PyPI / ghapi / 2.1.4

ghapi 2.1.4

Source
https://github.com/fastai/ghapi
Tag scanned
2.1.4
Compared with
2.1.3 (35 signals introduced since)
Files
23 scanned, 68 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 52 info
Scan time
29.2 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 38 of 38 warn and critical signals; 38 demoted to info.
Disclude version
4.1.0
Scanned (UTC)
2026-10-22 06:03

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info warn → info by review encoding-base64 ghapi/gh_spec.py:8872:124 new in this release

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

                                                                 'verificationMaterial': {'tlogEntries': [{'logIndex': '97913980',
                                                                                                           'logId': {'keyId': 'wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0='},
    likely benign LLM, confidence 0.93 Base64 keyId inside an embedded sigstore transparency-log entry in the GitHub API spec.
    Reasoning

    The blob is a base64 key identifier inside a sigstore/attestation verification-material structure in an API spec. Raw-pass base64 hits in such data are expected false positives.

  2. info warn → info by review encoding-base64 ghapi/gh_spec.py:8875:150 new in this release

    base64-like blob (96 bytes, compression ratio 1.11) (raw pass, confidence 0.60)

                                                                                                           'inclusionPromise': {'signedEntryTimestamp': 'MEYCIQCeEsQAy+qXtULkh52wbnHrkt2R2JQ05P9STK/xmdpQ2AIhANiG5Gw6cQiMnwvUz1+9UKtG/vlC8dduq07wsFOViwSL'},
    likely benign LLM, confidence 0.93 Base64 signed entry timestamp in a sigstore inclusion promise within the API spec.
    Reasoning

    The value is a signedEntryTimestamp signature from a transparency log inclusion proof, which is expected data in a spec of this kind.

  3. info warn → info by review encoding-base64 ghapi/gh_spec.py:8877:136 new in this release

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

                                                                                                                              'rootHash': 'KgKiXoOl8rM5d4y6Xlbm2QLftvj/FYvTs6z7dJlNO60=',
    likely benign LLM, confidence 0.93 Base64 Merkle rootHash digest in a sigstore proof within the API spec.
    Reasoning

    The value is a rootHash digest in a Merkle inclusion proof, a standard hash string with no executable role.

  4. info warn → info by review encoding-base64 ghapi/gh_spec.py:8879:135 new in this release

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

                                                                                                                              'hashes': ['8LI21mzwxnUSo0fuZeFsUrz2ujZ4QAL+oGeTG+5toZg=',
    likely benign LLM, confidence 0.93 Base64 SHA-256 hash in a Merkle proof hashes list within the API spec.
    Reasoning

    The entry is a 32-byte SHA-256 digest from a Merkle proof list, a typical hash value in attestation data.

  5. info warn → info by review encoding-base64 ghapi/gh_spec.py:8880:135 new in this release

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

                                                                                                                                         'nCb369rcIytNhGwWoqBv+eV49X3ZKpo/HJGKm9V+dck=',
    likely benign LLM, confidence 0.93 Base64 SHA-256 digest in a Merkle proof hashes list within the API spec.
    Reasoning

    The entry is a 32-byte digest in a Merkle proof hashes list, which is standard attestation data with no executable role.

  6. info warn → info by review encoding-base64 ghapi/gh_spec.py:8881:135 new in this release

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

                                                                                                                                         'hnNQ9mUdSwYCfdV21pd87NucrdRRNZATowlaRR1hJ4A=',
    likely benign LLM, confidence 0.93 Base64 SHA-256 digest in a Merkle proof hashes list within the API spec.
    Reasoning

    The entry is a 32-byte digest in a Merkle proof hashes list, consistent with the surrounding sigstore data and no executable role.

  7. info warn → info by review encoding-base64 ghapi/gh_spec.py:8882:135 new in this release

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

                                                                                                                                         'MBhhK33vlD4Tq/JKgAaXUI4VjmosWKe6+7RNpQ2ncNM=',
    likely benign LLM, confidence 0.93 Base64 SHA-256 digest in a Merkle proof hashes list within the API spec.
    Reasoning

    The entry is a 32-byte digest in a Merkle proof hashes list, consistent with the surrounding sigstore data and no executable role.

