google-auth 2.62.0

Source: https://github.com/googleapis/google-cloud-python
Tag scanned: google-auth-v2.62.0
Directory: packages/google-auth (only this part of the repository was scanned)
Compared with: google-auth-v2.61.0 (0 signals introduced since)
Files: 237 scanned, 44 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 39 info
Scan time: 24.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 37 of 37 warn and critical signals; 37 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-21 23:53

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info long-line packages/google-auth/CHANGELOG.md:1714:1

line length 630 characters (raw pass, confidence 0.50)

* **google.auth.compute_engine.metadata:** add retry to google.auth.compute_engine._metadata.get() ([#398](https://www.github.com/googleapis/google-auth-library-python/issues/398)) ([af29c1a](https://www.github.com/googleapis/google-auth-library-python/commit/af29c1a9fd9282b38867961e4053f74f018a3815)), closes [#211](ht

info long-line packages/google-auth/CHANGELOG.md:2019:1

line length 631 characters (raw pass, confidence 0.50)

- Added system tests for all credential types. ([#51](https://github.com/googleapis/google-auth-library-python/pull/51), [#54](https://github.com/googleapis/google-auth-library-python/pull/54), [#56](https://github.com/googleapis/google-auth-library-python/pull/56), [#58](https://github.com/googleapis/google-auth-libra

info ~~warn~~ → info by review dynamic-execution packages/google-auth/docs/user-guide.rst:391:8

[embedded bash] command name is a variable (`$EXECUTABLE_COMMAND`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
       # e.g. --executable-command="/path/to/command --foo=bar"
       --executable-command=$EXECUTABLE_COMMAND \
       # Optional argument for the executable timeout. Defaults to 30s.
       # --executable-timeout-millis=$EXECUTABLE_TIMEOUT \
```
likely benign LLM, confidence 0.90 RST docs showing an embedded bash example with a placeholder executable command for a Google auth config.
Reasoning
Documentation example of a CLI flag whose value is a placeholder variable in an embedded shell snippet; the flagged 'dynamic execution' is the documented executable command the user configures. Not malicious.
info ~~warn~~ → info by review dynamic-execution packages/google-auth/docs/user-guide.rst:881:9

[embedded bash] command name is a variable (`$EXECUTABLE_COMMAND`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
        # e.g. --executable-command="/path/to/command --foo=bar"
        --executable-command=$EXECUTABLE_COMMAND \
        # Optional argument for the executable timeout. Defaults to 30s.
        # --executable-timeout-millis=$EXECUTABLE_TIMEOUT \
```
likely benign LLM, confidence 0.90 Duplicate embedded bash example in the user guide documenting executable-command configuration.
Reasoning
Same documentation pattern repeated elsewhere in the guide; placeholder variable in a usage example, no concealment or malicious payload.
info ~~warn~~ → info by review dynamic-execution packages/google-auth/docs/user-guide.rst:887:9

[embedded bash] command name is a variable (`$WORKFORCE_POOL_USER_PROJECT`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
        # --executable-output-file=$EXECUTABLE_OUTPUT_FILE \
        --workforce-pool-user-project=$WORKFORCE_POOL_USER_PROJECT \
        --output-file /path/to/generated/config.json
```
likely benign LLM, confidence 0.90 Docs example showing CLI flags for workforce pool configuration in an embedded bash block.
Reasoning
Documentation example passing a workforce pool project variable to a CLI flag; the variable name is a configuration value, not dynamic execution of attacker-controlled code.
info ~~critical~~ → info by review dynamic-execution packages/google-auth/setup.py:97:5

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
with open(os.path.join(package_root, "google/auth/version.py")) as fp:
    exec(fp.read(), version)
version = version["__version__"]
```
likely benign LLM, confidence 0.95 setup.py executes the package's own version.py to read __version__ at build/import time.
Reasoning
Standard setup.py idiom reading google/auth/version.py and exec'ing it to obtain __version__. It is a known pattern in Google client libraries, though exec on file contents is worth noting; the file is packaged source, not remote input.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/compute_engine/test__metadata.py:43:7

