openai 3.32.0

Source: https://github.com/openai/openai-python
Tag scanned: v3.32.0
Compared with: v3.31.0 (3 signals introduced since)
Files: 2437 scanned, 37 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 110 info
Scan time: 47.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 61 of 61 warn and critical signals; 61 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-17 18:11

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info long-line api_reference/openapi.transformed.yml:44290:1 new in this release

line length 566 characters (raw pass, confidence 0.50)

          description: 'The voice to use when generating the audio. Supported built-in voices are `alloy`, `ash`, `ballad`, `coral`, `echo`, `fable`, `onyx`, `nova`, `sage`, `shimmer`, `verse`, `marin`, and `cedar`. You may also provide a custom voice object with an `id`, for example `{ "id": "voice_1234" }`. Previews

info long-line api_reference/openapi.transformed.yml:82391:1 new in this release

line length 673 characters (raw pass, confidence 0.50)

          description: Options for prompt caching. Supported for `gpt-5.6` and later models. By default, OpenAI automatically chooses one implicit cache breakpoint. You can add explicit breakpoints to content blocks with `prompt_cache_breakpoint`. Each request can write up to four breakpoints. For cache matching, OpenA

info long-line api_reference/openapi.transformed.yml:92414:1 new in this release

line length 589 characters (raw pass, confidence 0.50)

      description: Play one complete audio fixture through the session output. Send this event over the primary WebSocket or a server sideband. Audio must be raw mono PCM16 little-endian at 24 kHz, regardless of the session audio format, and at most 30 seconds. The entire payload is validated before model speech is int

info ~~warn~~ → info by review long-line api_reference/openapi.transformed.yml:1077:1

line length 2410 characters (raw pass, confidence 0.65)
```
            data: {"type":"transcript.text.done","text":"I see skies of blue and clouds of white, the bright blessed days, the dark sacred nights, and I think to myself, what a wonderful world.","logprobs":[{"token":"I","logprob":-0.00007588794,"bytes":[73]},{"token":" see","logprob":-3.1281633e-7,"bytes":[32,115,101,1
```
dismissed LLM, confidence 0.97 Long JSON example line in an OpenAPI transcription response example.
Reasoning
A long line inside a YAML example payload containing a JSON-encoded transcript event with logprobs. This is ordinary API documentation data with no execution or obfuscation, so the raw long-line signal is a false positive.

info long-line api_reference/openapi.transformed.yml:5743:1

line length 1879 characters (raw pass, confidence 0.50)

                -d '{"name":"gpt-6-astra","data_source":{"type":"completions","input_messages":{"type":"template","template":[{"role":"developer","content":"Categorize a given news headline into one of the following topics: Technology, Markets, World, Business, or Sports.\n\n# Steps\n\n1. Analyze the content of the new

info long-line api_reference/openapi.transformed.yml:7872:1

line length 783 characters (raw pass, confidence 0.50)

            python: "from openai import OpenAI\nfrom openai.types.fine_tuning import ReinforcementMethod, ReinforcementHyperparameters\nfrom openai.types.graders import StringCheckGrader\n\nclient = OpenAI()\n\nclient.fine_tuning.jobs.create(\n  training_file=\"file-abc\",\n  validation_file=\"file-123\",\n  model=\"o4

info long-line api_reference/openapi.transformed.yml:10951:1

line length 516 characters (raw pass, confidence 0.50)

        description: Group the costs by the specified fields. Supported fields include `project_id`, `user_id`, `line_item`, `api_key_id`, and `api_source`. Support for combining `user_id` with `project_id` grouping or the `project_ids` filter depends on the organization and requested time range. Unsupported combinatio

info long-line api_reference/openapi.transformed.yml:19845:1

line length 687 characters (raw pass, confidence 0.50)

          response: "{\n  \"id\": \"sess_001\",\n  \"object\": \"realtime.session\",\n  \"model\": \"gpt-realtime-2025-08-25\",\n  \"modalities\": [\"audio\", \"text\"],\n  \"instructions\": \"You are a friendly assistant.\",\n  \"voice\": \"alloy\",\n  \"input_audio_format\": \"pcm16\",\n  \"output_audio_format\": \"p

info long-line api_reference/openapi.transformed.yml:19849:1

line length 525 characters (raw pass, confidence 0.50)

      description: "Create an ephemeral API token for use in client-side applications with the\nRealtime API specifically for realtime transcriptions. \nCan be configured with the same session parameters as the `transcription_session.update` client event.\n\nIt responds with a session object, plus a `client_secret` key

info ~~warn~~ → info by review long-line api_reference/openapi.transformed.yml:20395:1

line length 2244 characters (raw pass, confidence 0.65)
```
                      "text": "The file seems to contain excerpts from a letter to the shareholders of Berkshire Hathaway Inc., likely written by Warren Buffett. It covers several topics:\n\n1. **Communication Philosophy**: Buffett emphasizes the importance of transparency and candidness in reporting mistakes and succe
```
dismissed LLM, confidence 0.97 Long example text string in an OpenAPI response example.
Reasoning
A long string literal holding example summarization text inside an OpenAPI example. Documentation content, not obfuscation.