  8. info warn → info by review encoding-base64 ghapi/gh_spec.py:8883:135 new in this release

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

                                                                                                                                         'XKWUE3stvGV1OHsIGiCGfn047Ok6uD4mFkh7BaicaEc=',
    likely benign LLM, confidence 0.93 Base64 SHA-256 digest in a Merkle proof hashes list within the API spec.
    Reasoning

    The entry is a 32-byte digest in a Merkle proof hashes list, consistent with the surrounding sigstore data and no executable role.

  9. info warn → info by review encoding-base64 ghapi/gh_spec.py:8884:135 new in this release

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

                                                                                                                                         'Tgve40VPFfuei+0nhupdGpfPPR+hPpZjxgTiDT8WNoY=',
    likely benign LLM, confidence 0.93 Base64 SHA-256 digest in a Merkle proof hashes list within the API spec.
    Reasoning

    The entry is a 32-byte digest in a Merkle proof hashes list, consistent with the surrounding sigstore data and no executable role.

  10. info warn → info by review encoding-base64 ghapi/gh_spec.py:8885:135 new in this release

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

                                                                                                                                         'wV+S/7tLtYGzkLaSb6UDqexNyhMvumHK/RpTNvEZuLU=',
    likely benign LLM, confidence 0.93 Base64 SHA-256 digest in a Merkle proof hashes list within the API spec.
    Reasoning

    The entry is a 32-byte digest in a Merkle proof hashes list, consistent with the surrounding sigstore data and no executable role.

  11. info warn → info by review encoding-base64 ghapi/gh_spec.py:8886:135 new in this release

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

                                                                                                                                         'uwaWufty6sn6XqO1Tb9M3Vz6sBKPu0HT36mStxJNd7s=',
    likely benign LLM, confidence 0.93 Base64 SHA-256 digest in a Merkle proof hashes list within the API spec.
    Reasoning

    The entry is a 32-byte digest in a Merkle proof hashes list, consistent with the surrounding sigstore data and no executable role.

  12. info warn → info by review encoding-base64 ghapi/gh_spec.py:8887:135 new in this release

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

                                                                                                                                         'jUfeMOXQP0XF1JAnCEETVbfRKMUwCzrVUzYi8vnDMVs=',
    likely benign LLM, confidence 0.93 Base64 SHA-256 digest in a Merkle proof hashes list within the API spec.
    Reasoning

    The entry is a 32-byte digest in a Merkle proof hashes list, consistent with the surrounding sigstore data and no executable role.

  13. info warn → info by review encoding-base64 ghapi/gh_spec.py:8888:135 new in this release

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

                                                                                                                                         'xQKjzJAwwdlQG/YUYBKPXxbCmhMYKo1wnv+6vDuKWhQ=',
    likely benign LLM, confidence 0.90 A 32-byte base64 digest-like string inside a GitHub API spec data structure.
    Reasoning

    Raw-pass base64 hit on a 44-byte string that decodes to 32 bytes, which is a typical SHA-256 digest or key. It sits in a list of hashes inside a generated GitHub API spec, so it is a data value rather than a payload.

  14. info warn → info by review encoding-base64 ghapi/gh_spec.py:8889:135 new in this release

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

                                                                                                                                         'cX3Agx+hP66t1ZLbX/yHbfjU46/3m/VAmWyG/fhxAVc=',
    likely benign LLM, confidence 0.90 A 32-byte base64 value in a list of GitHub API spec data entries.
    Reasoning

    Same pattern as its neighbours: a 44-character base64 value of 32 bytes in a list of spec example data. The raw pass is known to over-flag such strings and the file context is a legitimate API schema.

  15. info warn → info by review encoding-base64 ghapi/gh_spec.py:8890:135 new in this release

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

                                                                                                                                         'sjohk/3DQIfXTgf/5XpwtdF7yNbrf8YykOMHr1CyBYQ=',
    likely benign LLM, confidence 0.90 A base64 value of 32 bytes in a GitHub attestation example list.
    Reasoning

    A 32-byte base64 value in the same list of attestation example data. No execution, decoding, or dropper behaviour is present, and the file is a generated API spec.

  16. info warn → info by review encoding-base64 ghapi/gh_spec.py:8891:135 new in this release

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

                                                                                                                                         '98enzMaC+x5oCMvIZQA5z8vu2apDMCFvE/935NfuPw8='],
    likely benign LLM, confidence 0.90 A 32-byte base64 value in the GitHub attestation example data.
    Reasoning

    Another 32-byte base64 string in the same example list, consistent with a digest in API documentation. Raw-pass entropy and encoding signals are weak evidence here.

