openai 3.33.0

Source: https://github.com/openai/openai-python
Tag scanned: v3.33.0
Compared with: v3.32.0 (0 signals introduced since)
Files: 2440 scanned, 37 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 110 info
Scan time: 47.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 61 of 61 warn and critical signals; 61 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-17 18:12

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review long-line api_reference/openapi.transformed.yml:1077:1

line length 2410 characters (raw pass, confidence 0.65)
```
            data: {"type":"transcript.text.done","text":"I see skies of blue and clouds of white, the bright blessed days, the dark sacred nights, and I think to myself, what a wonderful world.","logprobs":[{"token":"I","logprob":-0.00007588794,"bytes":[73]},{"token":" see","logprob":-3.1281633e-7,"bytes":[32,115,101,1
```
dismissed LLM, confidence 0.95 A long JSON example line in an OpenAPI reference document.
Reasoning
A long line inside a YAML API example that holds a JSON-encoded transcript event with logprobs. Long lines in generated API reference docs are ordinary, and the raw-pass long-line signal is weak evidence on its own.

info long-line api_reference/openapi.transformed.yml:5743:1

line length 1879 characters (raw pass, confidence 0.50)

                -d '{"name":"gpt-6-astra","data_source":{"type":"completions","input_messages":{"type":"template","template":[{"role":"developer","content":"Categorize a given news headline into one of the following topics: Technology, Markets, World, Business, or Sports.\n\n# Steps\n\n1. Analyze the content of the new

info long-line api_reference/openapi.transformed.yml:7872:1

line length 783 characters (raw pass, confidence 0.50)

            python: "from openai import OpenAI\nfrom openai.types.fine_tuning import ReinforcementMethod, ReinforcementHyperparameters\nfrom openai.types.graders import StringCheckGrader\n\nclient = OpenAI()\n\nclient.fine_tuning.jobs.create(\n  training_file=\"file-abc\",\n  validation_file=\"file-123\",\n  model=\"o4

info long-line api_reference/openapi.transformed.yml:10951:1

line length 516 characters (raw pass, confidence 0.50)

        description: Group the costs by the specified fields. Supported fields include `project_id`, `user_id`, `line_item`, `api_key_id`, and `api_source`. Support for combining `user_id` with `project_id` grouping or the `project_ids` filter depends on the organization and requested time range. Unsupported combinatio

info long-line api_reference/openapi.transformed.yml:19845:1

line length 687 characters (raw pass, confidence 0.50)

          response: "{\n  \"id\": \"sess_001\",\n  \"object\": \"realtime.session\",\n  \"model\": \"gpt-realtime-2025-08-25\",\n  \"modalities\": [\"audio\", \"text\"],\n  \"instructions\": \"You are a friendly assistant.\",\n  \"voice\": \"alloy\",\n  \"input_audio_format\": \"pcm16\",\n  \"output_audio_format\": \"p

info long-line api_reference/openapi.transformed.yml:19849:1

line length 525 characters (raw pass, confidence 0.50)

      description: "Create an ephemeral API token for use in client-side applications with the\nRealtime API specifically for realtime transcriptions. \nCan be configured with the same session parameters as the `transcription_session.update` client event.\n\nIt responds with a session object, plus a `client_secret` key

info ~~warn~~ → info by review long-line api_reference/openapi.transformed.yml:20395:1

line length 2244 characters (raw pass, confidence 0.65)
```
                      "text": "The file seems to contain excerpts from a letter to the shareholders of Berkshire Hathaway Inc., likely written by Warren Buffett. It covers several topics:\n\n1. **Communication Philosophy**: Buffett emphasizes the importance of transparency and candidness in reporting mistakes and succe
```
dismissed LLM, confidence 0.95 A long example response string in an OpenAPI reference document.
Reasoning
A long YAML string holding example model output text about a Berkshire Hathaway letter. This is documentation sample content, not obfuscation.

info long-line api_reference/openapi.transformed.yml:22138:1

line length 1261 characters (raw pass, confidence 0.50)

            data: {"id":"run_123","object":"thread.run","created_at":1710351818,"assistant_id":"asst_123","thread_id":"thread_123","status":"requires_action","started_at":1710351818,"expires_at":1710352418,"cancelled_at":null,"failed_at":null,"completed_at":null,"required_action":{"type":"submit_tool_outputs","submit_t

info ~~warn~~ → info by review long-line api_reference/openapi.transformed.yml:34967:1

line length 2244 characters (raw pass, confidence 0.65)

                      "text": "The file seems to contain excerpts from a letter to the shareholders of Berkshire Hathaway Inc., likely written by Warren Buffett. It covers several topics:\n\n1. **Communication Philosophy**: Buffett emphasizes the importance of transparency and candidness in reporting mistakes and succe

dismissed LLM, confidence 0.95 A repeated long example response string in the OpenAPI reference document.