14 rows of base64-like lines, lines 43-58 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
    b"-----BEGIN CERTIFICATE-----\n"
    b"MIIDIzCCAgugAwIBAgIJAMfISuBQ5m+5MA0GCSqGSIb3DQEBBQUAMBUxEzARBgNV\n"
    b"BAMTCnVuaXQtdGVzdHMwHhcNMTExMjA2MTYyNjAyWhcNMjExMjAzMTYyNjAyWjAV\n"
    b"MRMwEQYDVQQDEwp1bml0LXRlc3RzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\n"
```
likely benign LLM, confidence 0.93 Test fixture containing a PEM certificate encoded as byte-string lines.
Reasoning
Lines are a PEM certificate fixture split into byte literals in a test file; the base64 is expected content, not obfuscation.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_agent_identity_utils.py:32:7

14 rows of base64-like lines, lines 32-47 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
    b"-----BEGIN CERTIFICATE-----\n"
    b"MIIDIzCCAgugAwIBAgIJAMfISuBQ5m+5MA0GCSqGSIb3DQEBBQUAMBUxEzARBgNV\n"
    b"BAMTCnVuaXQtdGVzdHMwHhcNMTExMjA2MTYyNjAyWhcNMjExMjAzMTYyNjAyWjAV\n"
    b"MRMwEQYDVQQDEwp1bml0LXRlc3RzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\n"
```
likely benign LLM, confidence 0.93 Test fixture with a PEM certificate split across byte-string lines.
Reasoning
Test certificate fixture in PEM format; base64 content is expected for certificate test data.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_agent_identity_utils.py:60:7

16 rows of base64-like lines, lines 60-75 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
    b"-----BEGIN CERTIFICATE-----\n"
    b"MIIDEjCCAfqgAwIBAgIUKZAXnXnxf8hsn+ojS1N8bN3hXrUwDQYJKoZIhvcNAQEL\n"
    b"BQAwHjEcMBoGA1UEAwwTYWdlbnQtaWRlbnRpdHktdGVzdDAeFw0yNDAxMDEwMDAw\n"
    b"MDBaFw0zNDAxMDEwMDAwMDBaMB4xHDAaBgNVBAMME2FnZW50LWlkZW50aXR5LXRl\n"
```
likely benign LLM, confidence 0.93 Second PEM certificate test fixture in the agent identity tests.
Reasoning
Another PEM certificate test fixture in a unit test; legitimate test data.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:74:10

base64-like blob (239 bytes, compression ratio 0.90) (raw pass, confidence 0.60)
```
TOKEN = "AQoEXAMPLEH4aoAH0gNCAPyJxz4BlCFFxWNE1OPTgk5TthT+FvwqnKwRcOIfrRh3c/LTo6UDdyJwOOvEVPvLXCrrrUtdnniCEXAMPLE/IvU1dYUg2RVAJBanLiHb4IgRmpRV3zrkuWJOgQs8IZZaIv2BXIa2R4OlgkBN9bkUDNCJiBeb/AXlzBBko7b15fjrBs2+cTQtpZ3CYWFXG8C5zqx37wnOE49mRl/+OtkIKGO7fAE"
# To avoid json.dumps() differing behavior from one version to other,
```
likely benign LLM, confidence 0.90 AWS example session token string used as test data.
Reasoning
AWS documentation example token (AQoEXAMPLE... pattern) used in tests for AWS signing; obviously placeholder credential material, not a live secret or obfuscation.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:183:138

base64-like blob (74 bytes, compression ratio 0.96) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=b27ccfbfa7df52a200ff74193ca6e32d4b48b8856fab7ebf1c595d0670a7e470",
                "host": "host.foo.com",
```
likely benign LLM, confidence 0.92 AWS Signature V4 example header in a test fixture.
Reasoning
AWS SigV4 example Authorization header from the AWS documentation test vectors (AKIDEXAMPLE); the hex signature is expected test data.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:208:138

