stating FastAPI relies on earlier work by others.
Reasoning
The identifier is a normal Japanese sentence fragment in the project history section. Mixed Han and Hiragana is expected, so this is a false positive.
-
identifier `を別々のモデルとして分けて使うことは可能です` mixes scripts: Hiragana + Han + Other + Katakana (raw pass, confidence 0.80)
...しかし、同じアプリ内で Pydantic v1 と v2 を別々のモデルとして分けて使うことは可能です。
```mermaid
dismissed
LLM, confidence 0.96
Japanese migration guide sentence about coexisting Pydantic v1 and v2 models.
Reasoning
The flagged text is ordinary Japanese prose about using Pydantic v1 and v2 models in one app, followed by a mermaid fence. The mixed scripts are normal Japanese orthography, not an evasion technique.
-
identifier `徐々に` mixes scripts: Han + Other + Hiragana (raw pass, confidence 0.80)
`bump-pydantic` が適用できない場合は、同一アプリで v1 と v2 のモデルを併用できるサポートを利用して、徐々に v2 へ移行できます。
dismissed
LLM, confidence 0.97
Japanese migration guide sentence about migrating to Pydantic v2 gradually.
Reasoning
The identifier is part of a Japanese sentence about gradual migration to v2. Mixed Han and Hiragana is standard, so the unicode finding is a false positive.
-
string literal compression ratio 1.036 (140 bytes) (raw pass, confidence 0.70)
"_FastAPIライブラリを採用し、クエリで **予測値** を取得できる **REST** サーバを構築しました。 [for Ludwig]_"
likely benign
LLM, confidence 0.97
Japanese markdown sentence describing a FastAPI/Ludwig REST server, falsely flagged for compression ratio.
Reasoning
Raw pass high-complexity flag on a Japanese prose string in a markdown docs file. Natural-language text has low compression ratio is expected behavior; the string is a normal documentation sentence with no encoded or obfuscated content.
-
identifier `様々な階層` mixes scripts: Han + Other + Hiragana (raw pass, confidence 0.80)
`BackgroundTasks` の使用は依存性注入システムでも機能し、様々な階層 (*path operation function*、依存性 (dependable)、サブ依存性など) で `BackgroundTasks` 型のパラメーターを宣言できます。
likely benign
LLM, confidence 0.95
A Japanese documentation sentence about declaring BackgroundTasks parameters at various dependency levels.
Reasoning
The mixed-script flag fires on ordinary Japanese prose ("様々な階層" meaning 'various levels') in a markdown tutorial. Japanese text routinely mixes Han, Hiragana and other scripts, so this is a false positive from the raw pass.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
**FastAPI** は、それぞれの場合の処理⟨U+200B⟩⟨U+200B⟩方法と同じオブジェクトの再利用方法を知っているため、すべてのバックグラウンドタスクがマージされ、バックグラウンドで後で実行されます:
likely benign
LLM, confidence 0.75
A zero-width space appears within a Japanese sentence about background task merging in FastAPI docs.
Reasoning
A zero-width space inside Japanese prose is most likely a copy-paste or translation artifact. It is not executable and has no role in code. Hidden characters in documentation are worth noting but do not indicate an attack on their own.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
**FastAPI** は、それぞれの場合の処理⟨U+200B⟩⟨U+200B⟩方法と同じオブジェクトの再利用方法を知っているため、すべてのバックグラウンドタスクがマージされ、バックグラウンドで後で実行されます:
likely benign
LLM, confidence 0.75
A second zero-width space in the same Japanese FastAPI documentation sentence.
Reasoning
This is a second zero-width space in the same Japanese sentence, with the same likely cause: an editing or copy-paste artifact in documentation with no executable effect.
-
identifier `個々の` mixes scripts: Han + Other + Hiragana (raw pass, confidence 0.80)
`APIRouter` に `dependencies` を置くことで、*path operations* のグループ全体に認証を要求する、といった用途に使えます。個々の *path operation* に依存関係を追加していなくても構いません。
///
likely benign
LLM, confidence 0.95
A Japanese doc sentence about applying dependencies to a router versus individual path operations.
Reasoning
"個々の" (individual) combined with Latin 'path operation' is normal mixed-script Japanese technical writing. Nothing suggests obfuscation.