  17. info warn → info by review encoding-base64 ghapi/gh_spec.py:8892:204 new in this release

    base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

                                                                                                                              'checkpoint': {'envelope': 'rekor.sigstore.dev - 2605736670972794746\\n93750551\\nKgKiXoOl8rM5d4y6Xlbm2QLftvj/FYvTs6z7dJlNO60=\\n\\n— rekor.sigstore.dev '
    likely benign LLM, confidence 0.90 A Rekor checkpoint envelope containing a base64 signature hash in an API example.
    Reasoning

    The value is a Sigstore/Rekor checkpoint envelope string containing a base64 signature hash. This is the standard transparency-log format used in API examples, not an obfuscated payload.

  18. info warn → info by review encoding-base64 ghapi/gh_spec.py:8893:151 new in this release

    base64-like blob (100 bytes, compression ratio 1.11) (raw pass, confidence 0.60)

                                                                                                                                                         'wNI9ajBEAiBkLzdjY8A9HReU7rmtjwZ+JpSuYtEr9SmvSwUIW7FBjgIgKo+vhkW3tqc+gc8fw9gza3xLoncA8a+MTaJYCaLGA9c=\\n'}},
    likely benign LLM, confidence 0.90 A base64-encoded ECDSA signature inside a Sigstore example structure.
    Reasoning

    The base64 decodes to an ECDSA DER signature, shown with a trailing newline inside a Sigstore attestation example. It is a cryptographic example value in a spec file.

  19. info warn → info by review encoding-base64 ghapi/gh_spec.py:8899:103 new in this release

    base64-like blob (96 bytes, compression ratio 1.11) (raw pass, confidence 0.60)

                                                                                  'signatures': [{'sig': 'MEQCIEGIGAm7gZVLLpsrPcjndEjiuctE2/c9+j9KGvazz3rlAiAd6O16T5hkzRM3IbRPzm+xT40mNQZxefd7laDP6x2XLQ=='}]}}}}},
              'docs_url': 'https://docs.github.com/rest/repos/attestations#create-an-attestation'},
    likely benign LLM, confidence 0.90 A base64 ECDSA signature value in a GitHub attestation API example.
    Reasoning

    A base64 ECDSA signature in the 'signatures' field of an attestation example. This is ordinary sample data for the GitHub attestations API.

  20. info warn → info by review encoding-base64 ghapi/gh_spec.py:10085:61 new in this release

    base64-like blob (1784 bytes, compression ratio 0.77) (raw pass, confidence 0.60)

                                            'sarif': 'H4sICMLGdF4AA2V4YW1wbGUuc2FyaWYAvVjdbts2FL7PUxDCijaA/CM7iRNfLkPXYgHSNstumlzQ0pHFVCI1korjFgH2ONtr7Ul2KFmy/mOn6QIkjsjDw0/nfN85NL8dEGL9pNwAImqRObECrWM1H40kXQ2XTAfJIlEgXcE1cD10RTQSVDE10K4aKSqZP1AxuKOIKg1ydJU60jSfSh8Hk6EzHA/vlOCWbfa7B6kYPpj90rlsWCZcmbHP5Bs+4oAWIjQD2SMOeJLh2v
    likely benign LLM, confidence 0.90 A gzip-compressed SARIF sample stored as base64 in an API spec example.
    Reasoning

    The H4sI prefix is base64 for gzip. The blob is a compressed SARIF example used as a code-scanning API sample. The raw pass flagged it on size and entropy alone, and nothing in the snippet decodes and runs it.

  21. info warn → info by review encoding-base64 ghapi/gh_spec.py:11487:65 new in this release

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

                                                                   'iQIzBAABAQAdFiEESn/54jMNIrGSE6Tp6cQjvhfv7nAFAlnT71cACgkQ6cQjvhfv\n'
                                                                   '7nCWwA//XVqBKWO0zF+bZl6pggvky3Oc2j1pNFuRWZ29LXpNuD5WUGXGG209B0hI\n'
    likely benign LLM, confidence 0.88 A base64-encoded GPG signature block within a GitHub API spec example.
    Reasoning

    The lines form a base64-encoded GPG signature packet, with the typical 'iQIz...' header and the repeated key ID marker. It is embedded signing data in a spec example and is not executed.

