google-auth 2.62.0

Source: https://github.com/googleapis/google-cloud-python
Tag scanned: google-auth-v2.62.0
Directory: packages/google-auth (only this part of the repository was scanned)
Compared with: google-auth-v2.61.0 (0 signals introduced since)
Files: 237 scanned, 44 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 39 info
Scan time: 26.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 37 of 37 warn and critical signals; 37 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:20

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info long-line packages/google-auth/CHANGELOG.md:1714:1

line length 630 characters (raw pass, confidence 0.50)

* **google.auth.compute_engine.metadata:** add retry to google.auth.compute_engine._metadata.get() ([#398](https://www.github.com/googleapis/google-auth-library-python/issues/398)) ([af29c1a](https://www.github.com/googleapis/google-auth-library-python/commit/af29c1a9fd9282b38867961e4053f74f018a3815)), closes [#211](ht

info long-line packages/google-auth/CHANGELOG.md:2019:1

line length 631 characters (raw pass, confidence 0.50)

- Added system tests for all credential types. ([#51](https://github.com/googleapis/google-auth-library-python/pull/51), [#54](https://github.com/googleapis/google-auth-library-python/pull/54), [#56](https://github.com/googleapis/google-auth-library-python/pull/56), [#58](https://github.com/googleapis/google-auth-libra

info ~~warn~~ → info by review dynamic-execution packages/google-auth/docs/user-guide.rst:391:8

[embedded bash] command name is a variable (`$EXECUTABLE_COMMAND`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
       # e.g. --executable-command="/path/to/command --foo=bar"
       --executable-command=$EXECUTABLE_COMMAND \
       # Optional argument for the executable timeout. Defaults to 30s.
       # --executable-timeout-millis=$EXECUTABLE_TIMEOUT \
```
likely benign LLM, confidence 0.85 Docs example of a gcloud/credential-config command with a placeholder executable command variable.
Reasoning
Documentation example showing a placeholder shell variable for an executable command in an embedded bash snippet; the variable is user-supplied configuration in docs, not malicious execution.
info ~~warn~~ → info by review dynamic-execution packages/google-auth/docs/user-guide.rst:881:9

[embedded bash] command name is a variable (`$EXECUTABLE_COMMAND`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
        # e.g. --executable-command="/path/to/command --foo=bar"
        --executable-command=$EXECUTABLE_COMMAND \
        # Optional argument for the executable timeout. Defaults to 30s.
        # --executable-timeout-millis=$EXECUTABLE_TIMEOUT \
```
likely benign LLM, confidence 0.85 Repeated docs example using $EXECUTABLE_COMMAND placeholder in a bash snippet.
Reasoning
Same placeholder pattern repeated in the user guide; it documents a configurable executable command, not hidden execution.
info ~~warn~~ → info by review dynamic-execution packages/google-auth/docs/user-guide.rst:887:9

[embedded bash] command name is a variable (`$WORKFORCE_POOL_USER_PROJECT`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
        # --executable-output-file=$EXECUTABLE_OUTPUT_FILE \
        --workforce-pool-user-project=$WORKFORCE_POOL_USER_PROJECT \
        --output-file /path/to/generated/config.json
```
likely benign LLM, confidence 0.85 Docs example using $WORKFORCE_POOL_USER_PROJECT placeholder in a bash command.
Reasoning
Documentation placeholder for a workforce pool project flag in an example command; no real execution path in the file.
info ~~critical~~ → info by review dynamic-execution packages/google-auth/setup.py:97:5

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
with open(os.path.join(package_root, "google/auth/version.py")) as fp:
    exec(fp.read(), version)
version = version["__version__"]
```
likely benign LLM, confidence 0.90 setup.py executes the package's version.py to read __version__ at build time.
Reasoning
This is the well-known google-auth pattern of exec'ing version.py read from the package's own source tree to obtain __version__. The argument is a local file read, not attacker-controlled input, but exec at module scope in setup.py is still a notable pattern worth a human glance.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/compute_engine/test__metadata.py:43:7