-
line length 509 characters (raw pass, confidence 0.50)
-
line length 720 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.97
A sample JSON Web Token in a Japanese OAuth2/JWT tutorial.
Reasoning
The blob is the well-known jwt.io example JWT (header, payload with sub 1234567890, and a signature), used as an illustrative token in a security tutorial. It is not a payload or dropper.
-
identifier `同じデータベースを使用してDjangoアプリケーションを徐々に移行することもできます` mixes scripts: Han + Hiragana + Katakana + Latin + Other (raw pass, confidence 0.80)
例えば、Djangoアプリケーションからデータベース内の同じデータをFastAPIアプリケーションと共有できるだけではなく、同じデータベースを使用してDjangoアプリケーションを徐々に移行することもできます。
likely benign
LLM, confidence 0.95
A Japanese documentation sentence about sharing a database between Django and FastAPI apps.
Reasoning
Japanese prose that mixes Han, Hiragana, Katakana and Latin ("Django", "FastAPI") is ordinary for technical writing. There is no hidden or steering content.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
A Korean documentation console snippet setting $Env variables for a FastAPI app.
Reasoning
This is a console example in documentation showing how to set PowerShell environment variables before running fastapi. The variable command name is standard PowerShell syntax in a shell-session example, not something executed by the scanner's target code.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
A second Korean documentation console snippet setting $Env variables for a FastAPI app.
Reasoning
Same as the preceding finding: a documentation console example with PowerShell $Env assignments and a fastapi run command, illustrating configuration rather than malicious execution.
-
string literal compression ratio 0.992 (128 bytes) (raw pass, confidence 0.70)
* 100% <dfn title="Python 타입 어노테이션으로, 이를 통해 편집기와 외부 도구가 더 나은 지원을 제공할 수 있습니다">타입 어노테이션</dfn> 코드 베이스.
* 프로덕션 애플리케이션에서 사용됩니다.
likely benign
LLM, confidence 0.90
A Korean features list describing type-annotated codebases, with an HTML definition tag.
Reasoning
The flagged 'string literal' is ordinary Korean prose with an HTML <dfn> tag and a description of type annotations. High compression ratio is an artifact of the flagging heuristic on natural-language text, not obfuscation.
-
string literal compression ratio 0.957 (162 bytes) (raw pass, confidence 0.60)
"_**FastAPI** 라이브러리를 채택하여 **예측**을 얻기 위해 쿼리를 실행할 수 있는 **REST** 서버를 생성했습니다. [Ludwig을 위해]_"
likely benign
LLM, confidence 0.90
A Korean testimonial quote about a REST server built with FastAPI.
Reasoning
This is a quoted Korean testimonial with markdown emphasis. The compression flag comes from natural-language text, and no executable or hidden content is present.
-
string literal compression ratio 0.956 (183 bytes) (raw pass, confidence 0.60)
"_**Netflix**는 우리의 **위기 관리** 오케스트레이션 프레임워크인 **Dispatch**의 오픈 소스 공개를 발표하게 되어 기쁩니다! [**FastAPI**로 빌드]_"
likely benign
LLM, confidence 0.90
A Korean testimonial quote about Netflix's Dispatch project built with FastAPI.
Reasoning
This is a quoted Korean testimonial about Netflix's Dispatch framework built on FastAPI. The high-complexity flag is a heuristic false positive on prose.
-
line length 514 characters (raw pass, confidence 0.50)
-
line length 719 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.97
A sample JSON Web Token in a Korean OAuth2/JWT tutorial.
Reasoning
This is the same well-known jwt.io sample JWT used as an example in a Korean security tutorial. It is not a live credential or encoded payload.
-
identifier `azərbaycan` mixes scripts: Latin + Other (raw pass, confidence 0.80)
ay: aymar aru
az: azərbaycan dili
ba: башҡорт теле
be: беларуская мова
likely benign
LLM, confidence 0.95
A YAML language-name mapping entry giving the Azerbaijani name with its proper schwa letter.
Reasoning
"azərbaycan dili" is the correct native name for Azerbaijani, with the legitimate schwa letter ə. This is a language-name mapping file, so the Latin/Other mix is expected.
