joserfc 1.7.6

Source: https://github.com/authlib/joserfc
Tag scanned: 1.7.6
Compared with: 1.7.5 (0 signals introduced since)
Files: 142 scanned, 71 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 35 info
Scan time: 21.8 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 35 of 35 warn and critical signals; 35 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-19 08:41

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review encoding-base64 docs/guide/jwe.rst:35:5

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
    eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZHQ00ifQ.
    OKOawDo13gRp2ojaHV7LFpZcgV7T6DVZKTyKOMTYUmKoTCVJRgckCL9kiMT03JGe
    ipsEdY3mx_etLbbWSrFr05kLzcSr4qKAq7YN7e9jwQRb23nfa6c9d-StnImGyFDb
    Sv04uVuxIp5Zms1gNxKKK2Da14B8S4rzVRltdYwam_lDp5XnZAYpQdb76FdIKLaV
```
likely benign LLM, confidence 0.97 Documentation example of a JWE compact token header and ciphertext.
Reasoning
Example JWE compact serialization in documentation; the header is standard base64url JSON (alg RSA-OAEP, enc A256GCM) and the context is RFC-style docs text, not executable code.
info ~~warn~~ → info by review encoding-base64 docs/guide/jwk.rst:119:5

[embedded python] base64-like blob (736 bytes over 12 lines, compression ratio 0.80) (raw pass, confidence 0.60)
```
    -----BEGIN PUBLIC KEY-----
    MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAm0tWm31IQ3zYU27bk/NZ
    3wMJOJ+Moska3WqnptWyiVR+p/qCBlV18NUSwshoctTkETi8+HIhOjUPb0WRvQV0
    YcpsqBVdSuPZ3m4Q+uX/rudAoDKHJ6B7vwjfeg4w9aT/YF+Zi61tEy1c15rHKyXA
```
likely benign LLM, confidence 0.97 Example RSA public key PEM block in a docs file.
Reasoning
A standard PEM-encoded RSA public key shown in documentation as an example of JWK/PEM usage. Base64 DER content is expected for PEM blocks.
info ~~warn~~ → info by review encoding-base64 docs/guide/jwk.rst:188:5

[embedded python] base64-like blob (164 bytes over 3 lines, compression ratio 0.96) (raw pass, confidence 0.60)
```
    -----BEGIN EC PRIVATE KEY-----
    MHcCAQEEIBnRS4Tf1PY6Jb7QOwAM7OWUOMJTBenEWRvGBCGgctBfoAoGCCqGSM49
    AwEHoUQDQgAE3r15c+Yd+0GXKysfWtwkqF7k12ylNE9LdfRP4TfkUcJSQXyGQjcx
    U8E81rOHjo+9xv2e64n4X6pC3yuP+pX4eA==
```
likely benign LLM, confidence 0.97 Example EC private key PEM block in docs.
Reasoning
Example EC private key PEM block in documentation; expected format for PEM keys shown for illustration.
info ~~warn~~ → info by review encoding-base64 docs/guide/jwk.rst:266:5

[embedded python] base64-like blob (100 bytes over 2 lines, compression ratio 1.11) (raw pass, confidence 0.60)
```
    -----BEGIN PRIVATE KEY-----
    MEcCAQAwBQYDK2VxBDsEOaVsPKMXOBfq9aHlDEaMlBY+FR63hwrINHa2X74uHXUr
    3/VXE8eMhrr8stXn41CQKqVmFEeL5Uj5Gg==
    -----END PRIVATE KEY-----
```
likely benign LLM, confidence 0.97 Example private key PEM block in docs.
Reasoning
Example Ed25519 private key PEM in documentation; standard PEM encoding, no executable context.
info ~~warn~~ → info by review encoding-base64 docs/guide/jws.rst:34:5

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
    eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9.
    eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFt
    cGxlLmNvbS9pc19yb290Ijp0cnVlfQ.
    dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk
```
likely benign LLM, confidence 0.97 Documentation example of a JWS compact token.
Reasoning
Standard JWS compact serialization example from the RFC 7515 style documentation; base64url segments are expected.
info ~~warn~~ → info by review encoding-base64 docs/guide/jws.rst:86:19