  22. info warn → info by review encoding-base64 ghapi/gh_spec.py:11488:65 new in this release

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

                                                                   '7nCWwA//XVqBKWO0zF+bZl6pggvky3Oc2j1pNFuRWZ29LXpNuD5WUGXGG209B0hI\n'
                                                                   'DkmcGk19ZKUTnEUJV2Xd0R7AW01S/YSub7OYcgBkI7qUE13FVHN5ln1KvH2all2n\n'
    likely benign LLM, confidence 0.88 A continuation line of a base64 GPG signature block in an API example.
    Reasoning

    A continuation of the same GPG signature block in the spec example. Consecutive base64 lines of this kind are expected for armored signature data.

  23. info warn → info by review encoding-base64 ghapi/gh_spec.py:11489:65 new in this release

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

                                                                   'DkmcGk19ZKUTnEUJV2Xd0R7AW01S/YSub7OYcgBkI7qUE13FVHN5ln1KvH2all2n\n'
                                                                   '2+JCV1HcJLEoTjqIFZSSu/sMdhkLQ9/NsmMAzpf/iIM0nQOyU4YRex9eD1bYj6nA\n'
    likely benign LLM, confidence 0.88 Another line of a base64 GPG signature example in the spec file.
    Reasoning

    Another line of the same armored GPG signature sample. Nothing decodes it into code or interacts with the environment.

  24. info warn → info by review encoding-base64 ghapi/gh_spec.py:11490:65 new in this release

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

                                                                   '2+JCV1HcJLEoTjqIFZSSu/sMdhkLQ9/NsmMAzpf/iIM0nQOyU4YRex9eD1bYj6nA\n'
                                                                   'OQPIDdAuaTQj1gFPHYLzM4zJnCqGdRlg0sOM/zC5apBNzIwlgREatOYQSCfCKV7k\n'
    likely benign LLM, confidence 0.88 A further line of a base64 GPG signature example in the spec file.
    Reasoning

    The final visible line of the same GPG signature example, with no execution or dropper behaviour present.

  25. info warn → info by review encoding-base64 ghapi/gh_spec.py:11491:65 new in this release

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

                                                                   'OQPIDdAuaTQj1gFPHYLzM4zJnCqGdRlg0sOM/zC5apBNzIwlgREatOYQSCfCKV7k\n'
                                                                   'nrU34X8b9BzQaUx48Qa+Dmfn5KQ8dl27RNeWAqlkuWyv3pUauH9UeYW+KyuJeMkU\n'
    dismissed LLM, confidence 0.93 Line of an armored PGP signature embedded as test or spec data.
    Reasoning

    The snippet is a line of a PGP signature block embedded in a string literal inside a GitHub API spec module. Line-wrapped base64 is the expected form of an armored signature, and the raw pass flags it only by its format.

  26. info warn → info by review encoding-base64 ghapi/gh_spec.py:11492:65 new in this release

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

                                                                   'nrU34X8b9BzQaUx48Qa+Dmfn5KQ8dl27RNeWAqlkuWyv3pUauH9UeYW+KyuJeMkU\n'
                                                                   '+NyHgAsWFaCFl23kCHThbLStMZOYEnGagrd0hnm1TPS4GJkV4wfYMwnI4KuSlHKB\n'
    dismissed LLM, confidence 0.93 Armored PGP signature continuation line in a spec data string.
    Reasoning

    Another 64-character line of the same armored PGP signature block, with the expected line wrapping. The raw base64 signal reflects the armor format, not hidden code.

  27. info warn → info by review encoding-base64 ghapi/gh_spec.py:11493:65 new in this release

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

                                                                   '+NyHgAsWFaCFl23kCHThbLStMZOYEnGagrd0hnm1TPS4GJkV4wfYMwnI4KuSlHKB\n'
                                                                   'jHl3Js9vNzEUQipQJbgCgTiWvRJoK3ENwBTMVkKHaqT4x9U4Jk/XZB6Q8MA09ezJ\n'
    dismissed LLM, confidence 0.93 Armored PGP signature continuation line in a spec data string.
    Reasoning

    Continuation of the same PGP signature block. The context is a static string literal with no decoding or execution, so it is benign data.

  28. info warn → info by review encoding-base64 ghapi/gh_spec.py:11494:65 new in this release

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

                                                                   'jHl3Js9vNzEUQipQJbgCgTiWvRJoK3ENwBTMVkKHaqT4x9U4Jk/XZB6Q8MA09ezJ\n'
                                                                   '3QgiTjTAGcum9E9QiJqMYdWQPWkaBIRRz5cET6HPB48YNXAAUsfmuYsGrnVLYbG+\n'
    dismissed LLM, confidence 0.93 Armored PGP signature continuation line in a spec data string.
    Reasoning

    Wrapped base64 from the PGP signature armor, consistent with the surrounding lines. Nothing in the snippet decodes or runs the data.