info long-line api_reference/openapi.transformed.yml:22138:1

line length 1261 characters (raw pass, confidence 0.50)

            data: {"id":"run_123","object":"thread.run","created_at":1710351818,"assistant_id":"asst_123","thread_id":"thread_123","status":"requires_action","started_at":1710351818,"expires_at":1710352418,"cancelled_at":null,"failed_at":null,"completed_at":null,"required_action":{"type":"submit_tool_outputs","submit_t

info ~~warn~~ → info by review long-line api_reference/openapi.transformed.yml:34967:1

line length 2244 characters (raw pass, confidence 0.65)
```
                      "text": "The file seems to contain excerpts from a letter to the shareholders of Berkshire Hathaway Inc., likely written by Warren Buffett. It covers several topics:\n\n1. **Communication Philosophy**: Buffett emphasizes the importance of transparency and candidness in reporting mistakes and succe
```
dismissed LLM, confidence 0.97 Duplicate long example text string in an OpenAPI response example.
Reasoning
Same example text as the previous finding at a different location in the same generated spec. Documentation content, not obfuscation.

info long-line api_reference/openapi.transformed.yml:37546:1

line length 506 characters (raw pass, confidence 0.50)

        **Important:** when using JSON mode, you **must** also instruct the model to produce JSON yourself via a system or user message. Without this, the model may generate an unending stream of whitespace until the generation reaches the token limit, resulting in a long-running and seemingly "stuck" request. Also not

info long-line api_reference/openapi.transformed.yml:41982:1

line length 561 characters (raw pass, confidence 0.50)

            Accepts a JSON object that maps tokens (specified by their token ID in the GPT tokenizer) to an associated bias value from -100 to 100. You can use this [tokenizer tool](https://platform.openai.com/tokenizer?view=bpe) to convert text to token IDs. Mathematically, the bias is added to the logits generated by

info long-line api_reference/openapi.transformed.yml:42267:1

line length 604 characters (raw pass, confidence 0.50)

            Input text to embed, encoded as a string or array of tokens. To embed multiple inputs in a single request, pass an array of strings or array of token arrays. The input must not exceed the max input tokens for the model (8192 tokens for all embedding models), cannot be an empty string, and any array must be

info long-line api_reference/openapi.transformed.yml:43247:1

line length 779 characters (raw pass, confidence 0.50)

          description: The size of the generated images. Defaults to `auto`. For `gpt-image-2`, `gpt-image-2-2026-04-21`, `gpt-image-2.5-sunburst`, `gpt-image-2.5-sunburst-2026-09-08`, `gpt-image-2.5-flare`, and `gpt-image-2.5-flare-2026-09-08`, arbitrary resolutions are supported as `WIDTHxHEIGHT` strings, for example

info long-line api_reference/openapi.transformed.yml:43459:1

line length 759 characters (raw pass, confidence 0.50)

          description: The size of the generated images. For `gpt-image-2`, `gpt-image-2-2026-04-21`, `gpt-image-2.5-sunburst`, `gpt-image-2.5-sunburst-2026-09-08`, `gpt-image-2.5-flare`, and `gpt-image-2.5-flare-2026-09-08`, arbitrary resolutions are supported as `WIDTHxHEIGHT` strings, for example `1536x864`. Width a

info long-line api_reference/openapi.transformed.yml:45726:1

line length 759 characters (raw pass, confidence 0.50)

          description: The size of the generated images. For `gpt-image-2`, `gpt-image-2-2026-04-21`, `gpt-image-2.5-sunburst`, `gpt-image-2.5-sunburst-2026-09-08`, `gpt-image-2.5-flare`, and `gpt-image-2.5-flare-2026-09-08`, arbitrary resolutions are supported as `WIDTHxHEIGHT` strings, for example `1536x864`. Width a

info long-line api_reference/openapi.transformed.yml:49444:1

line length 759 characters (raw pass, confidence 0.50)

          description: The size of the generated images. For `gpt-image-2`, `gpt-image-2-2026-04-21`, `gpt-image-2.5-sunburst`, `gpt-image-2.5-sunburst-2026-09-08`, `gpt-image-2.5-flare`, and `gpt-image-2.5-flare-2026-09-08`, arbitrary resolutions are supported as `WIDTHxHEIGHT` strings, for example `1536x864`. Width a

info long-line api_reference/openapi.transformed.yml:54332:1

line length 600 characters (raw pass, confidence 0.50)

      description: "Send this event to truncate a previous assistant message’s audio. The server \nwill produce audio faster than realtime, so this event is useful when the user \ninterrupts to truncate audio that has already been sent to the client but not \nyet played. This will synchronize the server's understandi

info long-line api_reference/openapi.transformed.yml:54368:1

line length 631 characters (raw pass, confidence 0.50)

      description: "Send this event to append audio bytes to the input audio buffer. The audio \nbuffer is temporary storage you can write to and later commit. In Server VAD \nmode, the audio buffer is used to detect speech and the server will decide \nwhen to commit. When Server VAD is disabled, you must commit the au

info long-line api_reference/openapi.transformed.yml:54415:1

line length 583 characters (raw pass, confidence 0.50)

      description: "Send this event to commit the user input audio buffer, which will create a \nnew user message item in the conversation. This event will produce an error \nif the input audio buffer is empty. When in Server VAD mode, the client does \nnot need to send this event, the server will commit the audio buff