base64-like blob (94 bytes, compression ratio 1.05) (raw pass, confidence 0.60)
```
    {
      "payload": "eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ",
      "signatures": [
        {
```
likely benign LLM, confidence 0.96 Example base64url JWS payload in JSON docs.
Reasoning
Base64url payload string inside a JSON example in documentation, matching the RFC example payload.
info ~~warn~~ → info by review encoding-base64 docs/guide/jws.rst:91:256

base64-like blob (95 bytes, compression ratio 1.04) (raw pass, confidence 0.60)
```
Hlb1L07Qe7K0GarZRmB_eSN9383LcOLn6_dO--xi12jzDwusC-eOkHWEsqtFZESc6BfI7noOPqvhJ1phCnvWh6IeYI2w9QOYEUipUTI8np6LbgGY9Fs98rqVt5AXLIhWkWywlVmtVrBp0igcN_IoypGlUPQGe77Rw"
```
likely benign LLM, confidence 0.96 Example base64url signature in JWS docs.
Reasoning
Base64url ECDSA/HMAC signature value in a JSON documentation example; expected encoding for signatures.
info ~~warn~~ → info by review encoding-base64 docs/guide/jws.rst:186:19

base64-like blob (94 bytes, compression ratio 1.05) (raw pass, confidence 0.60)
```
    {
      "payload": "eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ",
      "protected": "eyJhbGciOiJFUzI1NiJ9",
      "header": {"kid":"e9bc097a-ce51-4036-9562-d2ade882db0d"},
```
likely benign LLM, confidence 0.96 Example base64url payload in JWS JSON docs.
Reasoning
Repeated example payload in JWS documentation JSON; ordinary base64url content.
info ~~warn~~ → info by review encoding-base64 docs/guide/jws.rst:196:19

base64-like blob (94 bytes, compression ratio 1.05) (raw pass, confidence 0.60)
```
    {
      "payload": "eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ",
      "signatures": [
        {
```
likely benign LLM, confidence 0.96 Example base64url payload in JWS JSON docs.
Reasoning
Same documentation payload example as elsewhere in the JWS guide; benign.
info ~~warn~~ → info by review encoding-base64 docs/recipes/azure.rst:17:5

base64-like blob (84 bytes, compression ratio 1.13) (raw pass, confidence 0.60)
```
    eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Imk2bEdrM0ZaenhSY1ViMkMzbkVRN3N5SEpsWSJ9
    .eyJhdWQiOiI2ZTc0MTcyYi1iZTU2LTQ4NDMtOWZmNC1lNjZhMzliYjEyZTMiLCJpc3MiOiJodHRwczovL2x
    vZ2luLm1pY3Jvc29mdG9ubGluZS5jb20vNzJmOTg4YmYtODZmMS00MWFmLTkxYWItMmQ3Y2QwMTFkYjQ3L3Y
```
likely benign LLM, confidence 0.96 Example Azure JWT header/claims in documentation.
Reasoning
Azure AD JWT example header and claims in a recipe doc; base64url JSON segments, no executable content.
info ~~warn~~ → info by review encoding-base64 docs/recipes/azure.rst:18:6

base64-like blob (924 bytes over 11 lines, compression ratio 0.70) (raw pass, confidence 0.60)
```
    eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Imk2bEdrM0ZaenhSY1ViMkMzbkVRN3N5SEpsWSJ9
    .eyJhdWQiOiI2ZTc0MTcyYi1iZTU2LTQ4NDMtOWZmNC1lNjZhMzliYjEyZTMiLCJpc3MiOiJodHRwczovL2x
    vZ2luLm1pY3Jvc29mdG9ubGluZS5jb20vNzJmOTg4YmYtODZmMS00MWFmLTkxYWItMmQ3Y2QwMTFkYjQ3L3Y
```
likely benign LLM, confidence 0.96 Continuation of an example Azure JWT in docs.
Reasoning
Continuation of the Azure JWT example token in documentation; benign encoded example.
info ~~warn~~ → info by review encoding-base64 docs/recipes/cheatsheet.md:34:1