Reasoning

A duplicate of the same long documentation example line, with the same benign content.

info long-line api_reference/openapi.transformed.yml:37546:1

line length 506 characters (raw pass, confidence 0.50)

        **Important:** when using JSON mode, you **must** also instruct the model to produce JSON yourself via a system or user message. Without this, the model may generate an unending stream of whitespace until the generation reaches the token limit, resulting in a long-running and seemingly "stuck" request. Also not

info long-line api_reference/openapi.transformed.yml:41982:1

line length 561 characters (raw pass, confidence 0.50)

            Accepts a JSON object that maps tokens (specified by their token ID in the GPT tokenizer) to an associated bias value from -100 to 100. You can use this [tokenizer tool](https://platform.openai.com/tokenizer?view=bpe) to convert text to token IDs. Mathematically, the bias is added to the logits generated by

info long-line api_reference/openapi.transformed.yml:42267:1

line length 604 characters (raw pass, confidence 0.50)

            Input text to embed, encoded as a string or array of tokens. To embed multiple inputs in a single request, pass an array of strings or array of token arrays. The input must not exceed the max input tokens for the model (8192 tokens for all embedding models), cannot be an empty string, and any array must be

info long-line api_reference/openapi.transformed.yml:43247:1

line length 779 characters (raw pass, confidence 0.50)

          description: The size of the generated images. Defaults to `auto`. For `gpt-image-2`, `gpt-image-2-2026-04-21`, `gpt-image-2.5-sunburst`, `gpt-image-2.5-sunburst-2026-09-08`, `gpt-image-2.5-flare`, and `gpt-image-2.5-flare-2026-09-08`, arbitrary resolutions are supported as `WIDTHxHEIGHT` strings, for example

info long-line api_reference/openapi.transformed.yml:43466:1

line length 759 characters (raw pass, confidence 0.50)

          description: The size of the generated images. For `gpt-image-2`, `gpt-image-2-2026-04-21`, `gpt-image-2.5-sunburst`, `gpt-image-2.5-sunburst-2026-09-08`, `gpt-image-2.5-flare`, and `gpt-image-2.5-flare-2026-09-08`, arbitrary resolutions are supported as `WIDTHxHEIGHT` strings, for example `1536x864`. Width a

info long-line api_reference/openapi.transformed.yml:44304:1

line length 566 characters (raw pass, confidence 0.50)

          description: 'The voice to use when generating the audio. Supported built-in voices are `alloy`, `ash`, `ballad`, `coral`, `echo`, `fable`, `onyx`, `nova`, `sage`, `shimmer`, `verse`, `marin`, and `cedar`. You may also provide a custom voice object with an `id`, for example `{ "id": "voice_1234" }`. Previews

info long-line api_reference/openapi.transformed.yml:45740:1

line length 759 characters (raw pass, confidence 0.50)

          description: The size of the generated images. For `gpt-image-2`, `gpt-image-2-2026-04-21`, `gpt-image-2.5-sunburst`, `gpt-image-2.5-sunburst-2026-09-08`, `gpt-image-2.5-flare`, and `gpt-image-2.5-flare-2026-09-08`, arbitrary resolutions are supported as `WIDTHxHEIGHT` strings, for example `1536x864`. Width a

info long-line api_reference/openapi.transformed.yml:49474:1

line length 759 characters (raw pass, confidence 0.50)

          description: The size of the generated images. For `gpt-image-2`, `gpt-image-2-2026-04-21`, `gpt-image-2.5-sunburst`, `gpt-image-2.5-sunburst-2026-09-08`, `gpt-image-2.5-flare`, and `gpt-image-2.5-flare-2026-09-08`, arbitrary resolutions are supported as `WIDTHxHEIGHT` strings, for example `1536x864`. Width a

info long-line api_reference/openapi.transformed.yml:54367:1

line length 600 characters (raw pass, confidence 0.50)

      description: "Send this event to truncate a previous assistant message’s audio. The server \nwill produce audio faster than realtime, so this event is useful when the user \ninterrupts to truncate audio that has already been sent to the client but not \nyet played. This will synchronize the server's understandi

info long-line api_reference/openapi.transformed.yml:54403:1

line length 631 characters (raw pass, confidence 0.50)

      description: "Send this event to append audio bytes to the input audio buffer. The audio \nbuffer is temporary storage you can write to and later commit. In Server VAD \nmode, the audio buffer is used to detect speech and the server will decide \nwhen to commit. When Server VAD is disabled, you must commit the au

info long-line api_reference/openapi.transformed.yml:54450:1

line length 583 characters (raw pass, confidence 0.50)

      description: "Send this event to commit the user input audio buffer, which will create a \nnew user message item in the conversation. This event will produce an error \nif the input audio buffer is empty. When in Server VAD mode, the client does \nnot need to send this event, the server will commit the audio buff

info long-line api_reference/openapi.transformed.yml:54521:1

line length 1303 characters (raw pass, confidence 0.50)

      description: "This event instructs the server to create a Response, which means triggering \nmodel inference. When in Server VAD mode, the server will create Responses \nautomatically.\n\nA Response will include at least one Item, and may have two, in which case \nthe second will be a function call. These Items w

info long-line api_reference/openapi.transformed.yml:54855:1

line length 750 characters (raw pass, confidence 0.50)

          description: "The default system instructions (i.e. system message) prepended to model \ncalls. This field allows the client to guide the model on desired \nresponses. The model can be instructed on response content and format, \n(e.g. \"be extremely succinct\", \"act friendly\", \"here are examples of good \

info long-line api_reference/openapi.transformed.yml:55468:1

line length 693 characters (raw pass, confidence 0.50)

      description: "Sent by the server when in `server_vad` mode to indicate that speech has been \ndetected in the audio buffer. This can happen any time audio is added to the \nbuffer (unless speech is already detected). The client may want to use this \nevent to interrupt audio playback or provide visual feedback to

info long-line api_reference/openapi.transformed.yml:56621:1

line length 538 characters (raw pass, confidence 0.50)