  29. info warn → info by review encoding-base64 ghapi/gh_spec.py:11495:65 new in this release

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

                                                                   '3QgiTjTAGcum9E9QiJqMYdWQPWkaBIRRz5cET6HPB48YNXAAUsfmuYsGrnVLYbG+\n'
                                                                   'UpC6I97VybYHTy2O9XSGoaLeMI9CsFn38ycAxxbWagk5mhclNTP5mezIq6wKSwmr\n'
    dismissed LLM, confidence 0.93 Armored PGP signature continuation line in a spec data string.
    Reasoning

    Another wrapped line of the PGP signature armor, with no executable or decoding context.

  30. info warn → info by review encoding-base64 ghapi/gh_spec.py:11496:65 new in this release

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

                                                                   'UpC6I97VybYHTy2O9XSGoaLeMI9CsFn38ycAxxbWagk5mhclNTP5mezIq6wKSwmr\n'
                                                                   'X11FW3n1J23fWZn5HJMBsRnUCgzqzX3871IqLYHqRJ/bpZ4h20RhTyPj5c/z7QXp\n'
    dismissed LLM, confidence 0.93 Armored PGP signature continuation line in a spec data string.
    Reasoning

    Wrapped base64 line from the same armored signature. The raw pass matched only on its shape.

  31. info warn → info by review encoding-base64 ghapi/gh_spec.py:11497:65 new in this release

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

                                                                   'X11FW3n1J23fWZn5HJMBsRnUCgzqzX3871IqLYHqRJ/bpZ4h20RhTyPj5c/z7QXp\n'
                                                                   'eSakNQMfbbMcljkha+ZMuVQX1K9aRlVqbmv3ZMWh+OijLYVU2bc=\n'
    dismissed LLM, confidence 0.93 Armored PGP signature continuation line in a spec data string.
    Reasoning

    Final body lines of the PGP signature armor, which ends with a checksum line. This is a static signature sample.

  32. info warn → info by review encoding-base64 ghapi/gh_spec.py:11498:65 new in this release

    base64-like blob (52 bytes, compression ratio 1.21) (raw pass, confidence 0.60)

                                                                   'eSakNQMfbbMcljkha+ZMuVQX1K9aRlVqbmv3ZMWh+OijLYVU2bc=\n'
                                                                   '=5Io4\n'
                                                                   '-----END PGP SIGNATURE-----\n'}}},
    dismissed LLM, confidence 0.93 Final armored PGP signature lines including the checksum and END marker.
    Reasoning

    Last armor line of the PGP signature, including the checksum and END marker. The block is complete and static, consistent with example data in a spec file.

  33. info warn → info by review encoding-base64 ghapi/gh_spec.py:13229:66 new in this release

    base64-like blob (150 bytes, compression ratio 0.93) (raw pass, confidence 0.60)

                                       'oidc_token': 'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IlV2R1h4SUhlY0JFc1JCdEttemUxUEhfUERiVSIsImtpZCI6IjUyRjE5N0M0ODFERTcwMTEyQzQ0MUI0QTlCMzdCNTNDN0ZDRjBEQjUifQ.eyJqdGkiOiJhMWIwNGNjNy0zNzZiLTQ1N2QtOTMzNS05NTY5YmVjZDExYTIiLCJzdWIiOiJyZXBvOnBhcGVyLXNwYS9taW55aTplbnZpcm9ubWVudDpQcm9
    likely benign LLM, confidence 0.85 Sample OIDC JWT string assigned to an oidc_token key in a spec fixture.
    Reasoning

    The value is a JWT-shaped token (header beginning eyJ0eXAi... with the RS256 header and a payload) assigned to an 'oidc_token' key in a test or spec fixture. Such values are usually sample or redacted tokens, not a dropper. The raw pass flags its encoding, which is common for JWTs.