[embedded python] base64-like blob (392 bytes over 7 lines, compression ratio 0.84) (raw pass, confidence 0.60)
```
pem_rsa = """-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlwwS7I3t2fSTawG1DcNF
Cu6NECHT3eVkr2lYXXD2hz4ILiIST2Q3/YpzNA9CrRZDseA24Ax/8UNZsMi8G1M8
Dpq1jUMKA4NrWOTrraZQmD9q4+rZLNx7M5NV8uojSoPWFYIBFwXgwzJYOZ8RVobJ
```
likely benign LLM, confidence 0.96 Example RSA public key in a Python snippet in a cheatsheet.
Reasoning
PEM public key assigned to a variable in a markdown cheatsheet example; a sample key for illustrating library usage, not a dropper or hidden payload.
info ~~warn~~ → info by review encoding-base64 docs/recipes/cheatsheet.md:46:1

[embedded python] base64-like blob (124 bytes over 2 lines, compression ratio 1.02) (raw pass, confidence 0.60)
```
pem_ec = """-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEBdy4ZhgfXuBXLWgIAVfH+qqbZ4ne
opI4cgNaZ85tQM0rzghtBbXTnP9gxj49fhos3P34nBlIdShM9vaS0yQwcA==
-----END PUBLIC KEY-----"""
```
likely benign LLM, confidence 0.96 Example EC public key in a Python snippet in a cheatsheet.
Reasoning
Example EC public key PEM in a markdown cheatsheet snippet; standard key material shown for documentation.
info ~~warn~~ → info by review encoding-base64 docs/recipes/cheatsheet.md:53:1

[embedded python] base64-like blob (60 bytes, compression ratio 1.18) (raw pass, confidence 0.60)
```
pem_okp = """-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEAqfwZCPkk+0u/GeXg10A3xt6JdNgqcLHqL3jKgBmL8Ow=
-----END PUBLIC KEY-----"""
okp_key = jwk.import_key(pem_okp, "OKP")
```
dismissed LLM, confidence 0.90 Documentation example embedding a public key in PEM form for JWK import.
Reasoning
The blob is a standard PEM-encoded public key (an OKP/Ed25519 SPKI structure) in a documentation example for importing a JWK. It is public key material, not an encoded payload.
info ~~warn~~ → info by review decoder-decompress-payload src/joserfc/_rfc7518/jwe_zips.py:23:28

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        if s.startswith(self.GZIP_HEAD):
            decompressor = zlib.decompressobj()
        else:
            decompressor = zlib.decompressobj(-zlib.MAX_WBITS)
```
likely benign LLM, confidence 0.85 Implements zlib-based decompression for JWE payloads with the 'zip' header parameter.
Reasoning
This is the library's implementation of JWE DEFLATE compression, which uses zlib decompressobj with raw or gzip-header windows. Decompressing the payload is the expected behaviour for the JWE 'zip' feature, and the code is not hidden or executed.
info ~~warn~~ → info by review encoding-base64 src/joserfc/jwe.py:108:9

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
        OKOawDo13gRp2ojaHV7LFpZcgV7T6DVZKTyKOMTYUmKoTCVJRgckCL9kiMT03JGe
        ipsEdY3mx_etLbbWSrFr05kLzcSr4qKAq7YN7e9jwQRb23nfa6c9d-StnImGyFDb
        Sv04uVuxIp5Zms1gNxKKK2Da14B8S4rzVRltdYwam_lDp5XnZAYpQdb76FdIKLaV
```
dismissed LLM, confidence 0.90 Base64url sample token in a JWE library docstring.
Reasoning
The raw pass flagged a base64url string inside what appears to be a docstring or example JWE token. This is a sample token in a JOSE library, not an obfuscated payload.
info ~~warn~~ → info by review encoding-base64 src/joserfc/jws.py:171:9