-
identifier `Eʋegbe` mixes scripts: Latin + Other (raw pass, confidence 0.80)
dz: རྫོང་ཁ
ee: Eʋegbe
el: Ελληνικά
en: English
likely benign
LLM, confidence 0.93
Ewe language name in a multilingual language list, containing the IPA letter ʋ.
Reasoning
The flagged token is the Ewe language name, which legitimately uses the IPA letter ʋ (U+028B). Mixing Latin with an IPA letter is expected in a multilingual language-name table, and the surrounding entries are ordinary.
-
identifier `æвзаг` contains homoglyph candidates: а (0430)→a (raw pass, confidence 0.70)
or: ଓଡ଼ିଆ
os: ирон æвзаг
pa: ਪੰਜਾਬੀ
pi: पाऴि
likely benign
LLM, confidence 0.88
Ossetian language name in a language-name table, using native Cyrillic plus æ.
Reasoning
The value is the Ossetian word for language, written in Ossetian Cyrillic orthography, which uses æ alongside Cyrillic letters. The 'а' flagged as a Latin 'a' homoglyph is the native Cyrillic letter, and there is no identifier or code context that would make this deceptive.
-
identifier `æвзаг` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)
or: ଓଡ଼ିଆ
os: ирон æвзаг
pa: ਪੰਜਾਬੀ
pi: पाऴि
likely benign
LLM, confidence 0.88
Ossetian language name mixing Latin æ with Cyrillic letters, as the language's native orthography does.
Reasoning
This is the same Ossetian string flagged for mixed scripts. Mixing Latin æ with Cyrillic is the native orthography, and the data file is a plain translation table with no executable use of the value.
-
identifier `Saɯ` mixes scripts: Latin + Other (raw pass, confidence 0.80)
yo: Yorùbá
za: Saɯ cueŋƅ
zh: 简体中文
zh-hant: 繁體中文
likely benign
LLM, confidence 0.92
Zhuang language name in a language table, using IPA letters.
Reasoning
Saɯ cueŋƅ is the native name of the Zhuang language, written with IPA letters (ɯ, ŋ, ƅ). This is a legitimate linguistic value in a language-name list.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.85
Documentation example showing PowerShell environment variable assignment before running a FastAPI app.
Reasoning
This is a PowerShell example in Portuguese documentation that sets environment variables using $Env: syntax, followed by running a FastAPI command. The AST pass flagged the variable-style command name, but this is ordinary documented shell usage with no download, decode, or pipe-to-shell behavior.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.85
Documentation example setting PowerShell environment variables for a FastAPI app run.
Reasoning
This is the same PowerShell documentation example, which sets $Env:APP_NAME and runs uv. The flagged variable command name is the PowerShell environment syntax itself, and the snippet has no hostile action.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
o tem suas próprias coisas, variáveis ⟨U+200B⟩⟨U+200B⟩e memória. E se você estiver consumindo uma grande quantidade de memória em seu código, **cada processo** consumirá uma quantidade equivalente de memória.
likely benign
LLM, confidence 0.92
Stray U+200B zero-width space inside Portuguese documentation prose.
Reasoning
A zero-width space appears inside a Portuguese prose sentence in documentation. This is a common copy-paste or editor artifact in translated Markdown, and it has no effect on code or behavior.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
em suas próprias coisas, variáveis ⟨U+200B⟩⟨U+200B⟩e memória. E se você estiver consumindo uma grande quantidade de memória em seu código, **cada processo** consumirá uma quantidade equivalente de memória.
likely benign
LLM, confidence 0.92
Second stray U+200B in the same Portuguese documentation paragraph.
Reasoning
This is another zero-width space in the same translated paragraph, consistent with editor or copy-paste residue. The raw pass has a high false-positive rate, and the character is harmless in prose.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Esses processos de trabalho seriam aqueles que executariam sua aplicação, eles executariam os cálculos principais para receber uma **request** e retornar uma **resposta**, e carregariam qualquer coisa que você colocasse em variáveis ⟨U+200B⟩⟨U+200B⟩na RAM.
<img src="/img/deployment/concepts/process-ram.drawio.svg">
likely benign
LLM, confidence 0.92
Stray U+200B zero-width space in Portuguese documentation prose.