  34. info warn → info by review encoding-base64 ghapi/gh_spec.py:13229:1073 new in this release

    base64-like blob (87 bytes, compression ratio 1.13) (raw pass, confidence 0.60)

    U2LCJleHAiOjE2MzkwMDE3NTYsImlhdCI6MTYzOTAwMTQ1Nn0.VP8WictbQECKozE2SgvKb2FqJ9hisWsoMkYRTqfBrQfZTCXi5IcFEdgDMB2X7a99C2DeUuTvHh9RMKXLL2a0zg3-Sd7YrO7a2ll2kNlnvyIypcN6AeIc7BxHsTTnZN9Ud_xmEsTrSRGOEKmzCFkULQ6N4zlVD0sidypmXlMemmWEcv_ZHqhioEI_VMp5vwXQurketWH7qX4oDgG4okyYtPrv5RQHbfQcVo9izaPJ_jnsDd0CBA0QOx9InjPidtIkMYQLyUgJy33HLJ
    likely benign LLM, confidence 0.85 JWT signature segment in a sample OIDC token fixture.
    Reasoning

    This is the signature segment of a JWT, a long base64url string with no decoding or execution around it. It fits the same sample-token fixture as the preceding JWT finding.

  35. info warn → info by review encoding-base64 ghapi/gh_spec.py:13229:1306 new in this release

    base64-like blob (109 bytes, compression ratio 1.01) (raw pass, confidence 0.60)

    _VMp5vwXQurketWH7qX4oDgG4okyYtPrv5RQHbfQcVo9izaPJ_jnsDd0CBA0QOx9InjPidtIkMYQLyUgJy33HLJy86EFNUnAf8UhBQuQi5mAsEpEzBBuKpG3PDiPtYCHOk64JZkZGd5mR888a5sbHRiaF8hm8YA'}}},
    likely benign LLM, confidence 0.85 Tail of a sample JWT signature in a static fixture.
    Reasoning

    Tail of the same JWT signature string in a static fixture. It is base64url data with no obfuscation or execution context, so the raw signal is only a format match.

  36. info long-line README.md:196:1

    line length 967 characters (raw pass, confidence 0.50)

    [`ghapi`]https://ghapi.fast.ai/cli.html#ghapi also layers task-level conveniences over the generated endpoints – see the [GhApi details]https://ghapi.fast.ai/core.html page for the full set. Highlights: [`paged`]https://ghapi.fast.ai/page.html#paged/[`pages`]https://ghapi.fast.ai/page.html#pages iterate any l
  37. info critical → info by review dynamic-execution README.md:233:1

    [embedded bash] `eval` called on a dynamic (variable/substitution) expression (ast pass, confidence 0.90)

    eval "$(completion-ghapi --install)"
    likely benign LLM, confidence 0.80 A markdown install snippet evaluates the output of the ghapi completion installer.
    Reasoning

    The eval wraps output of the package's own completion-install command, a common shell-completion setup idiom. It is a dynamic eval, so it warrants a note, but the snippet shows no download, encoding, or hidden payload.

  38. info warn → info by review decoder-import-with-exec ghapi/event.py:71:17

    file imports decoder module(s) gzip and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)

    
    for o in Event: exec(f'class {snake2camel(o)}Event(GhEvent):pass')
    
    # %% ../nbs/04_event.ipynb #8232d504
    likely benign LLM, confidence 0.85 Generates GhEvent subclasses via exec over a fixed list of event names.
    Reasoning

    The exec builds event classes from a known Event list using a fixed f-string, which is nbdev-style code generation. The gzip import is not shown being used to decode a hidden payload in this snippet.

  39. info warn → info by review dynamic-attribute ghapi/event.py:85:26

    reach-by-name through `globals` (ast pass, confidence 0.60)

    # %% ../nbs/04_event.ipynb #4de78d50
    def _cast_evt(o): return globals()[o.type](o)
    
    # %% ../nbs/04_event.ipynb #e3e61809
    likely benign LLM, confidence 0.85 Resolves an event class by name from globals() to wrap an event object.
    Reasoning

    Looking up a class by name in globals() using the event type string is a plain dispatch idiom. The name comes from the GitHub event type, and the snippet shows no attacker-controlled execution.