base64-like blob (74 bytes, compression ratio 0.96) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=b27ccfbfa7df52a200ff74193ca6e32d4b48b8856fab7ebf1c595d0670a7e470",
                "host": "host.foo.com",
```
likely benign LLM, confidence 0.92 Duplicate AWS SigV4 example Authorization header in tests.
Reasoning
Repeated AWS SigV4 test vector with example credentials; legitimate test data.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:233:138

base64-like blob (74 bytes, compression ratio 0.96) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=b27ccfbfa7df52a200ff74193ca6e32d4b48b8856fab7ebf1c595d0670a7e470",
                "host": "host.foo.com",
```
likely benign LLM, confidence 0.92 Third AWS SigV4 example Authorization header in tests.
Reasoning
Repeated AWS SigV4 test vector with example credentials; legitimate test data.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:258:138

base64-like blob (74 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=910e4d6c9abafaf87898e1eb4c929135782ea25bb0279703146455745391e63a",
                "host": "host.foo.com",
```
dismissed LLM, confidence 0.93 AWS Signature V4 test vector in an Authorization header, misflagged as base64.
Reasoning
The flagged 74-byte value is the hex SigV4 Signature inside an AWS Authorization header. The AKIDEXAMPLE credential and host.foo.com are the standard AWS documentation test vectors, and the file is a test suite. A raw-pass base64 heuristic firing on a hex digest is a false positive.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:283:138

base64-like blob (74 bytes, compression ratio 0.96) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=8d6634c189aa8c75c2e51e106b6b5121bed103fdb351f7d7d4381c738823af74",
                "host": "host.foo.com",
```
dismissed LLM, confidence 0.93 AWS SigV4 test-vector signature in a test file, misflagged as base64.
Reasoning
Same pattern as the other findings: a hex SigV4 signature in an AWS documentation example inside a test file. The base64 signal is a false positive from a raw-byte heuristic.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:308:138

base64-like blob (74 bytes, compression ratio 0.97) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=be7148d34ebccdc6423b19085378aa0bee970bdc61d144bd1a8c48c33079ab09",
                "host": "host.foo.com",
```
dismissed LLM, confidence 0.93 AWS SigV4 example signature in a test fixture, misflagged as base64.
Reasoning
A hex SigV4 signature in a standard AWS example Authorization header, with AKIDEXAMPLE and host.foo.com placeholders. This is a legitimate test fixture and not an encoded payload.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:333:138

base64-like blob (74 bytes, compression ratio 0.95) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=feb926e49e382bec75c9d7dcb2a1b6dc8aa50ca43c25d2bc51143768c0875acc",
                "host": "host.foo.com",
```
dismissed LLM, confidence 0.93 AWS SigV4 test-vector signature, misflagged as base64.
Reasoning
The flagged blob is a 64-character hex signature in an AWS test vector. Placeholder credentials and host confirm it is a fixture, so the raw base64 heuristic is misfiring.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:362:138

base64-like blob (74 bytes, compression ratio 0.99) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=6fb359e9a05394cc7074e0feb42573a2601abc0c869a953e8c5c12e4e01f1a8c",
                "host": "host.foo.com",
```
dismissed LLM, confidence 0.93 AWS SigV4 test-vector signature, misflagged as base64.
Reasoning
Hex SigV4 signature in an AWS documentation-style test header with example credentials. Not obfuscation; a false positive from the raw pass.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:387:142

base64-like blob (74 bytes, compression ratio 0.95) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host;zoo, Signature=b7a95a52518abbca0964a999a880429ab734f35ebbf1235bd79a5de87756dc4a",
                "host": "host.foo.com",
```
dismissed LLM, confidence 0.93 AWS SigV4 test-vector signature in a test fixture, misflagged as base64.
Reasoning
Hex SigV4 signature in a signed-headers test case using AKIDEXAMPLE and host.foo.com placeholders. Legitimate test fixture; the base64 signal is spurious.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:413:142

