disclude.ioghapi 2.1.4
- Source
- https://github.com/fastai/ghapi
- Artifact scanned
ghapi-2.1.4-py3-none-any.whl- Compared with
ghapi-2.1.3-py3-none-any.whl(35 signals introduced since)- Files
- 17 scanned, 5 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 50 info
- Scan time
- 26.2 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 37 of 37 warn and critical signals; 37 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-23 08:57
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
:dismissed Base64 keyId value in a Sigstore verification example within the GitHub API spec.Reasoning
The blob is a base64 keyId inside an OpenAPI spec's Sigstore transparency-log example data. It is documentation content, not a payload.
-
: ,dismissed Base64 signedEntryTimestamp example in the GitHub API spec.Reasoning
The value is a base64 signed entry timestamp in a Sigstore inclusion promise example in a generated API spec file. This is expected data.
-
: ,dismissed Base64 rootHash value in the GitHub API spec's attestation example.Reasoning
A 32-byte base64 rootHash in a Merkle-proof example within the API spec data, a typical format for such hashes.
-
:dismissed Base64 hash entries in the GitHub API spec.Reasoning
An array of base64 SHA-256 digests in the API spec data. Hashes are ordinary content here and the file is a static schema.
-
,dismissed Base64 digest-like value in the GitHub API spec.Reasoning
A base64 SHA-256 digest-like string in a generated spec file. It is data, not executable code, and the raw pass fires on encoding alone.
-
,dismissed Base64 digest-like value in the GitHub API spec.Reasoning
Same pattern as the other spec-embedded digests: a 32-byte base64 value in static JSON-like data in a generated spec file.
-
,dismissed Base64 digest-like value in the GitHub API spec.Reasoning
A base64 SHA-256 hash-shaped string in static spec data. The raw pass flags it on format only.
-
,dismissed Base64 digest-like value in the GitHub API spec.Reasoning
A base64 hash-shaped value inside a dictionary literal in a generated API spec. It is not decoded or executed anywhere in the snippet.
-
,dismissed Base64 digest-like value in the GitHub API spec.Reasoning
A base64 hash-shaped string in static spec data, consistent with the rest of the file's hashes.
-
,dismissed Base64 digest-like value in the GitHub API spec.Reasoning
A base64 hash-shaped string in static spec data. The raw pass flags encoding without any execution context.
-
,dismissed Base64 digest-like value in the GitHub API spec.Reasoning
A base64 hash-shaped string in static spec data, with no decode or execution nearby.
-
,dismissed Base64 digest-like value in the GitHub API spec.Reasoning
A base64 hash-shaped string in static spec data. The raw pass flags encoding alone, and the file is a generated schema.
-
,likely benign A 32-byte base64 digest-like string within a GitHub API specification data structure.Reasoning
Raw-pass base64 match on a 44-byte value (32 bytes of digest, typical of a SHA-256 hash or signature) inside what appears to be a static GitHub API spec embedded as Python data. Nothing in the snippet decodes or executes it, and the file context is consistent with schema or example data.
-
,likely benign A base64 digest-like string in a list of static GitHub API spec values.Reasoning
Same pattern as its neighbours: a 44-character base64 value of digest size inside static API spec data, with no decode or execution path visible.
-
,likely benign A base64 digest-like string in a static GitHub API spec list.Reasoning
A 44-character base64 value of digest size in a static list of spec data. Consistent with example hashes or key fingerprints, with no dynamic use visible.
-
],likely benign A base64 digest-like string closing a static GitHub API spec list.Reasoning
Final element of the same static list of base64 digest-sized values. Nothing indicates a payload or runtime decoding.
-
:likely benign A Rekor checkpoint envelope containing a base64 root hash in attestation example data.Reasoning
The snippet is a Sigstore/Rekor transparency-log checkpoint envelope, with a signed-note format containing the tree-root hash. This is standard attestation example data embedded in an API spec, not a dropper.
-
}},likely benign A base64 ECDSA signature in a Sigstore attestation example.Reasoning
The 100-byte blob is an ECDSA DER signature (base64 starting with MEUCI/MEQCI), placed in a Sigstore attestation example with a trailing newline. It is signature data in a documentation-style structure.
-
: }}}}}, : },likely benign A base64 ECDSA signature in an attestation example's signatures field.Reasoning
The 96-byte value is a base64 DER ECDSA signature ('MEQCI...') in a 'signatures' field of an attestation example, alongside a docs_url. This matches the structure of documented API examples.