base64-like blob (94 bytes over 2 lines, compression ratio 1.05) (raw pass, confidence 0.60)
```
        .
        eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFt
        cGxlLmNvbS9pc19yb290Ijp0cnVlfQ
        .
```
dismissed LLM, confidence 0.90 RFC 7515 example JWS payload segment in a docstring.
Reasoning
The blob decodes to the JSON example from the JWS specification (RFC 7515 example), shown inside a docstring for a compact-serialization example. It is standard specification text with no executable or hidden behaviour.
info ~~warn~~ → info by review encoding-base64 tests/jwe/test_compact.py:219:22

base64-like blob (126 bytes, compression ratio 0.98) (raw pass, confidence 0.60)
```
        )
        encrypted = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJlbmMiOiJBMTI4Q0JDLUhTMjU2IiwicDJzIjoiUW9HcmNCcG5zX2NMV0NRUEVWdUEtZyIsInAyYyI6NTAwMDAwfQ.qdtshVQlPM-fW57DRVUnmwMyvBVzUZCm58zn7j5W7IP9S2-cBVTh_w.mMUagTUTRi7fLQ3VUi6g4w.Hi0-8_MusxEwRtW6dkjXzw.Ktm1FmBA9rPe0Vv8w0kZ2g"
        self.assertRaises(
```
dismissed LLM, confidence 0.92 Test vector for a compact-serialized JWE string used in an assertRaises test.
Reasoning
This is a hard-coded PBES2 compact JWE test vector passed to assertRaises in a test file. Test vectors of this form are expected in a JOSE library.
info ~~warn~~ → info by review encoding-base64 tests/jwe/test_ecdh_1pu.py:184:18

base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
            "protected": (
                "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
                "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
                "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
```
dismissed LLM, confidence 0.93 Protected header fragment of an ECDH-1PU test vector.
Reasoning
This is a split base64url-encoded protected header in a test fixture for ECDH-1PU. It is a JOSE protocol test vector and the split pattern is ordinary Python string concatenation.

info ~~warn~~ → info by review encoding-base64 tests/jwe/test_ecdh_1pu.py:185:18

base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)

                "eyJhbGciOiJFQ0RILTFQVStBMTI4S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYXB1Ijoi"
                "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
                "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
                "RnFVQUZhMzlkeUJjIn19"

dismissed LLM, confidence 0.93 Continuation of the ECDH-1PU protected-header test vector.

Reasoning

Continuation line of the same ECDH-1PU protected-header test vector. It is a JOSE test fixture, not obfuscation.

info ~~warn~~ → info by review encoding-base64 tests/jwe/test_ecdh_1pu.py:186:18

base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
```
                "UVd4cFkyVSIsImFwdiI6IlFtOWlJR0Z1WkNCRGFHRnliR2xsIiwiZXBrIjp7Imt0eSI6Ik9L"
                "UCIsImNydiI6IlgyNTUxOSIsIngiOiJrOW9mX2NwQWFqeTBwb1c1Z2FpeFhHczluSGt3ZzFB"
                "RnFVQUZhMzlkeUJjIn19"
            ),
```
dismissed LLM, confidence 0.93 Continuation of the ECDH-1PU test vector.
Reasoning
Continuation line of the same ECDH-1PU test vector. Multi-line string literals of base64url data are normal in test fixtures.
info ~~warn~~ → info by review encoding-base64 tests/jwe/test_example.py:469:14

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
            "eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZHQ00ifQ."
            "OKOawDo13gRp2ojaHV7LFpZcgV7T6DVZKTyKOMTYUmKoTCVJRgckCL9kiMT03JGe"
            "ipsEdY3mx_etLbbWSrFr05kLzcSr4qKAq7YN7e9jwQRb23nfa6c9d-StnImGyFDb"
            "Sv04uVuxIp5Zms1gNxKKK2Da14B8S4rzVRltdYwam_lDp5XnZAYpQdb76FdIKLaV"
```
dismissed LLM, confidence 0.92 Split JWE example token used in test_example.py.
Reasoning
This is an RSA-OAEP JWE example token split across string literals, which matches the library's documented example. Multi-line base64url test data is expected here.
info ~~warn~~ → info by review encoding-base64 tests/jwk/test_rsa_key.py:62:18