Reasoning
A zero-width space sits within Portuguese prose near an image tag in a documentation file. This is typical translation-editor residue and does not hide instructions or code from readers.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Esses processos de trabalho seriam aqueles que executariam sua aplicação, eles executariam os cálculos principais para receber uma **request** e retornar uma **resposta**, e carregariam qualquer coisa que você colocasse em variáveis ⟨U+200B⟩⟨U+200B⟩na RAM.
<img src="/img/deployment/concepts/process-ram.drawio.svg">
likely benign
LLM, confidence 0.92
Second stray U+200B in the same Portuguese documentation paragraph.
Reasoning
This second zero-width space is in the same translated paragraph and is consistent with copy-paste residue. It is harmless and does not conceal anything from readers.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Para alterar as URLs usadas ⟨U+200B⟩⟨U+200B⟩para as interfaces de usuário da documentação gerada automaticamente, leia a documentação de [Tutorial - Metadados e URLs da Documentação](../tutorial/metadata.md#docs-urls).
likely benign
LLM, confidence 0.92
Stray U+200B zero-width space in Portuguese how-to documentation prose.
Reasoning
A zero-width space is placed between words in a Portuguese documentation sentence about documentation URLs. This is a harmless editor artifact in prose, not a payload.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Para alterar as URLs usadas ⟨U+200B⟩⟨U+200B⟩para as interfaces de usuário da documentação gerada automaticamente, leia a documentação de [Tutorial - Metadados e URLs da Documentação](../tutorial/metadata.md#docs-urls).
likely benign
LLM, confidence 0.92
Second stray U+200B in the same Portuguese how-to sentence.
Reasoning
This is another zero-width space in the same sentence, consistent with translation or editor residue. It has no functional or concealing effect.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Mas isso só permitirá certos tipos de comunicação, excluindo tudo que envolva credenciais: cookies, cabeçalhos de autorização como aqueles usados ⟨U+200B⟩⟨U+200B⟩com Bearer Tokens, etc.
Então, para que tudo funcione corretamente, é melhor especificar explicitamente as origens permitidas.
likely benign
LLM, confidence 0.92
Stray U+200B zero-width space in Portuguese CORS tutorial prose.
Reasoning
A zero-width space appears in a Portuguese tutorial sentence about CORS and credentials. This is a typical copy-paste artifact in translated prose and is not hidden content.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Mas isso só permitirá certos tipos de comunicação, excluindo tudo que envolva credenciais: cookies, cabeçalhos de autorização como aqueles usados ⟨U+200B⟩⟨U+200B⟩com Bearer Tokens, etc.
Então, para que tudo funcione corretamente, é melhor especificar explicitamente as origens permitidas.
likely benign
LLM, confidence 0.92
Second stray U+200B in the same Portuguese CORS tutorial paragraph.
Reasoning
This second zero-width space is in the same translated tutorial paragraph and is consistent with editor residue. It is harmless in documentation prose.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Os parâmetros padrão usados ⟨U+200B⟩⟨U+200B⟩pela implementação `CORSMiddleware` são restritivos por padrão, então você precisará habilitar explicitamente as origens, métodos ou cabeçalhos específicos para que os navegadores tenham permissão para usá-los em um contexto cross domain.
likely benign
LLM, confidence 0.97
A zero-width space appears in a Portuguese CORS documentation sentence.
Reasoning
Zero-width space inside Portuguese prose before 'usados' is a typical copy-paste/typesetting artifact in translated docs; no hidden instruction or payload.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
Os parâmetros padrão usados ⟨U+200B⟩⟨U+200B⟩pela implementação `CORSMiddleware` são restritivos por padrão, então você precisará habilitar explicitamente as origens, métodos ou cabeçalhos específicos para que os navegadores tenham permissão para usá-los em um contexto cross domain.
likely benign
LLM, confidence 0.97
Another zero-width space in the same CORS documentation line.
Reasoning
Second zero-width space in the same benign documentation sentence; consistent with translation tooling artifacts.
-
line length 710 characters (raw pass, confidence 0.50)
-
line length 897 characters (raw pass, confidence 0.50)
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
E ambos os modelos serão usados ⟨U+200B⟩⟨U+200B⟩para a documentação interativa da API:
<img src="/img/tutorial/response-model/image02.png">
likely benign
LLM, confidence 0.96
Zero-width space in Portuguese response-model documentation text.