14 rows of base64-like lines, lines 43-58 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
    b"-----BEGIN CERTIFICATE-----\n"
    b"MIIDIzCCAgugAwIBAgIJAMfISuBQ5m+5MA0GCSqGSIb3DQEBBQUAMBUxEzARBgNV\n"
    b"BAMTCnVuaXQtdGVzdHMwHhcNMTExMjA2MTYyNjAyWhcNMjExMjAzMTYyNjAyWjAV\n"
    b"MRMwEQYDVQQDEwp1bml0LXRlc3RzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\n"
```
likely benign LLM, confidence 0.90 Test fixture containing a PEM-encoded certificate.
Reasoning
A PEM certificate split across byte-string lines in a test fixture; base64 of a certificate is expected and harmless.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_agent_identity_utils.py:32:7

14 rows of base64-like lines, lines 32-47 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
    b"-----BEGIN CERTIFICATE-----\n"
    b"MIIDIzCCAgugAwIBAgIJAMfISuBQ5m+5MA0GCSqGSIb3DQEBBQUAMBUxEzARBgNV\n"
    b"BAMTCnVuaXQtdGVzdHMwHhcNMTExMjA2MTYyNjAyWhcNMjExMjAzMTYyNjAyWjAV\n"
    b"MRMwEQYDVQQDEwp1bml0LXRlc3RzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\n"
```
likely benign LLM, confidence 0.90 Test fixture containing a PEM-encoded certificate.
Reasoning
Test fixture of a PEM certificate in byte-string form; expected test data.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_agent_identity_utils.py:60:7

16 rows of base64-like lines, lines 60-75 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
    b"-----BEGIN CERTIFICATE-----\n"
    b"MIIDEjCCAfqgAwIBAgIUKZAXnXnxf8hsn+ojS1N8bN3hXrUwDQYJKoZIhvcNAQEL\n"
    b"BQAwHjEcMBoGA1UEAwwTYWdlbnQtaWRlbnRpdHktdGVzdDAeFw0yNDAxMDEwMDAw\n"
    b"MDBaFw0zNDAxMDEwMDAwMDBaMB4xHDAaBgNVBAMME2FnZW50LWlkZW50aXR5LXRl\n"
```
likely benign LLM, confidence 0.90 Second PEM certificate test fixture in the agent identity tests.
Reasoning
Another PEM certificate test fixture; benign test data.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:74:10

base64-like blob (239 bytes, compression ratio 0.90) (raw pass, confidence 0.60)
```
TOKEN = "AQoEXAMPLEH4aoAH0gNCAPyJxz4BlCFFxWNE1OPTgk5TthT+FvwqnKwRcOIfrRh3c/LTo6UDdyJwOOvEVPvLXCrrrUtdnniCEXAMPLE/IvU1dYUg2RVAJBanLiHb4IgRmpRV3zrkuWJOgQs8IZZaIv2BXIa2R4OlgkBN9bkUDNCJiBeb/AXlzBBko7b15fjrBs2+cTQtpZ3CYWFXG8C5zqx37wnOE49mRl/+OtkIKGO7fAE"
# To avoid json.dumps() differing behavior from one version to other,
```
likely benign LLM, confidence 0.90 AWS documentation sample session token string in test data.
Reasoning
AWS example token from the AWS documentation (AKIDEXAMPLE-style sample values) used in tests; not a live credential.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:183:138

base64-like blob (74 bytes, compression ratio 0.96) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=b27ccfbfa7df52a200ff74193ca6e32d4b48b8856fab7ebf1c595d0670a7e470",
                "host": "host.foo.com",
```
likely benign LLM, confidence 0.90 AWS SigV4 example Authorization header in test fixture.
Reasoning
AWS Signature V4 example header with the documented AKIDEXAMPLE sample credential and signature from AWS's test vectors; benign.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:208:138