info long-line api_reference/openapi.transformed.yml:54486:1

line length 1303 characters (raw pass, confidence 0.50)

      description: "This event instructs the server to create a Response, which means triggering \nmodel inference. When in Server VAD mode, the server will create Responses \nautomatically.\n\nA Response will include at least one Item, and may have two, in which case \nthe second will be a function call. These Items w

info long-line api_reference/openapi.transformed.yml:54820:1

line length 750 characters (raw pass, confidence 0.50)

          description: "The default system instructions (i.e. system message) prepended to model \ncalls. This field allows the client to guide the model on desired \nresponses. The model can be instructed on response content and format, \n(e.g. \"be extremely succinct\", \"act friendly\", \"here are examples of good \

info long-line api_reference/openapi.transformed.yml:55433:1

line length 693 characters (raw pass, confidence 0.50)

      description: "Sent by the server when in `server_vad` mode to indicate that speech has been \ndetected in the audio buffer. This can happen any time audio is added to the \nbuffer (unless speech is already detected). The client may want to use this \nevent to interrupt audio playback or provide visual feedback to

info long-line api_reference/openapi.transformed.yml:56586:1

line length 538 characters (raw pass, confidence 0.50)

              "instructions": "Your knowledge cutoff is 2023-10. You are a helpful, witty, and friendly AI. Act like a human, but remember that you aren't a human and that you can't do human things in the real world. Your voice and personality should be warm and engaging, with a lively and playful tone. If interacting

info long-line api_reference/openapi.transformed.yml:56820:1

line length 511 characters (raw pass, confidence 0.50)

      description: "Add a new Item to the Conversation's context, including messages, function \ncalls, and function call responses. This event can be used both to populate a \n\"history\" of the conversation and to add new items mid-stream, but has the \ncurrent limitation that it cannot populate assistant audio messa

info long-line api_reference/openapi.transformed.yml:56916:1

line length 600 characters (raw pass, confidence 0.50)

      description: "Send this event to truncate a previous assistant message’s audio. The server \nwill produce audio faster than realtime, so this event is useful when the user \ninterrupts to truncate audio that has already been sent to the client but not \nyet played. This will synchronize the server's understandi

info long-line api_reference/openapi.transformed.yml:56953:1

line length 910 characters (raw pass, confidence 0.50)

      description: "Send this event to append audio bytes to the input audio buffer. The audio \nbuffer is temporary storage you can write to and later commit. A \"commit\" will create a new\nuser message item in the conversation history from the buffer content and clear the buffer.\nInput audio transcription (if enabl

info long-line api_reference/openapi.transformed.yml:57078:1

line length 1388 characters (raw pass, confidence 0.50)

      description: "This event instructs the server to create a Response, which means triggering \nmodel inference. When in Server VAD mode, the server will create Responses \nautomatically.\n\nA Response will include at least one Item, and may have two, in which case \nthe second will be a function call. These Items w

info long-line api_reference/openapi.transformed.yml:58152:1

line length 535 characters (raw pass, confidence 0.50)

            The default system instructions (i.e. system message) prepended to model calls. This field allows the client to guide the model on desired responses. The model can be instructed on response content and format, (e.g. "be extremely succinct", "act friendly", "here are examples of good responses") and on audio

info long-line api_reference/openapi.transformed.yml:58987:1

line length 693 characters (raw pass, confidence 0.50)

      description: "Sent by the server when in `server_vad` mode to indicate that speech has been \ndetected in the audio buffer. This can happen any time audio is added to the \nbuffer (unless speech is already detected). The client may want to use this \nevent to interrupt audio playback or provide visual feedback to

info long-line api_reference/openapi.transformed.yml:59711:1

line length 547 characters (raw pass, confidence 0.50)

      description: "Returned when a Response is done streaming. Always emitted, no matter the \nfinal state. The Response object included in the `response.done` event will \ninclude all output Items in the Response but will omit the raw audio data.\n\nClients should check the `status` field of the Response to determine

info long-line api_reference/openapi.transformed.yml:60303:1

line length 538 characters (raw pass, confidence 0.50)

              "instructions": "Your knowledge cutoff is 2023-10. You are a helpful, witty, and friendly AI. Act like a human, but remember that you aren't a human and that you can't do human things in the real world. Your voice and personality should be warm and engaging, with a lively and playful tone. If interacting

info long-line api_reference/openapi.transformed.yml:60377:1

line length 538 characters (raw pass, confidence 0.50)

              "instructions": "Your knowledge cutoff is 2023-10. You are a helpful, witty, and friendly AI. Act like a human, but remember that you aren't a human and that you can't do human things in the real world. Your voice and personality should be warm and engaging, with a lively and playful tone. If interacting

info long-line api_reference/openapi.transformed.yml:60586:1

line length 634 characters (raw pass, confidence 0.50)

              Configuration for input audio transcription, defaults to off and can be set to `null` to turn off once on. Input audio transcription is not native to the model, since the model consumes audio directly. Transcription runs asynchronously through [the /audio/transcriptions endpoint](https://developers.openai

info long-line api_reference/openapi.transformed.yml:60736:1

line length 535 characters (raw pass, confidence 0.50)