Reasoning
Zero-width space in Portuguese prose adjacent to an image tag; no code execution or concealed content, just invisible characters in docs.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
E ambos os modelos serão usados ⟨U+200B⟩⟨U+200B⟩para a documentação interativa da API:
<img src="/img/tutorial/response-model/image02.png">
likely benign
LLM, confidence 0.96
A second zero-width space in the same documentation paragraph.
Reasoning
Same benign zero-width character artifact in documentation prose.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
E as ferramentas também ficarão felizes porque `RedirectResponse` e ⟨U+200B⟩⟨U+200B⟩`JSONResponse` são subclasses de `Response`, então a anotação de tipo está correta.
### Anote uma subclasse de Response { #annotate-a-response-subclass }
likely benign
LLM, confidence 0.96
Zero-width space between RedirectResponse and JSONResponse mentions in docs.
Reasoning
Zero-width space between code-formatted class names in documentation; a harmless encoding artifact.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
E as ferramentas também ficarão felizes porque `RedirectResponse` e ⟨U+200B⟩⟨U+200B⟩`JSONResponse` são subclasses de `Response`, então a anotação de tipo está correta.
### Anote uma subclasse de Response { #annotate-a-response-subclass }
likely benign
LLM, confidence 0.96
Another zero-width space in the same documentation passage.
Reasoning
Repeated benign zero-width artifact in the same documentation passage.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
...isso falha porque a anotação de tipo não é um tipo Pydantic e não é apenas uma única classe ou subclasse `Response`, é uma união (qualquer uma das duas) entre um `Response` e ⟨U+200B⟩⟨U+200B⟩um `dict`.
### Desative o modelo de resposta { #disable-response-model }
likely benign
LLM, confidence 0.96
Zero-width space in a Portuguese explanation of response type unions.
Reasoning
Zero-width space in documentation prose near 'Response e um dict'; no hidden instruction or malicious content.
-
U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
...isso falha porque a anotação de tipo não é um tipo Pydantic e não é apenas uma única classe ou subclasse `Response`, é uma união (qualquer uma das duas) entre um `Response` e ⟨U+200B⟩⟨U+200B⟩um `dict`.
### Desative o modelo de resposta { #disable-response-model }
likely benign
LLM, confidence 0.96
Another zero-width space in the same documentation sentence.
Reasoning
Second benign zero-width artifact in the same sentence.
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
A sample JWT token shown in a FastAPI OAuth2 tutorial code block.
Reasoning
This is the standard JWT example token from jwt.io documentation (header.payload.signature with HS256), widely used in tutorials; not an obfuscated payload.
-
identifier `Pythonу` contains homoglyph candidates: у (0443)→y (raw pass, confidence 0.70)
Pythonу придётся сравнить весь общий префикс `stanleyjobso` в `stanleyjobsox` и `stanleyjobson`, прежде чем понять, что строки отличаются. Поэтому на ответ «Неверное имя пользователя или пароль» уйдё
likely benign
LLM, confidence 0.90
Russian prose word 'Pythonу' with a Cyrillic inflection ending flagged as a homoglyph.
Reasoning
The 'у' is a Cyrillic letter in a Russian sentence where 'Python' is followed by a Cyrillic case ending; this is natural Russian morphology, not a deliberate spoof of an identifier.
-
identifier `Pythonу` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)
Pythonу придётся сравнить весь общий префикс `stanleyjobso` в `stanleyjobsox` и `stanleyjobson`, прежде чем понять, что строки отличаются. Поэтому на ответ «Неверное имя пользователя или пароль» уйдё
likely benign
LLM, confidence 0.90
Mixed-script Russian word 'Pythonу' in documentation prose.
Reasoning
Mixed Latin and Cyrillic is expected in Russian text inflecting a Latin brand name; the word is prose, not code identifier, so no spoofing.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.90
PowerShell environment variable setup lines in a Russian settings tutorial console block.
Reasoning
This is a PowerShell-style environment variable assignment in a console doc example ($Env:ADMIN_EMAIL), flagged because the command name is a variable; in context it is a documentation illustration, not a dropper.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
Documentation example setting environment variables before running a FastAPI app.
Reasoning
The flagged line is a PowerShell environment-variable assignment shown as a console example in translated documentation. The `$Env:` prefix is a normal PowerShell idiom, and the snippet runs nothing hidden.