base64-like blob (74 bytes, compression ratio 0.95) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host;zoo, Signature=273313af9d0c265c531e11db70bbd653f3ba074c1009239e8559d3987039cad7",
                "host": "host.foo.com",
```
dismissed LLM, confidence 0.93 AWS SigV4 test-vector signature, misflagged as base64.
Reasoning
A hex signature in an AWS SigV4 test header using placeholder credentials. The raw-pass base64 detection is a false positive on a hexadecimal digest.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:439:140

base64-like blob (74 bytes, compression ratio 0.95) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host;p, Signature=debf546796015d6f6ded8626f5ce98597c33b47b9164cf6b17b4642036fcb592",
                "host": "host.foo.com",
```
dismissed LLM, confidence 0.93 AWS SigV4 test-vector signature, misflagged as base64.
Reasoning
Hex SigV4 signature in an AWS example Authorization header inside a test module. Benign fixture data flagged by a high-false-positive raw heuristic.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:469:151

base64-like blob (74 bytes, compression ratio 0.99) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=content-type;date;host, Signature=5a15b22cf462f047318703b92e6f4f38884e4a7ab7b1d6426ca46a8bd1c26cbc",
                "host": "host.foo.com",
```
dismissed LLM, confidence 0.93 AWS SigV4 test-vector signature, misflagged as base64.
Reasoning
A 64-character hex signature in an AWS SigV4 test header with placeholder credentials and host. Not an encoded dropper or hidden payload.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:496:138

base64-like blob (74 bytes, compression ratio 0.95) (raw pass, confidence 0.60)
```
            "headers": {
                "Authorization": "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=b6e3b79003ce0743a491606ba1035a804593b0efb1e20a11cba83f8c25a57a92",
                "host": "host.foo.com",
```
dismissed LLM, confidence 0.93 AWS SigV4 test-vector signature, misflagged as base64.
Reasoning
Hex SigV4 signature in a standard AWS test vector with AKIDEXAMPLE and host.foo.com placeholders. Legitimate test data; the base64 finding is spurious.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:521:110

base64-like blob (74 bytes, compression ratio 0.95) (raw pass, confidence 0.60)
```
                + ACCESS_KEY_ID
                + "/20200811/us-east-2/ec2/aws4_request, SignedHeaders=host;x-amz-date;x-amz-security-token, Signature=41e226f997bf917ec6c9b2b14218df0874225f13bb153236c247881e614fafc9",
                "host": "ec2.us-east-2.amazonaws.com",
```
dismissed LLM, confidence 0.92 SigV4 signature generated in an EC2 signing test, misflagged as base64.
Reasoning
The blob is a hex SigV4 signature built in a test that concatenates an access key ID into an EC2 credential scope. The host ec2.us-east-2.amazonaws.com is a real endpoint but the code is a signing test, not a payload. The base64 signal is a false positive.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:547:110

base64-like blob (74 bytes, compression ratio 0.92) (raw pass, confidence 0.60)
```
                + ACCESS_KEY_ID
                + "/20200811/us-east-2/sts/aws4_request, SignedHeaders=host;x-amz-date;x-amz-security-token, Signature=596aa990b792d763465d73703e684ca273c45536c6d322c31be01a41d02e5b60",
                "host": "sts.us-east-2.amazonaws.com",
```
likely benign LLM, confidence 0.93 AWS SigV4 test Authorization header containing a hex signature.
Reasoning
Raw-pass base64 heuristic hit on a hex signature string inside an AWS SigV4 Authorization header in a test file. Test fixture with no execution or concealment; the signature is a hex digest, not an obfuscated payload.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:569:89

base64-like blob (74 bytes, compression ratio 0.96) (raw pass, confidence 0.60)
```
                + ACCESS_KEY_ID
                + "/20200811/us-east-2/sts/aws4_request, SignedHeaders=host;x-amz-date, Signature=9e722e5b7bfa163447e2a14df118b45ebd283c5aea72019bdf921d6e7dc01a9a",
                "host": "sts.us-east-2.amazonaws.com",
                "x-amz-date": "20200811T065522Z",
```
likely benign LLM, confidence 0.93 AWS SigV4 test Authorization header with a hex signature.
Reasoning
Same pattern as the other AWS test: a SigV4 Authorization header with a hex signature in a unit test. Raw-pass heuristic on a legitimate fixture value.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/test_aws.py:599:141

base64-like blob (74 bytes, compression ratio 1.00) (raw pass, confidence 0.60)
```
                + ACCESS_KEY_ID
                + "/20200811/us-east-2/dynamodb/aws4_request, SignedHeaders=content-type;host;x-amz-date;x-amz-security-token;x-amz-target, Signature=eb8bce0e63654bba672d4a8acb07e72d69210c1797d56ce024dbbc31beb2a2c7",
                "host": "dynamodb.us-east-2.amazonaws.com",
```
likely benign LLM, confidence 0.93 DynamoDB SigV4 test Authorization header with a hex signature.
Reasoning
DynamoDB SigV4 test header with a hex signature string. Legitimate test fixture flagged by a high-false-positive raw heuristic.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/transport/test__custom_tls_signer.py:82:44

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
    assert (
        base64.b64encode(sig).decode() == "RG5gyEH8CAAh3lxgbt2PLPAHPO8p6i9+cn5dqHfUUYM="
    )
```
likely benign LLM, confidence 0.95 Assertion comparing a base64-encoded signature to an expected value.
Reasoning
Base64 encoding of a signature is compared to an expected literal inside an assert. This is ordinary test assertion code with no decoding or execution.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/transport/test__mtls_helper.py:36:1