            The default system instructions (i.e. system message) prepended to model calls. This field allows the client to guide the model on desired responses. The model can be instructed on response content and format, (e.g. "be extremely succinct", "act friendly", "here are examples of good responses") and on audio

info long-line api_reference/openapi.transformed.yml:60977:1

line length 535 characters (raw pass, confidence 0.50)

            The default system instructions (i.e. system message) prepended to model calls. This field allows the client to guide the model on desired responses. The model can be instructed on response content and format, (e.g. "be extremely succinct", "act friendly", "here are examples of good responses") and on audio

info long-line api_reference/openapi.transformed.yml:61419:1

line length 535 characters (raw pass, confidence 0.50)

            The default system instructions (i.e. system message) prepended to model calls. This field allows the client to guide the model on desired responses. The model can be instructed on response content and format, (e.g. "be extremely succinct", "act friendly", "here are examples of good responses") and on audio

info long-line api_reference/openapi.transformed.yml:73646:1

line length 669 characters (raw pass, confidence 0.50)

      description: Options for prompt caching. Supported for `gpt-5.6` and later models. By default, OpenAI automatically chooses one implicit cache breakpoint. You can add explicit breakpoints to content blocks with `prompt_cache_breakpoint`. Each request can write up to four breakpoints. For cache matching, OpenAI co

info long-line api_reference/openapi.transformed.yml:78576:1

line length 751 characters (raw pass, confidence 0.50)

          description: The Cyber access program to use for this request. Supported values are `standard`, `daybreak_blue`, and `daybreak_red`. If omitted, the API resolves the program from the model's Cyber tier and your organization and project access, subject to model-specific eligibility restrictions. By default, mo

info long-line api_reference/openapi.transformed.yml:78601:1

line length 669 characters (raw pass, confidence 0.50)

      description: Options for prompt caching. Supported for `gpt-5.6` and later models. By default, OpenAI automatically chooses one implicit cache breakpoint. You can add explicit breakpoints to content blocks with `prompt_cache_breakpoint`. Each request can write up to four breakpoints. For cache matching, OpenAI co

info long-line api_reference/openapi.transformed.yml:80468:1

line length 951 characters (raw pass, confidence 0.50)

              Specifies the processing type used for serving the request.   - If set to 'auto', then the request will be processed with the service tier configured in the Project settings. Unless otherwise configured, the Project will use 'default'.   - If set to 'default', then the request will be processed with the s

info long-line api_reference/openapi.transformed.yml:95197:1

line length 759 characters (raw pass, confidence 0.50)

          description: The size of the generated images. For `gpt-image-2`, `gpt-image-2-2026-04-21`, `gpt-image-2.5-sunburst`, `gpt-image-2.5-sunburst-2026-09-08`, `gpt-image-2.5-flare`, and `gpt-image-2.5-flare-2026-09-08`, arbitrary resolutions are supported as `WIDTHxHEIGHT` strings, for example `1536x864`. Width a

info long-line api_reference/openapi.transformed.yml:99396:1

line length 951 characters (raw pass, confidence 0.50)

              Specifies the processing type used for serving the request.   - If set to 'auto', then the request will be processed with the service tier configured in the Project settings. Unless otherwise configured, the Project will use 'default'.   - If set to 'default', then the request will be processed with the s

info long-line api_reference/openapi.transformed.yml:99421:1

line length 669 characters (raw pass, confidence 0.50)

      description: Options for prompt caching. Supported for `gpt-5.6` and later models. By default, OpenAI automatically chooses one implicit cache breakpoint. You can add explicit breakpoints to content blocks with `prompt_cache_breakpoint`. Each request can write up to four breakpoints. For cache matching, OpenAI co

info long-line api_reference/openapi.transformed.yml:106581:1

line length 669 characters (raw pass, confidence 0.50)

      description: Options for prompt caching. Supported for `gpt-5.6` and later models. By default, OpenAI automatically chooses one implicit cache breakpoint. You can add explicit breakpoints to content blocks with `prompt_cache_breakpoint`. Each request can write up to four breakpoints. For cache matching, OpenAI co

info long-line api_reference/openapi.transformed.yml:106586:1

line length 751 characters (raw pass, confidence 0.50)

          description: The Cyber access program to use for this request. Supported values are `standard`, `daybreak_blue`, and `daybreak_red`. If omitted, the API resolves the program from the model's Cyber tier and your organization and project access, subject to model-specific eligibility restrictions. By default, mo

info long-line docs/architecture/security-model.md:35:1

line length 1109 characters (raw pass, confidence 0.50)

| Streaming and authenticated WebSockets | Incrementally decode SSE and exchange authenticated current or beta Realtime/Responses WebSocket messages through distinct sync and async connection paths. | [src/openai/_streaming.py:53](../../src/openai/_streaming.py), [src/openai/resources/realtime/realtime.py:683](../../sr

info ~~warn~~ → info by review long-line docs/architecture/security-model.md:54:1

line length 2482 characters (raw pass, confidence 0.65)
```
| Legacy module-level client | Global/environment-selected OpenAI, Azure, or Bedrock credential and destination | Module `api_type` starts from `OPENAI_API_TYPE`. `_load_client()` fills unset Azure endpoint/version globals from environment; only when `api_type` is unset, it rejects `OPENAI_API_KEY` in the environment t
```
dismissed LLM, confidence 0.97 Long markdown table row in a security architecture document.
Reasoning
A long markdown table row describing credential handling for legacy clients. Prose in a security document with no executable content.
info ~~warn~~ → info by review long-line docs/architecture/security-model.md:65:1