-
line length 666 characters (raw pass, confidence 0.50)
-
line length 890 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
Sample JWT token in a Russian tutorial page.
Reasoning
The base64 blob is the standard JWT example token from the FastAPI OAuth2 tutorial, with the header, payload and signature segments typical of a sample token. It is documentation content, not an obfuscated payload.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
Documentation example setting environment variables in a Turkish settings page.
Reasoning
The snippet is the same PowerShell environment-variable console example in Turkish documentation. It is a normal setup instruction with no hidden execution.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
Documentation example setting environment variables before running a FastAPI app.
Reasoning
This is the same PowerShell environment-variable example in Turkish documentation, showing a benign shell command in a code block.
-
line length 654 characters (raw pass, confidence 0.50)
-
line length 899 characters (raw pass, confidence 0.50)
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
likely benign
LLM, confidence 0.95
Sample JWT token in a Turkish tutorial page.
Reasoning
The base64 string is the canonical sample JWT from the tutorial, identical in content to the Russian version, and is expected in this documentation.
-
identifier `необовʼязковою` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Властивість `servers` у специфікації OpenAPI є необовʼязковою.
likely benign
LLM, confidence 0.90
Ukrainian word 'необовʼязковою' using the standard modifier-letter apostrophe.
Reasoning
The flagged word uses the Ukrainian apostrophe U+02BC (ʼ) inside a Cyrillic word, which is the standard orthography for Ukrainian. The mixed-script signal is a false positive from a legitimate letter.
-
identifier `обʼєкті` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Потім ви можете встановлювати заголовки в цьому *тимчасовому* обʼєкті відповіді.
{* ../../docs_src/response_headers/tutorial002_py310.py hl[1, 7:8] *}
likely benign
LLM, confidence 0.90
Ukrainian word 'обʼєкті' in response-header documentation.
Reasoning
The identifier 'обʼєкті' contains U+02BC, the normal Ukrainian apostrophe, within Cyrillic text. This is ordinary prose and not a homoglyph attack.
-
identifier `обʼєкт` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Далі ви можете повернути будь-який потрібний обʼєкт, як зазвичай (наприклад, `dict`, модель бази даних тощо).
likely benign
LLM, confidence 0.90
Ukrainian word 'обʼєкт' in documentation prose.
Reasoning
The word 'обʼєкт' uses the standard Ukrainian apostrophe U+02BC in running text. The mixed-script flag is a false positive.
-
identifier `обʼєкта` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Якщо ви оголосили `response_model`, його все одно буде використано для фільтрації та перетворення поверненого обʼєкта.
likely benign
LLM, confidence 0.90
Ukrainian word 'обʼєкта' in documentation prose.
Reasoning
The word 'обʼєкта' is Ukrainian prose with the normal apostrophe character. No code or hidden content is involved.
-
identifier `обʼєкт` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
�стає цей *тимчасовий* обʼєкт відповіді, щоб витягти заголовки (а також кукі та код статусу) і помістить їх у кінцеву відповідь, яка міститиме повернуте вами значення, відфіль… (340 bytes total)
likely benign
LLM, confidence 0.90
Ukrainian word 'обʼєкт' in documentation prose.
Reasoning
The flagged token is 'обʼєкт' with the standard Ukrainian apostrophe. The snippet is ordinary translated documentation text.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```console
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
Documentation example setting environment variables in a Ukrainian settings page.
Reasoning
This is the same PowerShell environment-variable console example in Ukrainian documentation, a benign setup instruction.
-
[embedded bash] command name is a variable (`$Env`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
$ $Env:ADMIN_EMAIL = "deadpool@example.com"
$ $Env:APP_NAME = "ChimichangApp"
$ uv run fastapi run main.py
likely benign
LLM, confidence 0.95
Documentation example setting environment variables before running a FastAPI app.
Reasoning
This is the same PowerShell environment-variable example in Ukrainian documentation, showing a normal shell command for running an app.
-
identifier `необовʼязковий` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* _Шлях_ `/items/{item_id}` містить _параметр шляху_ `item_id`, який має бути типу `int`.