base64-like blob (74 bytes, compression ratio 0.96) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=b27ccfbfa7df52a200ff74193ca6e32d4b48b8856fab7ebf1c595d0670a7e470",
                "host": "host.foo.com",
```
likely benign LLM, confidence 0.95 Hex SigV4 signature string in AWS test fixture flagged as base64 blob.
Reasoning
Raw-pass base64 heuristic firing on a hex AWS Signature value inside an AWS Signature V4 example test fixture; hex digits look like base64 to the entropy/compression check. Benign test data.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:233:138

base64-like blob (74 bytes, compression ratio 0.96) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=b27ccfbfa7df52a200ff74193ca6e32d4b48b8856fab7ebf1c595d0670a7e470",
                "host": "host.foo.com",
```
dismissed LLM, confidence 0.97 Hex SigV4 signature in an AWS test fixture header, flagged as base64 by the raw pass.
Reasoning
The flagged blob is a hex AWS SigV4 signature inside an Authorization header in a test file using AWS's documented example credentials (AKIDEXAMPLE, host.foo.com). Hex strings are misdetected as base64 by the raw pass; no obfuscation or malicious intent.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:258:138

base64-like blob (74 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=910e4d6c9abafaf87898e1eb4c929135782ea25bb0279703146455745391e63a",
                "host": "host.foo.com",
```
dismissed LLM, confidence 0.97 Hex SigV4 signature in an AWS test fixture header, flagged as base64 by the raw pass.
Reasoning
Same pattern: a hex AWS signature in a test fixture using the public AKIDEXAMPLE example credentials. Raw-pass false positive on a hex digest.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:283:138

base64-like blob (74 bytes, compression ratio 0.96) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=8d6634c189aa8c75c2e51e106b6b5121bed103fdb351f7d7d4381c738823af74",
                "host": "host.foo.com",
```
dismissed LLM, confidence 0.97 Hex SigV4 signature in an AWS test fixture header, flagged as base64 by the raw pass.
Reasoning
Hex signature in a test-suite AWS Authorization header with example credentials; the base64 signal is a false positive on hex characters.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:308:138

base64-like blob (74 bytes, compression ratio 0.97) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=be7148d34ebccdc6423b19085378aa0bee970bdc61d144bd1a8c48c33079ab09",
                "host": "host.foo.com",
```
dismissed LLM, confidence 0.97 Hex SigV4 signature in an AWS test fixture header, flagged as base64 by the raw pass.
Reasoning
Hex SigV4 test signature with documented example credentials; no evidence of obfuscation.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:333:138

base64-like blob (74 bytes, compression ratio 0.95) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=feb926e49e382bec75c9d7dcb2a1b6dc8aa50ca43c25d2bc51143768c0875acc",
                "host": "host.foo.com",
```
dismissed LLM, confidence 0.97 Hex SigV4 signature in an AWS test fixture header, flagged as base64 by the raw pass.
Reasoning
Hex SigV4 test signature with documented example credentials; raw-pass false positive.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:362:138

base64-like blob (74 bytes, compression ratio 0.99) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=6fb359e9a05394cc7074e0feb42573a2601abc0c869a953e8c5c12e4e01f1a8c",
                "host": "host.foo.com",
```
dismissed LLM, confidence 0.97 Hex SigV4 signature in an AWS test fixture header, flagged as base64 by the raw pass.
Reasoning
Hex SigV4 test signature with example credentials; the base64 detection is spurious.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:387:142

base64-like blob (74 bytes, compression ratio 0.95) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host;zoo, Signature=b7a95a52518abbca0964a999a880429ab734f35ebbf1235bd79a5de87756dc4a",
                "host": "host.foo.com",
```
dismissed LLM, confidence 0.97 Hex SigV4 signature in an AWS test fixture header, flagged as base64 by the raw pass.
Reasoning
Hex SigV4 test signature (SignedHeaders includes zoo) with example credentials in a test file; benign.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:413:142