line length 2772 characters (raw pass, confidence 0.65)
```
| Current and beta Realtime/Responses WebSockets | WebSocket destination and client auth headers | All current and beta paths use explicit `websocket_base_url` or transform the configured HTTP base to a WebSocket scheme, then merge client auth with caller extra headers. Only Realtime branches into Azure `_configure_rea
```
dismissed LLM, confidence 0.97 Long markdown table row in a security architecture document.
Reasoning
A long markdown table row about WebSocket destinations and auth headers. Prose documentation, not code.

info long-line docs/architecture/security-model.md:353:1

line length 1687 characters (raw pass, confidence 0.50)

| High | Legacy module-client selection or cache regression routes an OpenAI, Azure, or Bedrock credential through the wrong provider. | Mutable module globals or environment signals must cross a broken precedence, ambiguity, forwarding, or reset boundary; the caller deliberately setting a coherent provider configurati

info ~~warn~~ → info by review long-line docs/architecture/security-model.md:354:1

line length 2534 characters (raw pass, confidence 0.65)

| High | A current or beta Realtime/Responses WebSocket regression sends client auth to the wrong peer or redirect target. | A sync direct-connect or async wrapper path must lose its destination/header binding; caller-selected explicit WebSocket configuration alone is insufficient. | API credential disclosure; Azure `a

dismissed LLM, confidence 0.97 Long markdown table row in a security risk table.

Reasoning

A long markdown table row describing a risk and its impact. Prose documentation, not code.

info long-line docs/architecture/security-model.md:365:1

line length 1490 characters (raw pass, confidence 0.50)

| Medium | Monthly review input or output escapes its intended isolation or publication boundary. | A regression lets independently mutable lifecycle/PyPI data expose the action-held key, mutate protected workspace state, leak sensitive output to the step summary, escape the bounded issue body into publisher commands/m

info long-line docs/architecture/security-model.md:366:1

line length 1595 characters (raw pass, confidence 0.50)

| High | Castiron candidate data escapes the trusted reporter/publisher boundary and changes published commit statuses or PR comments. | Candidate Git objects, stale run metadata, or an untrusted artifact must bypass provenance/freshness/payload/artifact checks before a write-capable publisher acts; normal candidate in

info ~~warn~~ → info by review dynamic-import scripts/run-steady:5:1

`source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)
```
STEADY_ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
source "$STEADY_ROOT/scripts/steady/settings"
steady_verify
```
likely benign LLM, confidence 0.85 Launcher sources a settings file relative to its own repository root.
Reasoning
The script derives its root from its own location and sources a sibling settings file within the repository. Sourcing a path built from the script's directory is a standard launcher idiom and is not a remote or attacker-controlled path.
info ~~critical~~ → info by review dynamic-execution scripts/run-steady:9:1

`exec` called with a dynamic (variable/substitution) path (ast pass, confidence 0.85)
```
# Keep the caller's working directory so relative spec paths keep working.
exec "$DENO_DIRECTORY/$DENO_BINARY" run --cached-only --frozen \
  --config "$STEADY_SOURCE/deno.json" \
  --allow-read --allow-net --allow-env --allow-write \
```
likely benign LLM, confidence 0.72 Launcher execs a cached Deno binary using paths from its repo settings.
Reasoning
The launcher execs a Deno binary whose path comes from variables defined in the repo's settings file, run with --cached-only and --frozen. The dynamic path is expected for a toolchain launcher, but the target is set by repo-controlled configuration rather than untrusted input, so this is most likely a legitimate launcher.
info ~~warn~~ → info by review dynamic-import scripts/steady/install:5:1

`source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)
```
STEADY_ROOT="$(cd "$(dirname "$0")/../.." && pwd -P)"
source "$STEADY_ROOT/scripts/steady/settings"

mkdir -p "$STEADY_CACHE"
```
likely benign LLM, confidence 0.85 Install script sources its sibling settings file relative to its own location.
Reasoning
Same self-relative sourcing of the repository's settings file as in run-steady. Standard shell structure with no sign of malicious use.
info ~~warn~~ → info by review dynamic-execution scripts/steady/install:35:1

command name is a variable (`$DENO_DIRECTORY`, `$DENO_BINARY`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
steady_verify
"$DENO_DIRECTORY/$DENO_BINARY" cache --frozen --config "$STEADY_SOURCE/deno.json" "$STEADY_SOURCE/cmd/steady.ts" >&2

if [[ "${1:-}" == '--print-executable' ]]; then
```
likely benign LLM, confidence 0.75 Install script runs deno cache using variables defined in the sourced settings file.
Reasoning
The command variables are defined in the settings file sourced at line 5, so the finding's claim that they are unset here is only a local-scope artifact. The command runs deno cache with frozen config, which is a routine dependency-caching step.
info ~~warn~~ → info by review dynamic-attribute src/openai/__init__.py:139:13

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            value = getattr(import_module(module, __name__), name)
            globals()[name] = value
            return value
        raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
```
likely benign LLM, confidence 0.95 Lazy submodule loading via module-level __getattr__ in the OpenAI SDK package.
Reasoning
This is the PEP 562 module __getattr__ lazy-loading pattern. It imports a named submodule on first access and caches it in globals. It is a common legitimate idiom for reducing import cost and does not hide any malicious behavior.
info ~~warn~~ → info by review dynamic-attribute src/openai/lib/streaming/__init__.py:19:13