* _Шлях_ `/items/{item_id}` містить необовʼязковий `str` _параметр запиту_ `q`.
likely benign
LLM, confidence 0.90
Ukrainian word 'необовʼязковий' in the documentation index.
Reasoning
The word 'необовʼязковий' uses the standard Ukrainian apostrophe U+02BC within Cyrillic text in the index page. This is legitimate orthography, not obfuscation.
-
identifier `обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Автоматичні та зрозумілі помилки, коли дані некоректні.
* Валідацію навіть для глибоко вкладених JSON-обʼєктів.
dismissed
LLM, confidence 0.95
Ukrainian documentation prose using the standard apostrophe character in the word 'обʼєктів'.
Reasoning
The flagged token uses U+02BC (modifier letter apostrophe), which is standard Ukrainian orthography for words like 'обʼєктів'. The mixed-script signal is a false positive from a legitimate Ukrainian translation of documentation.
-
identifier `Обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Перетворення типів Python (`str`, `int`, `float`, `bool`, `list`, тощо).
* Обʼєктів `datetime`.
* Обʼєктів `UUID`.
* Моделей бази даних.
dismissed
LLM, confidence 0.95
Ukrainian markdown list item containing the word 'Обʼєктів' with a standard apostrophe.
Reasoning
The capitalized 'Обʼєктів' uses the Ukrainian modifier-letter apostrophe in a markdown bullet list of Python object types. This is normal Ukrainian spelling, not obfuscation.
-
identifier `Обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Обʼєктів `datetime`.
* Обʼєктів `UUID`.
* Моделей бази даних.
* ...та багато іншого.
dismissed
LLM, confidence 0.95
Ukrainian markdown list item containing 'Обʼєктів' in a documentation list.
Reasoning
Same standard Ukrainian apostrophe usage in a documentation bullet list. The Cyrillic plus apostrophe mix is expected in Ukrainian text.
-
identifier `обовʼязковий` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Перевірить, що є обовʼязковий атрибут `name`, який має бути типу `str`.
* Перевірить, що є обовʼязковий атрибут `price`, який має бути типу `float`.
dismissed
LLM, confidence 0.95
Ukrainian documentation text with the word 'обовʼязковий' (mandatory).
Reasoning
'обовʼязковий' is correct Ukrainian spelling with the modifier-letter apostrophe. The raw-pass unicode flag is a false positive on natural-language documentation.
-
identifier `обовʼязковий` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Перевірить, що є обовʼязковий атрибут `price`, який має бути типу `float`.
* Перевірить, що є необовʼязковий атрибут `is_offer`, який має бути типу `bool`, якщо він присутній.
dismissed
LLM, confidence 0.95
Ukrainian documentation line with 'обовʼязковий' (mandatory).
Reasoning
Standard Ukrainian orthography in translated FastAPI docs. No code execution or hidden content is involved.
-
identifier `необовʼязковий` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Перевірить, що є необовʼязковий атрибут `is_offer`, який має бути типу `bool`, якщо він присутній.
* Усе це також працюватиме для глибоко вкладених JSON-обʼєктів.
dismissed
LLM, confidence 0.95
Ukrainian documentation line with 'необовʼязковий' (optional).
Reasoning
'необовʼязковий' is standard Ukrainian for 'optional' with the apostrophe. This is ordinary translated prose.
-
identifier `обʼєктів` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
* Усе це також працюватиме для глибоко вкладених JSON-обʼєктів.
* Автоматично перетворюватиме з та в JSON.
* Документуватиме все за допомогою OpenAPI, який може бути використано в:
dismissed
LLM, confidence 0.95
Ukrainian documentation sentence containing 'JSON-обʼєктів'.
Reasoning
The word 'обʼєктів' with the Ukrainian apostrophe is correct spelling in this translated documentation. The mixed-script match is expected for Ukrainian.
-
identifier `необовʼязково` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
### Розгортання застосунку (необовʼязково) { #deploy-your-app-optional }
За бажання ви можете розгорнути ваш застосунок FastAPI у [FastAPI Cloud](https://fastapicloud.com) однією командою. 🚀
dismissed
LLM, confidence 0.95
Ukrainian heading 'Розгортання застосунку (необовʼязково)' (deploy your app, optional).
Reasoning
'необовʼязково' (optionally) is normal Ukrainian spelling in a heading. The raw-pass signal is a false positive on legitimate translated text.