base64-like blob (74 bytes, compression ratio 0.95) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host;zoo, Signature=273313af9d0c265c531e11db70bbd653f3ba074c1009239e8559d3987039cad7",
                "host": "host.foo.com",
```
dismissed LLM, confidence 0.97 Hex SigV4 signature in an AWS test fixture header, flagged as base64 by the raw pass.
Reasoning
Hex SigV4 test signature with example credentials in test code; benign raw-pass false positive.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:439:140

base64-like blob (74 bytes, compression ratio 0.95) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host;p, Signature=debf546796015d6f6ded8626f5ce98597c33b47b9164cf6b17b4642036fcb592",
                "host": "host.foo.com",
```
dismissed LLM, confidence 0.97 Hex SigV4 signature in an AWS test fixture header, flagged as base64 by the raw pass.
Reasoning
Hex SigV4 test signature (SignedHeaders includes p) with example credentials in a test file; benign.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:469:151

base64-like blob (74 bytes, compression ratio 0.99) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=content-type;date;host, Signature=5a15b22cf462f047318703b92e6f4f38884e4a7ab7b1d6426ca46a8bd1c26cbc",
                "host": "host.foo.com",
```
likely benign LLM, confidence 0.93 AWS SigV4 Authorization header with a documentation-example signature in a test fixture.
Reasoning
The flagged value is a hex AWS SigV4 Signature in a unit test. The Credential uses AKIDEXAMPLE, the placeholder key from AWS's own documentation, and the host is host.foo.com. The base64 signal is a false positive on a hex string in test code.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:496:138

base64-like blob (74 bytes, compression ratio 0.95) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=b6e3b79003ce0743a491606ba1035a804593b0efb1e20a11cba83f8c25a57a92",
                "host": "host.foo.com",
```
likely benign LLM, confidence 0.93 AWS SigV4 Authorization header with a documentation-example signature in a test fixture.
Reasoning
Same pattern as the other AWS test lines: an AWS documentation example credential (AKIDEXAMPLE) and a hex signature used as test input. Nothing here runs or exfiltrates anything.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:521:110

base64-like blob (74 bytes, compression ratio 0.95) (raw pass, confidence 0.60)
```
                + ACCESS_KEY_ID
                + "/20200811/us-east-2/ec2/aws4_request, SignedHeaders=host;x-amz-date;x-amz-security-token, Signature=41e226f997bf917ec6c9b2b14218df0874225f13bb153236c247881e614fafc9",
                "host": "ec2.us-east-2.amazonaws.com",
```
likely benign LLM, confidence 0.92 Test-constructed AWS SigV4 header for an EC2 request with a hex signature.
Reasoning
The signed header is built from ACCESS_KEY_ID in a test for an EC2 request. The signature is a hex string flagged as base64. It is expected test data for request signing.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:547:110

base64-like blob (74 bytes, compression ratio 0.92) (raw pass, confidence 0.60)
```
                + ACCESS_KEY_ID
                + "/20200811/us-east-2/sts/aws4_request, SignedHeaders=host;x-amz-date;x-amz-security-token, Signature=596aa990b792d763465d73703e684ca273c45536c6d322c31be01a41d02e5b60",
                "host": "sts.us-east-2.amazonaws.com",
```
likely benign LLM, confidence 0.92 Test-constructed AWS SigV4 header for an STS request with a hex signature.
Reasoning
A test for an STS signed request. The base64 flag is triggered by a hex signature, and the header is built from a test constant. There is no sign of malicious intent.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:569:89

base64-like blob (74 bytes, compression ratio 0.96) (raw pass, confidence 0.60)
```
                + ACCESS_KEY_ID
                + "/20200811/us-east-2/sts/aws4_request, SignedHeaders=host;x-amz-date, Signature=9e722e5b7bfa163447e2a14df118b45ebd283c5aea72019bdf921d6e7dc01a9a",
                "host": "sts.us-east-2.amazonaws.com",
                "x-amz-date": "20200811T065522Z",
```
likely benign LLM, confidence 0.92 Test-constructed AWS SigV4 header for an STS request with a hex signature.
Reasoning
A test fixture for signing an STS request. The flagged content is a hex signature in an Authorization header, which is ordinary for SigV4 tests.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:599:141