  40. info high-complexity ghapi/gh_spec.py:1502:37

    compression ratio 0.869 is >2σ above file mean 0.701 (raw pass, confidence 0.50)

                             'before': 'Only show notifications updated before the given time. This is a timestamp in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format: `YYYY-MM-DDTHH:MM:SSZ`.',
  41. info high-complexity ghapi/gh_spec.py:9572:41

    compression ratio 0.886 is >2σ above file mean 0.701 (raw pass, confidence 0.50)

                             'external_id': "A reference for the run on the integrator's system.",
                             'started_at': 'The time that the check run began. This is a timestamp in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format: `YYYY-MM-DDTHH:MM:SSZ`.',
  42. info high-complexity ghapi/gh_spec.py:9574:43

    compression ratio 0.904 is >2σ above file mean 0.701 (raw pass, confidence 0.50)

                             'completed_at': 'The time the check completed. This is a timestamp in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format: `YYYY-MM-DDTHH:MM:SSZ`.',
  43. info high-complexity ghapi/gh_spec.py:9624:43

    compression ratio 0.904 is >2σ above file mean 0.701 (raw pass, confidence 0.50)

                             'completed_at': 'The time the check completed. This is a timestamp in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format: `YYYY-MM-DDTHH:MM:SSZ`.',
  44. info high-complexity ghapi/gh_spec.py:10079:41

    compression ratio 0.874 is >2σ above file mean 0.701 (raw pass, confidence 0.50)

                             'started_at': 'The time that the analysis run began. This is a timestamp in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format: `YYYY-MM-DDTHH:MM:SSZ`.',
  45. info high-complexity ghapi/gh_spec.py:13014:37

    compression ratio 0.915 is >2σ above file mean 0.701 (raw pass, confidence 0.50)

                             'description': 'A description of the milestone.',
                             'due_on': 'The milestone due date. This is a timestamp in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format: `YYYY-MM-DDTHH:MM:SSZ`.'},
  46. info high-complexity ghapi/gh_spec.py:13044:37

    compression ratio 0.915 is >2σ above file mean 0.701 (raw pass, confidence 0.50)

                             'description': 'A description of the milestone.',
                             'due_on': 'The milestone due date. This is a timestamp in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format: `YYYY-MM-DDTHH:MM:SSZ`.'},
  47. info high-complexity ghapi/gh_spec.py:13088:37

    compression ratio 0.869 is >2σ above file mean 0.701 (raw pass, confidence 0.50)

                             'before': 'Only show notifications updated before the given time. This is a timestamp in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format: `YYYY-MM-DDTHH:MM:SSZ`.',
  48. info high-complexity ghapi/gh_spec.py:16210:36

    compression ratio 0.854 is >2σ above file mean 0.701 (raw pass, confidence 0.50)

                             'since': 'Only show repositories updated after the given time. This is a timestamp in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format: `YYYY-MM-DDTHH:MM:SSZ`.',
  49. info high-complexity ghapi/gh_spec.py:16211:37

    compression ratio 0.868 is >2σ above file mean 0.701 (raw pass, confidence 0.50)

                             'before': 'Only show repositories updated before the given time. This is a timestamp in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format: `YYYY-MM-DDTHH:MM:SSZ`.'},
              'docs_url': 'https://docs.github.com/rest/repos/repos#list-repositories-for-the-authenticated-user'},
  50. info high-complexity ghapi/gql_spec.py:593:38

    compression ratio 0.870 is >2σ above file mean 0.683 (raw pass, confidence 0.50)

    'Float': {'kind': 'SCALAR', 'desc': 'Represents signed double-precision fractional values as specified by [IEEE 754](https://en.wikipedia.org/wiki/IEEE_floating_point).'},
  51. info high-complexity ghapi/gql_spec.py:941:349

    compression ratio 0.840 is >2σ above file mean 0.683 (raw pass, confidence 0.50)

    icateOf': {'type': 'IssueOrPullRequest', 'desc': 'The issue or pull request the suggestion proposes marking this issue as a duplicate of. Only set when `stateReason` is `DUPLICATE`.', 'args': {}}, 'rationale': {'type': 'String', 'desc': 'The rationale provided for suggesting this close.', 'args': {}}, 'stateReason': {'
  52. info high-complexity ghapi/gql_spec.py:1773:19706

    compression ratio 0.906 is >2σ above file mean 0.683 (raw pass, confidence 0.50)

    ributionTypes': ['[RepositoryContributionType]', 'If non-null, include only the specified types of contributions. The GitHub.com UI uses [COMMIT, ISSUE, PULL_REQUEST, REPOSITORY]', None], 'after': ['String', 'Returns the elements in the list that come after the specified cursor.', None], 'before': ['String', 'Returns t

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/fastai/ghapi ghapi && cd ghapi
git checkout 2.1.4
disclude scan --severity info --diff 2.1.3 .