base64-like blob (332 bytes over 6 lines, compression ratio 0.83) (raw pass, confidence 0.60)
```
ENCRYPTED_EC_PRIVATE_KEY = b"""-----BEGIN ENCRYPTED PRIVATE KEY-----
MIH0MF8GCSqGSIb3DQEFDTBSMDEGCSqGSIb3DQEFDDAkBBClWcQyUELNC9Hjr+Sp
WK85AgIIADAMBggqhkiG9w0CCQUAMB0GCWCGSAFlAwQBKgQQ6uJeoqE7P9HtxAgS
n6rBFgSBkMRDYXLucNp7ew7LbQmkZCmjnRhgyw6b0dD3eK8f3jisj8UiR8aj9a2S
```
likely benign LLM, confidence 0.96 Encrypted EC private key PEM fixture in an mTLS helper test.
Reasoning
Encrypted PEM private key literal used as a test fixture for mTLS helper code. Standard test data, not a dropper or hidden payload.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/transport/test__mtls_helper.py:45:1

base64-like blob (124 bytes over 2 lines, compression ratio 1.03) (raw pass, confidence 0.60)
```
EC_PUBLIC_KEY = b"""-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEwdsHzL05VUmqYJat2yGdbSHQAg49
Wc+fhwLH3b+SCC/2/TqPNDy9yMdMxMtEfZfKal2EaeE2erJrtu7WNfjD0Q==
-----END PUBLIC KEY-----"""
```
likely benign LLM, confidence 0.96 EC public key PEM fixture in a test.
Reasoning
PEM public key constant in a test module. Standard fixture data flagged by the raw base64 heuristic.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/transport/test__mtls_helper.py:108:9

base64-like blob (104 bytes over 2 lines, compression ratio 1.04) (raw pass, confidence 0.60)
```
        KEY = b"""-----BEGIN PRIVATE KEY-----
        MIIBCgKCAQEA4ej0p7bQ7L/r4rVGUz9RN4VQWoej1Bg1mYWIDYslvKrk1gpj7wZg
        /fy3ZpsL7WqgsZS7Q+0VRK8gKfqkxg5OYQIDAQAB
        -----END PRIVATE KEY-----"""
```
likely benign LLM, confidence 0.95 Dummy PRIVATE KEY PEM fixture in a test.
Reasoning
Dummy PEM private key literal used as test input for key-parsing code. Fixture data, not malicious.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/transport/test__mtls_helper.py:112:9