base64-like blob (74 bytes, compression ratio 1.00) (raw pass, confidence 0.60)
```
                + ACCESS_KEY_ID
                + "/20200811/us-east-2/dynamodb/aws4_request, SignedHeaders=content-type;host;x-amz-date;x-amz-security-token;x-amz-target, Signature=eb8bce0e63654bba672d4a8acb07e72d69210c1797d56ce024dbbc31beb2a2c7",
                "host": "dynamodb.us-east-2.amazonaws.com",
```
likely benign LLM, confidence 0.92 Test-constructed AWS SigV4 header for a DynamoDB request with a hex signature.
Reasoning
A DynamoDB signing test. The signature is a hex string flagged by a base64 heuristic, and the header is assembled from test constants in a test file.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/transport/test__custom_tls_signer.py:82:44

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
    assert (
        base64.b64encode(sig).decode() == "RG5gyEH8CAAh3lxgbt2PLPAHPO8p6i9+cn5dqHfUUYM="
    )
```
likely benign LLM, confidence 0.90 Expected base64-encoded signature value in a TLS signer unit test assertion.
Reasoning
The base64 string is the expected output of an assertion comparing a signature to a known value. It is test data, not an obfuscated payload.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/transport/test__mtls_helper.py:36:1

base64-like blob (332 bytes over 6 lines, compression ratio 0.83) (raw pass, confidence 0.60)
```
ENCRYPTED_EC_PRIVATE_KEY = b"""-----BEGIN ENCRYPTED PRIVATE KEY-----
MIH0MF8GCSqGSIb3DQEFDTBSMDEGCSqGSIb3DQEFDDAkBBClWcQyUELNC9Hjr+Sp
WK85AgIIADAMBggqhkiG9w0CCQUAMB0GCWCGSAFlAwQBKgQQ6uJeoqE7P9HtxAgS
n6rBFgSBkMRDYXLucNp7ew7LbQmkZCmjnRhgyw6b0dD3eK8f3jisj8UiR8aj9a2S
```
likely benign LLM, confidence 0.90 Encrypted EC private key PEM fixture in an mTLS helper test.
Reasoning
An encrypted PEM private key literal in a test module for mTLS helpers. It is a standard fixture for testing encrypted key handling. The raw pass flags the armored base64 body, which is expected for PEM.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/transport/test__mtls_helper.py:45:1

base64-like blob (124 bytes over 2 lines, compression ratio 1.03) (raw pass, confidence 0.60)
```
EC_PUBLIC_KEY = b"""-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEwdsHzL05VUmqYJat2yGdbSHQAg49
Wc+fhwLH3b+SCC/2/TqPNDy9yMdMxMtEfZfKal2EaeE2erJrtu7WNfjD0Q==
-----END PUBLIC KEY-----"""
```
likely benign LLM, confidence 0.90 EC public key PEM fixture in an mTLS helper test.
Reasoning
A public key PEM fixture in a test file. PEM bodies are base64 by design, and a public key cannot be used to attack anything here.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/transport/test__mtls_helper.py:108:9

base64-like blob (104 bytes over 2 lines, compression ratio 1.04) (raw pass, confidence 0.60)
```
        KEY = b"""-----BEGIN PRIVATE KEY-----
        MIIBCgKCAQEA4ej0p7bQ7L/r4rVGUz9RN4VQWoej1Bg1mYWIDYslvKrk1gpj7wZg
        /fy3ZpsL7WqgsZS7Q+0VRK8gKfqkxg5OYQIDAQAB
        -----END PRIVATE KEY-----"""
```
likely benign LLM, confidence 0.90 Private key PEM fixture embedded in an mTLS helper test function.
Reasoning
A private key PEM literal inside a test function. The raw pass flags the armored base64 body. This is typical test-key material and does not show obfuscation.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/transport/test__mtls_helper.py:112:9

base64-like blob (104 bytes over 2 lines, compression ratio 1.04) (raw pass, confidence 0.60)
```
        RSA_KEY = b"""-----BEGIN RSA PRIVATE KEY-----
        MIIBCgKCAQEA4ej0p7bQ7L/r4rVGUz9RN4VQWoej1Bg1mYWIDYslvKrk1gpj7wZg
        /fy3ZpsL7WqgsZS7Q+0VRK8gKfqkxg5OYQIDAQAB
        -----END RSA PRIVATE KEY-----"""
```
likely benign LLM, confidence 0.90 Test fixture containing a fake RSA private key PEM block used for mTLS helper tests.
Reasoning
Raw pass base64 flag on a PEM-delimited RSA key constant in a test module for mTLS helper; the content is clearly test fixture data (the key body is a short, well-formed fake with repeated test-like content). Test fixtures containing PEM blocks are a standard legitimate pattern, not obfuscation.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/transport/test__mtls_helper.py:116:9

base64-like blob (104 bytes over 2 lines, compression ratio 1.04) (raw pass, confidence 0.60)
```
        EC_KEY = b"""-----BEGIN EC PRIVATE KEY-----
        MIIBCgKCAQEA4ej0p7bQ7L/r4rVGUz9RN4VQWoej1Bg1mYWIDYslvKrk1gpj7wZg
        /fy3ZpsL7WqgsZS7Q+0VRK8gKfqkxg5OYQIDAQAB
        -----END EC PRIVATE KEY-----"""
```
likely benign LLM, confidence 0.90 Test fixture containing a fake EC private key PEM block.
Reasoning
Same pattern as the RSA fixture: a PEM-delimited EC private key placeholder in a test file, flagged only because PEM bodies look base64-like. Raw-pass false positive on test data.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/transport/test_requests.py:73:47

18 rows of base64-like lines, lines 73-74 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
CERT_MOCK_VAL = b"-----BEGIN CERTIFICATE-----\nMIIDIzCCAgugAwIBAgIJAMfISuBQ5m+5MA0GCSqGSIb3DQEBBQUAMBUxEzARBgNV\nBAMTCnVuaXQtdGVzdHMwHhcNMTExMjA2MTYyNjAyWhcNMjExMjAzMTYyNjAyWjAV\nMRMwEQYDVQQDEwp1bml0LXRlc3RzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEA4ej0p7bQ7L/r4rVGUz9RN4VQWoej1Bg1mYWIDYslvKrk1gpj7wZgkdmM\n7oVK2Ofgr
```
likely benign LLM, confidence 0.92 Mock PEM certificate bytes used as test data for requests transport.
Reasoning
A PEM certificate constant in a unit test for the requests transport; the base64 lines are standard certificate encoding, and the test file context indicates mock certificate data. Raw-pass false positive.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/transport/test_requests.py:1076:50