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
                "aEeXS1j82E375xxhWMHXyvjYecPT9fpwR_M9gV8n9Hrh2anTpTD93Dt62ypW3yDs"
                "JzBnTnrYu1iwWRgBKrEYY46qAZIrA2xAwnm2X7uGR1hghkqDp0Vqj3kbSCz1XyfC"
                "s6_LehBwtxHIyh8Ripy40p24moOAbgxVw3rxT_vlt3UVe4WO3JkJOzlpUf-KTVI2"
```
dismissed LLM, confidence 0.93 RSA key parameter fragment in a JWK test fixture.
Reasoning
This is base64url RSA key material (the modulus or private exponent fragment) in a JWK test fixture. Key test data in a crypto library's tests is expected.
info ~~warn~~ → info by review encoding-base64 tests/jwk/test_rsa_key.py:71:14

base64-like blob (68 bytes, compression ratio 1.16) (raw pass, confidence 0.60)
```
        data["p"] = (
            "9gY2w6I6S6L0juEKsbeDAwpd9WMfgqFoeA9vEyEUuk4kLwBKcoe1x4HG68ik918hdDSE"
            "9vDQSccA3xXHOAFOPJ8R9EeIAbTi1VwBYnbTp87X-xcPWlEPkrdoUKW60tgs1aNd_Nnc"
            "9LEVVPMS390zbFxt8TN_biaBgelNgbC95sM"
```
dismissed LLM, confidence 0.93 RSA prime parameter in a JWK test fixture.
Reasoning
This is an RSA private prime parameter 'p' in a JWK test fixture, written as base64url string concatenation. It is ordinary key test data.
info ~~warn~~ → info by review encoding-base64 tests/jwk/test_rsa_key.py:136:18

base64-like blob (76 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
```
            "n": (
                "qEr7algLblN5qcstFCfOkAVERAWOyq3UuIor3BZq6s932Zs97yrkKw6XhKobGlNKEXNJhFiKU9oG-XA1dyvwv"
                "9uRbFPiUxLC0IS1mnIeF1Uz3n9h8o3v23TIkbcTPPNsJJuSPiRybefddDBtld7i_9mzNjDR4Ios6DJCNthnIKc"
            ),
```
dismissed LLM, confidence 0.93 RSA modulus parameter in a JWK test fixture.
Reasoning
This is the base64url modulus 'n' of an RSA JWK test case, split across lines. It is standard key material in a test.
info ~~warn~~ → info by review encoding-base64 tests/jwk/test_rsa_key.py:145:19

base64-like blob (86 bytes, compression ratio 1.05) (raw pass, confidence 0.60)
```
            "q": "wh0awdt7hnpdHJGbrbaC1Pr12MRd6bnraPTGewBB9o6KxPXpkSVBlm5mLuhEiB0gnuA933zxvt1bSHHUNuGGDQ",
            "dp": "1GFJ6YWx8w6_PLvx6vc6v3NMbiRQvDGXQBOOy3okfN7b_YWeC9M3HT2jZb9v2mpiuf-ZwFZuJogYsqZQVzYl8Q",
```
likely benign LLM, confidence 0.97 Base64url-encoded RSA key parameters in a JWK test fixture.
Reasoning
The snippet is an RSA JWK private component (q, dp) in a test file for a JWK library, using base64url encoding as the JWK spec requires. Raw-pass base64 heuristic on key material in a test fixture is a false positive.
info ~~warn~~ → info by review encoding-base64 tests/rfc7520/test_jwe.py:133:9

base64-like blob (151 bytes over 3 lines, compression ratio 0.92) (raw pass, confidence 0.60)
```
        compact_data = """
        eyJhbGciOiJQQkVTMi1IUzUxMitBMjU2S1ciLCJwMnMiOiI4UTFTemluYXNSM3