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            value = getattr(import_module("._assistants", __name__), name)
            globals()[name] = value
            return value
        raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
```
likely benign LLM, confidence 0.95 Lazy submodule loading via module-level __getattr__ in the OpenAI streaming package.
Reasoning
The same lazy-import __getattr__ pattern, importing a fixed relative submodule name. Standard and benign.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/__init__.py:350:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 Lazy-loading module __getattr__ that caches resolved attributes in globals() in the OpenAI SDK resources package.
Reasoning
The snippet is the standard PEP 562 module-level __getattr__ used for lazy submodule loading. It raises AttributeError for unknown names and caches resolved values in globals(). This is a common, legitimate pattern in large SDKs, and nothing here decodes data or runs anything dynamically.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/admin/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 Lazy-loading module __getattr__ caching into globals() in the admin resources package.
Reasoning
Same generated lazy-import __getattr__ pattern as the other openai resources __init__ files: a name lookup that raises AttributeError on miss and caches the value in globals(). It is routine package plumbing.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/admin/organization/__init__.py:233:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 Lazy-loading module __getattr__ caching into globals() in the admin organization resources package.
Reasoning
Standard PEP 562 lazy attribute loading via globals() caching. The snippet shows no decoding, network access, or execution of fetched content.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/admin/organization/groups/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 Lazy-loading module __getattr__ caching into globals() in the organization groups resources package.
Reasoning
Generated lazy-import __getattr__ with globals() caching, matching the standard SDK pattern. The flagged reach-by-name is ordinary module attribute resolution.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/admin/organization/projects/__init__.py:230:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 Lazy-loading module __getattr__ caching into globals() in the organization projects resources package.
Reasoning
Standard lazy submodule loader: unknown names raise AttributeError and resolved values are stored in globals(). This is a legitimate, widely used idiom.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/admin/organization/projects/groups/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 Lazy-loading module __getattr__ caching into globals() in the project groups resources package.
Reasoning
The snippet is the same benign PEP 562 __getattr__ with globals() caching. No external input is executed or decoded.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/admin/organization/projects/service_accounts/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 Lazy-loading module __getattr__ caching into globals() in the project service accounts resources package.
Reasoning
Standard lazy-import module __getattr__ with globals() caching, as generated across the SDK. Nothing suspicious appears in the snippet.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/admin/organization/projects/users/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 Lazy-loading module __getattr__ caching into globals() in the project users resources package.
Reasoning
Routine lazy submodule loader. The name-based globals() write is ordinary module attribute caching.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/admin/organization/users/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 Lazy-loading module __getattr__ caching into globals() in the organization users resources package.
Reasoning
Same standard lazy-loading __getattr__ pattern with globals() caching. It is benign package plumbing.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/audio/__init__.py:98:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 Lazy-loading module __getattr__ caching into globals() in the audio resources package.
Reasoning
Standard PEP 562 lazy attribute resolution with globals() caching. The pattern is legitimate and the snippet shows no malicious behavior.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/__init__.py:113:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 Lazy-loading module __getattr__ caching into globals() in the beta resources package.
Reasoning
Lazy submodule loader using module __getattr__ and globals() caching, a common and benign SDK idiom.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/agents/__init__.py:83:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 Lazy-loading module __getattr__ caching into globals() in the beta agents resources package.
Reasoning
The snippet is the standard lazy-import __getattr__ with globals() caching. It is routine package code.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/agents/environments/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 Lazy-loading module __getattr__ caching into globals() in the beta agents environments resources package.
Reasoning
Standard lazy attribute loading via globals(). Nothing in the snippet decodes, fetches, or executes anything.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/agents/sessions/__init__.py:128:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 Lazy-loading module __getattr__ caching into globals() in the beta agents sessions resources package.
Reasoning
Same benign PEP 562 __getattr__ idiom with globals() caching used across the SDK's generated resource packages.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/agents/sessions/subagents/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 Lazy-loading module __getattr__ caching into globals() in the subagents resources package.
Reasoning
Standard lazy-loading module __getattr__ with globals() caching. The reach-by-name is ordinary attribute resolution with no dynamic execution.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/agents/sessions/subagents/turns/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 Lazy-loading module __getattr__ caching into globals() in the subagents turns resources package.
Reasoning
Routine lazy submodule loader using globals() caching. It matches the rest of the generated SDK package structure and is not an obfuscation or dropper pattern.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/agents/sessions/turns/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 A lazy-loading module __getattr__ that caches resolved attributes in globals().
Reasoning
The snippet is a module-level __getattr__ that caches a lazily imported attribute into globals() and raises AttributeError for unknown names. This is the standard lazy-import idiom for SDK subpackages, and the name is a local variable, not attacker-controlled input.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/agents/vaults/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 A lazy-loading module __getattr__ that caches resolved attributes in globals().
Reasoning
Same lazy-import __getattr__ pattern: the snippet resolves a module attribute, caches it in globals(), and raises AttributeError otherwise. Nothing here executes code or decodes data.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/chatkit/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 A lazy-loading module __getattr__ that caches resolved attributes in globals().
Reasoning
The snippet is the standard lazy module attribute loader with a globals() cache and AttributeError fallback, typical of generated SDK __init__ files.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/responses/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 A lazy-loading module __getattr__ that caches resolved attributes in globals().
Reasoning
The snippet is the standard lazy module attribute loader with a globals() cache and AttributeError fallback, a common pattern in the openai SDK package layout.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/threads/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 A lazy-loading module __getattr__ that caches resolved attributes in globals().
Reasoning
The snippet is the standard lazy module attribute loader with a globals() cache and AttributeError fallback, with no dynamic execution or decoding.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/threads/runs/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 A lazy-loading module __getattr__ that caches resolved attributes in globals().
Reasoning
The snippet is the standard lazy module attribute loader with a globals() cache and AttributeError fallback, consistent with the generated SDK layout.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/chat/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 A lazy-loading module __getattr__ that caches resolved attributes in globals().
Reasoning
The snippet is the standard lazy module attribute loader with a globals() cache and AttributeError fallback. It is a legitimate import-deferral technique.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/chat/completions/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 A lazy-loading module __getattr__ that caches resolved attributes in globals().
Reasoning
The snippet is the standard lazy module attribute loader with a globals() cache and AttributeError fallback, with no network, shell, or decode behavior.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/containers/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 A lazy-loading module __getattr__ that caches resolved attributes in globals().
Reasoning
The snippet is the standard lazy module attribute loader with a globals() cache and AttributeError fallback, a common and benign SDK pattern.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/containers/files/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 A lazy-loading module __getattr__ that caches resolved attributes in globals().
Reasoning
The snippet is the standard lazy module attribute loader with a globals() cache and AttributeError fallback, with nothing that executes or decodes payloads.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/conversations/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 A lazy-loading module __getattr__ that caches resolved attributes in globals().
Reasoning
The snippet is the standard lazy module attribute loader with a globals() cache and AttributeError fallback, consistent with generated SDK code.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/evals/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 A lazy-loading module __getattr__ that caches resolved attributes in globals().
Reasoning
The snippet is the standard lazy module attribute loader with a globals() cache and AttributeError fallback, a legitimate import-deferral idiom.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/evals/runs/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 A lazy-loading module __getattr__ that caches resolved attributes in globals().
Reasoning
The snippet is the standard lazy module attribute loader with a globals() cache and AttributeError fallback, with no suspicious execution behavior.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/fine_tuning/__init__.py:83:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 A lazy-loading module __getattr__ that caches resolved attributes in globals().
Reasoning
The snippet is the standard lazy module attribute loader with a globals() cache and AttributeError fallback, consistent with the other SDK subpackage loaders.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/fine_tuning/alpha/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 A lazy-loading module __getattr__ that caches resolved attributes in globals().
Reasoning
The snippet is the standard lazy module attribute loader with a globals() cache and AttributeError fallback, a benign import-deferral pattern.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/fine_tuning/checkpoints/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.94 A lazy-loading module __getattr__ that caches resolved attributes in globals().
Reasoning
The snippet is the standard lazy module attribute loader with a globals() cache and AttributeError fallback, with no dynamic execution or encoded payloads.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/fine_tuning/jobs/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Module-level __getattr__ that lazily loads and caches a submodule attribute via globals().
Reasoning
This is the standard lazy-import pattern in a generated SDK package: __getattr__ imports a submodule on first access, caches it in globals(), and raises AttributeError for unknown names. The name comes from the module's own attribute access, not untrusted input.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/live/__init__.py:67:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader caching values into globals() in the live resources package.
Reasoning
Same lazy-loading __getattr__ pattern as the other SDK package initializers; it only resolves the package's own declared submodules and raises on unknown names.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/realtime/__init__.py:83:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader caching values into globals() in the realtime resources package.
Reasoning
Standard generated lazy-import __getattr__ that caches resolved names in globals(). No external input or execution of fetched content is involved.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/realtime/translations/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader caching values into globals() in the realtime translations package.
Reasoning
Identical lazy-import __getattr__ pattern; resolves only the package's own names and raises AttributeError otherwise.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/responses/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader caching values into globals() in the responses resources package.
Reasoning
Standard lazy-import __getattr__ in a generated SDK package initializer, consistent with the rest of the package. The flagged globals() write is a normal caching step.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/safety/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader caching values into globals() in the safety resources package.
Reasoning
Identical generated lazy-import pattern for a submodule attribute; no sensitive or external data flows into the dynamic lookup.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/skills/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader caching values into globals() in the skills resources package.
Reasoning
Standard lazy-import __getattr__ used across the SDK's resource packages; the dynamic globals() assignment only caches the package's own submodules.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/skills/versions/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader caching values into globals() in the skills versions package.
Reasoning
Same generated lazy-loading __getattr__ pattern; benign module plumbing with no external input.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/uploads/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader caching values into globals() in the uploads resources package.
Reasoning
Standard lazy-import __getattr__ for the package's own submodules; the globals() caching is ordinary and the AttributeError path guards unknown names.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/vector_stores/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader caching values into globals() in the vector stores resources package.
Reasoning
Identical generated lazy-loading pattern; it resolves declared package attributes only and is routine SDK code.
info ~~warn~~ → info by review encoding-base64 tests/lib/test_webhooks.py:24:22

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
# Standardized test constants (matches TypeScript implementation)
TEST_SECRET = "whsec_RdvaYFYUXuIFuEbvZHwMfYFhUf7aMYjYcmM24+Aj40c="
TEST_PAYLOAD = '{"id": "evt_685c059ae3a481909bdc86819b066fb6", "object": "event", "created_at": 1750861210, "type": "response.completed", "data": {"id": "resp_123"}}'
```
likely benign LLM, confidence 0.95 Test webhook signing secret constant in a unit test file.
Reasoning
The flagged value is a test webhook secret constant, explicitly labelled as matching the TypeScript test implementation. It is a fixed test vector in a test file, not an encoded payload or hidden code.
info ~~warn~~ → info by review encoding-base64 tests/lib/test_webhooks.py:28:22