8 rows of base64-like lines, lines 1076-1076 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
        old_cert = b"-----BEGIN CERTIFICATE-----\nMIIBdTCCARqgAwIBAgIJAOYVvu/axMxvMAoGCCqGSM49BAMCMCcxJTAjBgNVBAMM\nHEdvb2dsZSBFbmRwb2ludCBWZXJpZmljYXRpb24wHhcNMjUwNzMwMjMwNjA4WhcN\nMjYwNzMxMjMwNjA4WjAnMSUwIwYDVQQDDBxHb29nbGUgRW5kcG9pbnQgVmVyaWZp\nY2F0aW9uMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbtr18gkEtwPow2oqyZsU\n4KLwFa
```
likely benign LLM, confidence 0.92 PEM-encoded old certificate literal inside a transport test.
Reasoning
Old certificate PEM literal in a test function, a normal way to supply certificate material to test mTLS or endpoint verification. Base64 flagging is expected for PEM encoding.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/transport/test_requests.py:1200:50

8 rows of base64-like lines, lines 1200-1200 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
        old_cert = b"-----BEGIN CERTIFICATE-----\nMIIBdTCCARqgAwIBAgIJAOYVvu/axMxvMAoGCCqGSM49BAMCMCcxJTAjBgNVBAMM\nHEdvb2dsZSBFbmRwb2ludCBWZXJpZmljYXRpb24wHhcNMjUwNzMwMjMwNjA4WhcN\nMjYwNzMxMjMwNjA4WjAnMSUwIwYDVQQDDBxHb29nbGUgRW5kcG9pbnQgVmVyaWZp\nY2F0aW9uMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbtr18gkEtwPow2oqyZsU\n4KLwFa
```
likely benign LLM, confidence 0.92 PEM-encoded certificate literal used in another transport test.
Reasoning
Duplicate of the previous certificate fixture in a second test; PEM text in tests is ordinary and the base64 signal reflects standard certificate encoding.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/transport/test_urllib3.py:29:47