base64-like blob (104 bytes over 2 lines, compression ratio 1.04) (raw pass, confidence 0.60)
```
        RSA_KEY = b"""-----BEGIN RSA PRIVATE KEY-----
        MIIBCgKCAQEA4ej0p7bQ7L/r4rVGUz9RN4VQWoej1Bg1mYWIDYslvKrk1gpj7wZg
        /fy3ZpsL7WqgsZS7Q+0VRK8gKfqkxg5OYQIDAQAB
        -----END RSA PRIVATE KEY-----"""
```
likely benign LLM, confidence 0.95 Dummy RSA private key PEM fixture in a test.
Reasoning
Dummy RSA private key PEM literal in a test file, used to exercise key handling. Ordinary test data.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/transport/test__mtls_helper.py:116:9

base64-like blob (104 bytes over 2 lines, compression ratio 1.04) (raw pass, confidence 0.60)
```
        EC_KEY = b"""-----BEGIN EC PRIVATE KEY-----
        MIIBCgKCAQEA4ej0p7bQ7L/r4rVGUz9RN4VQWoej1Bg1mYWIDYslvKrk1gpj7wZg
        /fy3ZpsL7WqgsZS7Q+0VRK8gKfqkxg5OYQIDAQAB
        -----END EC PRIVATE KEY-----"""
```
likely benign LLM, confidence 0.95 Dummy EC private key PEM fixture in a test.
Reasoning
Dummy EC private key PEM literal in a test file. Standard fixture; the repeated body reflects test data, not hidden code.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/transport/test_requests.py:73:47

18 rows of base64-like lines, lines 73-74 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
CERT_MOCK_VAL = b"-----BEGIN CERTIFICATE-----\nMIIDIzCCAgugAwIBAgIJAMfISuBQ5m+5MA0GCSqGSIb3DQEBBQUAMBUxEzARBgNV\nBAMTCnVuaXQtdGVzdHMwHhcNMTExMjA2MTYyNjAyWhcNMjExMjAzMTYyNjAyWjAV\nMRMwEQYDVQQDEwp1bml0LXRlc3RzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEA4ej0p7bQ7L/r4rVGUz9RN4VQWoej1Bg1mYWIDYslvKrk1gpj7wZgkdmM\n7oVK2Ofgr
```
likely benign LLM, confidence 0.95 Mock certificate PEM constant in a requests transport test.
Reasoning
Certificate PEM bytes used as a mock value in a transport test. Standard certificate test data flagged by the raw base64 heuristic.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/transport/test_requests.py:1076:50

8 rows of base64-like lines, lines 1076-1076 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
        old_cert = b"-----BEGIN CERTIFICATE-----\nMIIBdTCCARqgAwIBAgIJAOYVvu/axMxvMAoGCCqGSM49BAMCMCcxJTAjBgNVBAMM\nHEdvb2dsZSBFbmRwb2ludCBWZXJpZmljYXRpb24wHhcNMjUwNzMwMjMwNjA4WhcN\nMjYwNzMxMjMwNjA4WjAnMSUwIwYDVQQDDBxHb29nbGUgRW5kcG9pbnQgVmVyaWZp\nY2F0aW9uMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbtr18gkEtwPow2oqyZsU\n4KLwFa
```
likely benign LLM, confidence 0.95 Old certificate PEM constant in a requests transport test.
Reasoning
Old certificate PEM bytes assigned in a test for certificate handling. Fixture data with no execution or concealment.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/transport/test_requests.py:1200:50