        hjaFl6NlpaY0hBIiwicDJjIjo4MTkyLCJjdHkiOiJqd2stc2V0K2pzb24iLCJl
        bmMiOiJBMTI4Q0JDLUhTMjU2In0
```
likely benign LLM, confidence 0.97 RFC 7520 compact JWE serialization test vector.
Reasoning
Multi-line base64url compact JWE header taken from RFC 7520 test vectors; the decoded header is a normal JOSE header (alg PBES2, enc A128CBC-HS256). Standard test data, not obfuscation.
info ~~warn~~ → info by review encoding-base64 tests/rfc7520/test_jwe.py:141:13

base64-like blob (103 bytes over 2 lines, compression ratio 1.03) (raw pass, confidence 0.60)
```
        .
        23i-Tb1AV4n0WKVSSgcQrdg6GRqsUKxjruHXYsTHAJLZ2nsnGIX86vMXqIi6IR
        sfywCRFzLxEcZBRnTvG3nhzPk0GDD7FMyXhUHpDjEYCNA_XOmzg8yZR9oyjo6l
        TF6si4q9FZ2EhzgFQCLO_6h5EVg3vR75_hkBsnuoqoM3dwejXBtIodN84PeqMb
```
likely benign LLM, confidence 0.97 Base64url payload fragment from an RFC 7520 JWE test vector.
Reasoning
Continuation lines of an RFC 7520 JWE test vector encoded as base64url. Expected content for a JOSE library test suite.
info ~~warn~~ → info by review encoding-base64 tests/rfc7520/test_jwe.py:145:10

base64-like blob (103 bytes over 2 lines, compression ratio 1.05) (raw pass, confidence 0.60)
```
        6asmas_dpSsz7H10fC5ni9xIz424givB1YLldF6exVmL93R3fOoOJbmk2GBQZL
        _SEGllv2cQsBgeprARsaQ7Bq99tT80coH8ItBjgV08AtzXFFsx9qKvC982KLKd
        PQMTlVJKkqtV4Ru5LEVpBZXBnZrtViSOgyg6AiuwaS-rCrcD_ePOGSuxvgtrok
        AKYPqmXUeRdjFJwafkYEkiuDCV9vWGAi1DH2xTafhJwcmywIyzi4BqRpmdn_N-
```
likely benign LLM, confidence 0.97 Base64url ciphertext fragment from an RFC 7520 JWE test vector.
Reasoning
Base64url encrypted-key/ciphertext continuation lines from the RFC 7520 test vector, referenced by the test module's cited spec section. Benign test data.
info ~~warn~~ → info by review encoding-base64 tests/rfc7520/test_jwk.py:12:15

base64-like blob (81 bytes, compression ratio 1.06) (raw pass, confidence 0.60)
```
        "x": "AHKZLLOsCOzz5cY97ewNUajB957y-C-U88c3v13nmGZx6sYl_oJXu9A5RkTKqjqvjyekWF-7ytDyRXYgCF5cj0Kt",
        "y": "AdymlHvOiLxXkEhayXQnNCvDX4h9htZaCJN34kfmC6pV5OhQHiraVySsUdaQkAgDPrwQrJmbnX9cwlGfP-HqHZR1",
    }
    # https://datatracker.ietf.org/doc/html/rfc7520#section-3.2
```
likely benign LLM, confidence 0.97 EC JWK public coordinates from RFC 7520 section 3.2.
Reasoning
EC public key coordinates (x, y) from the RFC 7520 JWK example, cited in a comment. Public test vector, no malicious intent.
info ~~warn~~ → info by review encoding-base64 tests/rfc7520/test_jwk.py:22:19

base64-like blob (81 bytes, compression ratio 1.06) (raw pass, confidence 0.60)
```
            "y": "AdymlHvOiLxXkEhayXQnNCvDX4h9htZaCJN34kfmC6pV5OhQHiraVySsUdaQkAgDPrwQrJmbnX9cwlGfP-HqHZR1",
            "d": "AAhRON2r9cqXX1hg-RoI6R1tX5p2rUAYdmpHZoC1XNM56KtscrX6zbKipQrCW9CGZH3T4ubpnoTKLDYJ_fF3_rJt",
        }
```