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
TEST_WEBHOOK_ID = "wh_685c059ae39c8190af8c71ed1022a24d"
TEST_SIGNATURE = "v1,gUAg4R2hWouRZqRQG4uJypNS8YK885G838+EHb4nKBY="
SIP_EVENT_TYPES = ["live.call.incoming", "live.transport.incoming", "realtime.call.incoming"]
SIP_MEDIA_SECURITY_VALUES = [None, "rtp", "srtp", "future_media_security"]
```
likely benign LLM, confidence 0.95 Test webhook signature constant in a unit test file.
Reasoning
The flagged value is a fixed webhook signature test vector alongside other test constants. Base64 here is the normal format for webhook signatures in test fixtures.
info ~~warn~~ → info by review dynamic-execution tests/test_uv_workflows.py:1243:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    # Compile once per worker, but execute with fresh globals for every case.
    return compile(security_dependency_floor_program(), str(ROOT / "scripts/check-dependency-security.py"), "exec")
```
likely benign LLM, confidence 0.80 Test helper compiles a generated program for the dependency-security checker script.
Reasoning
The compile call takes source produced by a local helper (security_dependency_floor_program) and compiles it for a repository script path inside a test. This is test harness behaviour, not an attacker-controlled dropper, though the generated source is not fully visible in the snippet.
info ~~warn~~ → info by review dynamic-execution tests/test_uv_workflows.py:1522:19