8 rows of base64-like lines, lines 1200-1200 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
        old_cert = b"-----BEGIN CERTIFICATE-----\nMIIBdTCCARqgAwIBAgIJAOYVvu/axMxvMAoGCCqGSM49BAMCMCcxJTAjBgNVBAMM\nHEdvb2dsZSBFbmRwb2ludCBWZXJpZmljYXRpb24wHhcNMjUwNzMwMjMwNjA4WhcN\nMjYwNzMxMjMwNjA4WjAnMSUwIwYDVQQDDBxHb29nbGUgRW5kcG9pbnQgVmVyaWZp\nY2F0aW9uMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbtr18gkEtwPow2oqyZsU\n4KLwFa
```
likely benign LLM, confidence 0.95 A PEM-encoded test certificate embedded as a bytes literal in a transport test.
Reasoning
The snippet is a PEM certificate literal in a test file, with standard BEGIN CERTIFICATE framing and base64 rows. Certificates are base64 by design, and the raw pass flags them as encoded blobs with a low compression ratio that is expected for base64 of DER data. No decoding or execution is present.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/transport/test_urllib3.py:29:47

18 rows of base64-like lines, lines 29-30 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
CERT_MOCK_VAL = b"-----BEGIN CERTIFICATE-----\nMIIDIzCCAgugAwIBAgIJAMfISuBQ5m+5MA0GCSqGSIb3DQEBBQUAMBUxEzARBgNV\nBAMTCnVuaXQtdGVzdHMwHhcNMTExMjA2MTYyNjAyWhcNMjExMjAzMTYyNjAyWjAV\nMRMwEQYDVQQDEwp1bml0LXRlc3RzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEA4ej0p7bQ7L/r4rVGUz9RN4VQWoej1Bg1mYWIDYslvKrk1gpj7wZgkdmM\n7oVK2Ofgr
```
likely benign LLM, confidence 0.95 A mock PEM certificate constant for urllib3 transport unit tests.
Reasoning
This is a PEM certificate constant used as mock data in a urllib3 transport test. Base64 DER content inside a BEGIN CERTIFICATE block is the normal representation of certificates, and nothing decodes or executes it.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/transport/test_urllib3.py:458:50

8 rows of base64-like lines, lines 458-458 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
        old_cert = b"-----BEGIN CERTIFICATE-----\nMIIBdTCCARqgAwIBAgIJAOYVvu/axMxvMAoGCCqGSM49BAMCMCcxJTAjBgNVBAMM\nHEdvb2dsZSBFbmRwb2ludCBWZXJpZmljYXRpb24wHhcNMjUwNzMwMjMwNjA4WhcN\nMjYwNzMxMjMwNjA4WjAnMSUwIwYDVQQDDBxHb29nbGUgRW5kcG9pbnQgVmVyaWZp\nY2F0aW9uMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbtr18gkEtwPow2oqyZsU\n4KLwFa
```
likely benign LLM, confidence 0.95 A test-fixture PEM certificate in the urllib3 transport tests.
Reasoning
Same PEM certificate literal pattern as the other test certificates: a BEGIN CERTIFICATE block with base64 rows, used as test fixture data. The raw-pass base64 signal reflects normal certificate encoding, not obfuscation.
info ~~warn~~ → info by review encoding-base64 packages/google-auth/tests/transport/test_urllib3.py:577:50

8 rows of base64-like lines, lines 577-577 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
        old_cert = b"-----BEGIN CERTIFICATE-----\nMIIBdTCCARqgAwIBAgIJAOYVvu/axMxvMAoGCCqGSM49BAMCMCcxJTAjBgNVBAMM\nHEdvb2dsZSBFbmRwb2ludCBWZXJpZmljYXRpb24wHhcNMjUwNzMwMjMwNjA4WhcN\nMjYwNzMxMjMwNjA4WjAnMSUwIwYDVQQDDBxHb29nbGUgRW5kcG9pbnQgVmVyaWZp\nY2F0aW9uMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbtr18gkEtwPow2oqyZsU\n4KLwFa
```
likely benign LLM, confidence 0.95 A PEM certificate fixture in urllib3 transport tests.
Reasoning
A PEM certificate bytes literal in a test file, with the same structure as the other flagged certificate fixtures. Base64 is the standard format for certificates, and the code only uses the value as test data.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/googleapis/google-cloud-python google-cloud-python && cd google-cloud-python
git checkout google-auth-v2.62.0
disclude scan --severity info --diff google-auth-v2.61.0 packages/google-auth