-
:likely benign A base64 gzip-compressed SARIF example in a GitHub code-scanning API spec.Reasoning
The 'H4sI' prefix is a base64-encoded gzip stream. Here it holds a SARIF example payload, a common format for code-scanning API examples. Compressed example data in a static spec has no malicious signal, and nothing decodes or runs it in the snippet.
-
likely benign A base64 OpenPGP signature block in static spec example data.
Reasoning
The 'iQIzBAAB' prefix is a base64 OpenPGP signature packet with an embedded key-id-style value, the typical form of an example GPG signature or public key in a GitHub API spec for signing and verification. Multi-line string constant, no decode or execution.
-
likely benign A continuation line of a base64 OpenPGP example block in a spec file.
Reasoning
Continuation of the same base64 OpenPGP-style example block, split across literal lines. It is static string data with no runtime use.
-
likely benign Another base64 OpenPGP example line in static spec data.
Reasoning
Another continuation line of the same base64 OpenPGP-style example. Static data consistent with documented signing examples.
-
likely benign The last base64 OpenPGP example line in a static spec block.
Reasoning
Final line of the same base64 OpenPGP-style example, with no decoding or execution visible. It is documentation or fixture text in a generated API spec.
-
likely benign A wrapped base64 line from an embedded PGP signature block in a generated GitHub API spec.
Reasoning
Raw-pass base64 match on a line-wrapped string inside a large generated API spec. The lines are a PGP signature block embedded as example data, a common pattern in fixtures and docs. Raw findings have a high false-positive rate and nothing here executes or decodes anything.
-
likely benign Another wrapped base64 line from the same embedded PGP signature block.
Reasoning
Continuation of the same embedded PGP signature block. It is plain data in a spec file with no decoding or execution path.
-
likely benign A wrapped base64 line of the embedded PGP signature block.
Reasoning
Same PGP signature block continuation, a static string literal with no runtime use visible in the snippet.
-
likely benign A wrapped base64 line of the embedded PGP signature block.
Reasoning
Static base64 text in the PGP signature block of an API spec example. The compression ratio of 1.17 is typical of random-looking base64 and says nothing about hidden payloads.
-
likely benign A wrapped base64 line of the embedded PGP signature block.
Reasoning
Same embedded PGP signature block, plain data in a spec file.
-
likely benign A wrapped base64 line of the embedded PGP signature block.
Reasoning
Same embedded PGP signature block, plain data in a spec file.
-
likely benign The closing base64 lines of an embedded PGP signature block.
Reasoning
Final body lines of the PGP signature block, followed by the armor footer. Static data with no code path.
-
}}},likely benign The checksum line and END marker of an embedded PGP signature block.Reasoning
Trailing checksum and END marker of the PGP signature block, a standard armored-signature structure in example data.
-
:likely benign A sample GitHub OIDC JWT stored as a string literal in the API spec file.Reasoning
The 'oidc_token' value is a JWT with a standard header (typ JWT, RS256) and a claims segment about a GitHub Actions repository and environment. It appears as a string literal in a spec or test fixture. Its content is an identifiable public-format token example, not an encoded dropper.
-
-likely benign The signature portion of the sample JWT string in the spec file.Reasoning
The snippet is the signature segment of a JWT-shaped token inside the same string literal, with the usual base64url alphabet. It is test or example data, not executed code.
-
likely benign The tail of the sample JWT signature string in the spec file.
Reasoning
Tail of the same sample JWT signature string, static literal data. Nothing decodes or executes it.
-
# %% ../nbs/04_event.ipynb #8232d504likely benign Dynamically generates event subclass definitions via exec of an f-string class template.Reasoning
The exec call builds small wrapper classes named after GitHub event types, a standard nbdev-generated pattern. The gzip import sits in the same module but the snippet shows no decoding of a payload, so the multi-stage shape is not evident.
-
# %% ../nbs/04_event.ipynb #4de78d50 return # %% ../nbs/04_event.ipynb #e3e61809likely benign Resolves an event class from globals() using the event's type field.Reasoning
Looks up a class by name in module globals from the event type string. This is ordinary dispatch for a library that maps GitHub event names to generated classes, with no external input reaching a dangerous sink.
-
: , -
: , : , -
: , -
: , -
: , -
: , : }, -
: , : }, -
: , -
: , -
: }, : }, -
: , -
or `` is ``. }, : -
-, in None], :
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|