-
identifier `необовʼязкових` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Коли ви встановлюєте FastAPI за допомогою `uv add "fastapi[standard]"`, ви отримуєте групу необовʼязкових залежностей `standard`:
Використовується Pydantic:
dismissed
LLM, confidence 0.95
Ukrainian documentation sentence about optional dependencies of fastapi[standard].
Reasoning
'необовʼязкових' is standard Ukrainian with the modifier apostrophe, used in describing optional dependencies. No obfuscation is present.
-
identifier `необовʼязкові` mixes scripts: Cyrillic + Other (raw pass, confidence 0.80)
Якщо ви не хочете включати необовʼязкові залежності `standard`, ви можете встановити через `uv add fastapi` замість `uv add "fastapi[standard]"`.
### Без `fastapi-cloud-cli` { #without-fastapi-cloud-cli }
dismissed
LLM, confidence 0.95
Ukrainian documentation sentence about optional standard dependencies.
Reasoning
'необовʼязкові' is correct Ukrainian spelling in translated docs. The mixed-script flag is a false positive.
-
line length 717 characters (raw pass, confidence 0.50)
-
line length 857 characters (raw pass, confidence 0.50)
-
string literal compression ratio 0.993 (153 bytes) (raw pass, confidence 0.70)
你的 API 現在也能掌控自己的 <dfn title="這只是個玩笑，提醒一下。這與 Cookie 同意無關，但有趣的是連 API 現在也能拒絕可憐的 Cookie。請收下這塊餅乾。🍪">Cookie 同意</dfn>。🤪🍪
你可以使用 Pydantic 的模型設定來 `forbid` 任何 `extra` 欄位：
likely benign
LLM, confidence 0.97
Chinese FastAPI tutorial sentence with a humorous dfn title about cookies, flagged for compression ratio.
Reasoning
Raw pass flagged a Traditional Chinese prose string with an HTML title attribute containing a joke about cookie consent. This is ordinary FastAPI tutorial markdown text; the high ratio is an artifact of natural language and emoji, not obfuscation.
-
line length 655 characters (raw pass, confidence 0.50)
-
string literal compression ratio 0.987 (153 bytes) (raw pass, confidence 0.70)
你的 API 现在可以控制自己的 <dfn title="只是个玩笑，别当真。和 cookie 同意无关，不过连 API 现在都能拒绝可怜的 cookie，挺好玩的。来，吃块小饼干吧。🍪">cookie 同意</dfn>。🤪🍪
dismissed
LLM, confidence 0.93
Chinese documentation sentence with a humorous dfn title about cookie consent.
Reasoning
The flagged 'string literal' is ordinary Chinese prose inside an HTML abbr/dfn title, a joke about cookie consent. Chinese text in UTF-8 has a high byte-level compression ratio, so the high-complexity signal is a false positive on natural language.
-
line length 665 characters (raw pass, confidence 0.50)
-
string literal compression ratio 1.032 (154 bytes) (raw pass, confidence 0.70)
库类库（在某些情况下称为 <abbr title="Object Relational Mapper - 对象关系映射器: 一个花哨的术语，指一种库，其中某些类表示 SQL 表，而实例表示这些表中的行">"ORMs"</abbr>），FastAPI 不会强迫你使用任何东西。😎
dismissed
LLM, confidence 0.93
Chinese documentation sentence with an abbr tooltip defining ORMs.
Reasoning
The flagged text is a Chinese documentation sentence with an abbr title explaining ORM. It is natural-language prose, and the compression-ratio signal reflects Chinese byte encoding rather than obfuscation.
-
`__import__` called on a non-literal expression (ast pass, confidence 0.70)
try:
Color = __import__(module_path, fromlist=["Color"]).Color
except ImportError: pytest.skip(f"{module_path} not available")
likely benign
LLM, confidence 0.93
Test helper dynamically imports a Color class from a module path, skipping the test if unavailable.
Reasoning
Dynamic __import__ inside a try/except ImportError with pytest.skip and a pragma no-cover comment is a standard test idiom for optionally importing a module that may be unavailable on a given Python version. The module_path is a test-local value, not attacker-controlled input from outside the repo, and nothing here executes downloaded or encoded payloads.
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
disclude.io