likely benign LLM, confidence 0.97 EC JWK coordinate and private scalar from an RFC 7520 test fixture.
Reasoning
EC JWK y-coordinate and private scalar d from the RFC 7520 example used in a JWK test. Published test vector data, not hidden payload.
info ~~warn~~ → info by review encoding-base64 tests/rfc7520/test_jws.py:74:36

base64-like blob (80 bytes, compression ratio 1.06) (raw pass, confidence 0.60)
```
                {
                    "protected": ("eyJhbGciOiJIUzI1NiIsImtpZCI6IjAxOGMwYWU1LTRkOWItNDcxYi1iZmQ2LWVlZjMxNGJjNzAzNyJ9"),
                    "signature": "s0h6KThzkfBBBkLspW1h84VsJZFTsPPqMDA7g1Md7p0",
                }
```
likely benign LLM, confidence 0.97 JWS protected header and signature from an RFC 7520 test vector.
Reasoning
Standard JWS flattened serialization protected header and signature from RFC 7520 test data. Expected in a JOSE library's tests.
info ~~warn~~ → info by review encoding-base64 tests/rfc7520/test_jws.py:82:28

base64-like blob (80 bytes, compression ratio 1.06) (raw pass, confidence 0.60)
```
        flattened_json = {
            "protected": ("eyJhbGciOiJIUzI1NiIsImtpZCI6IjAxOGMwYWU1LTRkOWItNDcxYi1iZmQ2LWVlZjMxNGJjNzAzNyJ9"),
            "signature": "s0h6KThzkfBBBkLspW1h84VsJZFTsPPqMDA7g1Md7p0",
        }
```
likely benign LLM, confidence 0.97 Repeated JWS flattened serialization test vector.
Reasoning
Same JWS protected header and signature test vector reused in a second test. Benign fixture data.
info ~~warn~~ → info by review encoding-base64 tests/rfc7520/test_jws.py:169:26

base64-like blob (66 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
                        "Cdkn9Ybdlmi54ho0x924DUz8sK7ZXkhc7AFM8ObLfTvNCrqcI3Jkl2U"
                        "5IX3utNhODH6v7xgy1Qahsn0fyb4zSAkje8bAWz4vIfj5pCMYxxm4fgV3q7ZYhm5eD"
                    ),
                },
```
likely benign LLM, confidence 0.96 Base64url JWS test vector fragment.
Reasoning
Base64url signature/payload strings within an RFC 7520 JWS test case. Legitimate test vector data with no execution or hidden logic.
info ~~warn~~ → info by review encoding-base64 tests/rfc7520/test_jws.py:173:35

base64-like blob (80 bytes, compression ratio 1.06) (raw pass, confidence 0.60)
```
                {
                    "protected": "eyJhbGciOiJIUzI1NiIsImtpZCI6IjAxOGMwYWU1LTRkOWItNDcxYi1iZmQ2LWVlZjMxNGJjNzAzNyJ9",
                    "signature": "s0h6KThzkfBBBkLspW1h84VsJZFTsPPqMDA7g1Md7p0",
                },
```
likely benign LLM, confidence 0.97 JWS protected header and signature from an RFC 7520 test vector.
Reasoning
JWS protected header and signature repeated in another test case. Standard RFC 7520 test data.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/authlib/joserfc joserfc && cd joserfc
git checkout 1.7.6
disclude scan --severity info --diff 1.7.5 .