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    # the same checker and Git stub in-process; keep real CLI coverage below.
    git_program = compile(fake_git.read_text(), str(fake_git), "exec")

    def run_git(args: list[str], **_kwargs: Any) -> subprocess.CompletedProcess[str]:
```
likely benign LLM, confidence 0.80 Test compiles a fake git stub script read from a fixture file.
Reasoning
The code compiles a fake git stub read from a test fixture file to run a checker in-process. The comment describes this as deliberate test isolation with real CLI coverage kept separately, which is consistent with benign test scaffolding.
info ~~warn~~ → info by review dynamic-execution tests/test_uv_workflows.py:1529:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
            patch.setattr(sys, "argv", args)
            exec(git_program, {"__name__": "__main__"})
        return subprocess.CompletedProcess(args, 0, output.getvalue(), "")
```
likely benign LLM, confidence 0.80 Test executes a fake git stub in-process to mock subprocess output.
Reasoning
exec runs the compiled fake git stub in a fresh globals dict with patched argv and captured output. This is a test-only mock of the git CLI, and the source comes from a repository test fixture rather than from the network or user input.
info ~~warn~~ → info by review dynamic-execution tests/test_uv_workflows.py:1543:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        try:
            exec(compiled_security_dependency_floor_program(), {"__name__": "__main__"})
        except SystemExit as error:
            if isinstance(error.code, int):
```
likely benign LLM, confidence 0.70 A test in a uv workflow test module execs a program produced by a helper and checks the SystemExit code.
Reasoning
The exec call runs the return value of a local helper, compiled_security_dependency_floor_program(), with a fresh __name__ of __main__, and catches SystemExit. That is a common pattern for a test harness that runs a generated script and checks its exit code. The snippet shows no decoding, download, or network step, and the file is a test module. Exec of a non-literal is still worth a look because the program source is not visible, so this is likely benign rather than confirmed.
info ~~warn~~ → info by review dynamic-execution tests/utils.py:32:12

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
def evaluate_forwardref(forwardref: ForwardRef, globalns: dict[str, Any]) -> type:
    return eval(str(forwardref), globalns)  # type: ignore[no-any-return]
```
likely benign LLM, confidence 0.92 A test utility evaluates a ForwardRef's string form in a given namespace to resolve type annotations.
Reasoning
This is a standard helper that resolves a typing.ForwardRef by evaluating its string form against a supplied globals dict, the same approach typing and pydantic-style libraries use. The input is type annotation text from the codebase, not attacker-controlled data, and the file is a test utility. There is no obfuscation or dropper behavior here.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/openai/openai-python openai-python && cd openai-python
git checkout v3.32.0
disclude scan --severity info --diff v3.31.0 .