18 rows of base64-like lines, lines 29-30 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
CERT_MOCK_VAL = b"-----BEGIN CERTIFICATE-----\nMIIDIzCCAgugAwIBAgIJAMfISuBQ5m+5MA0GCSqGSIb3DQEBBQUAMBUxEzARBgNV\nBAMTCnVuaXQtdGVzdHMwHhcNMTExMjA2MTYyNjAyWhcNMjExMjAzMTYyNjAyWjAV\nMRMwEQYDVQQDEwp1bml0LXRlc3RzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEA4ej0p7bQ7L/r4rVGUz9RN4VQWoej1Bg1mYWIDYslvKrk1gpj7wZgkdmM\n7oVK2Ofgr
```
likely benign LLM, confidence 0.92 Mock PEM certificate bytes used as test data for urllib3 transport.
Reasoning
Mock PEM certificate constant in a urllib3 transport unit test; standard test fixture with base64 body, a raw-pass false positive.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/transport/test_urllib3.py:458:50

8 rows of base64-like lines, lines 458-458 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
        old_cert = b"-----BEGIN CERTIFICATE-----\nMIIBdTCCARqgAwIBAgIJAOYVvu/axMxvMAoGCCqGSM49BAMCMCcxJTAjBgNVBAMM\nHEdvb2dsZSBFbmRwb2ludCBWZXJpZmljYXRpb24wHhcNMjUwNzMwMjMwNjA4WhcN\nMjYwNzMxMjMwNjA4WjAnMSUwIwYDVQQDDBxHb29nbGUgRW5kcG9pbnQgVmVyaWZp\nY2F0aW9uMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbtr18gkEtwPow2oqyZsU\n4KLwFa
```
likely benign LLM, confidence 0.92 PEM-encoded certificate literal in a urllib3 transport test.
Reasoning
PEM certificate literal in a urllib3 test; expected encoding for certificate fixtures, no execution or hiding behavior.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/transport/test_urllib3.py:577:50

8 rows of base64-like lines, lines 577-577 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
        old_cert = b"-----BEGIN CERTIFICATE-----\nMIIBdTCCARqgAwIBAgIJAOYVvu/axMxvMAoGCCqGSM49BAMCMCcxJTAjBgNVBAMM\nHEdvb2dsZSBFbmRwb2ludCBWZXJpZmljYXRpb24wHhcNMjUwNzMwMjMwNjA4WhcN\nMjYwNzMxMjMwNjA4WjAnMSUwIwYDVQQDDBxHb29nbGUgRW5kcG9pbnQgVmVyaWZp\nY2F0aW9uMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbtr18gkEtwPow2oqyZsU\n4KLwFa
```
likely benign LLM, confidence 0.92 PEM-encoded certificate literal used in a urllib3 test.
Reasoning
Another PEM certificate fixture in a urllib3 test file, consistent with legitimate certificate test data and flagged only by the raw base64 heuristic.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/googleapis/google-cloud-python google-cloud-python && cd google-cloud-python
git checkout google-auth-v2.62.0
disclude scan --severity info --diff google-auth-v2.61.0 packages/google-auth