              "instructions": "Your knowledge cutoff is 2023-10. You are a helpful, witty, and friendly AI. Act like a human, but remember that you aren't a human and that you can't do human things in the real world. Your voice and personality should be warm and engaging, with a lively and playful tone. If interacting

info long-line api_reference/openapi.transformed.yml:56855:1

line length 511 characters (raw pass, confidence 0.50)

      description: "Add a new Item to the Conversation's context, including messages, function \ncalls, and function call responses. This event can be used both to populate a \n\"history\" of the conversation and to add new items mid-stream, but has the \ncurrent limitation that it cannot populate assistant audio messa

info long-line api_reference/openapi.transformed.yml:56951:1

line length 600 characters (raw pass, confidence 0.50)

      description: "Send this event to truncate a previous assistant message’s audio. The server \nwill produce audio faster than realtime, so this event is useful when the user \ninterrupts to truncate audio that has already been sent to the client but not \nyet played. This will synchronize the server's understandi

info long-line api_reference/openapi.transformed.yml:56988:1

line length 910 characters (raw pass, confidence 0.50)

      description: "Send this event to append audio bytes to the input audio buffer. The audio \nbuffer is temporary storage you can write to and later commit. A \"commit\" will create a new\nuser message item in the conversation history from the buffer content and clear the buffer.\nInput audio transcription (if enabl

info long-line api_reference/openapi.transformed.yml:57113:1

line length 1388 characters (raw pass, confidence 0.50)

      description: "This event instructs the server to create a Response, which means triggering \nmodel inference. When in Server VAD mode, the server will create Responses \nautomatically.\n\nA Response will include at least one Item, and may have two, in which case \nthe second will be a function call. These Items w

info long-line api_reference/openapi.transformed.yml:58187:1

line length 535 characters (raw pass, confidence 0.50)

            The default system instructions (i.e. system message) prepended to model calls. This field allows the client to guide the model on desired responses. The model can be instructed on response content and format, (e.g. "be extremely succinct", "act friendly", "here are examples of good responses") and on audio

info long-line api_reference/openapi.transformed.yml:59022:1

line length 693 characters (raw pass, confidence 0.50)

      description: "Sent by the server when in `server_vad` mode to indicate that speech has been \ndetected in the audio buffer. This can happen any time audio is added to the \nbuffer (unless speech is already detected). The client may want to use this \nevent to interrupt audio playback or provide visual feedback to

info long-line api_reference/openapi.transformed.yml:59746:1

line length 547 characters (raw pass, confidence 0.50)

      description: "Returned when a Response is done streaming. Always emitted, no matter the \nfinal state. The Response object included in the `response.done` event will \ninclude all output Items in the Response but will omit the raw audio data.\n\nClients should check the `status` field of the Response to determine

info long-line api_reference/openapi.transformed.yml:60338:1

line length 538 characters (raw pass, confidence 0.50)

              "instructions": "Your knowledge cutoff is 2023-10. You are a helpful, witty, and friendly AI. Act like a human, but remember that you aren't a human and that you can't do human things in the real world. Your voice and personality should be warm and engaging, with a lively and playful tone. If interacting

info long-line api_reference/openapi.transformed.yml:60412:1

line length 538 characters (raw pass, confidence 0.50)

              "instructions": "Your knowledge cutoff is 2023-10. You are a helpful, witty, and friendly AI. Act like a human, but remember that you aren't a human and that you can't do human things in the real world. Your voice and personality should be warm and engaging, with a lively and playful tone. If interacting

info long-line api_reference/openapi.transformed.yml:60621:1

line length 634 characters (raw pass, confidence 0.50)

              Configuration for input audio transcription, defaults to off and can be set to `null` to turn off once on. Input audio transcription is not native to the model, since the model consumes audio directly. Transcription runs asynchronously through [the /audio/transcriptions endpoint](https://developers.openai

info long-line api_reference/openapi.transformed.yml:60771:1

line length 535 characters (raw pass, confidence 0.50)

            The default system instructions (i.e. system message) prepended to model calls. This field allows the client to guide the model on desired responses. The model can be instructed on response content and format, (e.g. "be extremely succinct", "act friendly", "here are examples of good responses") and on audio

info long-line api_reference/openapi.transformed.yml:61012:1

line length 535 characters (raw pass, confidence 0.50)

            The default system instructions (i.e. system message) prepended to model calls. This field allows the client to guide the model on desired responses. The model can be instructed on response content and format, (e.g. "be extremely succinct", "act friendly", "here are examples of good responses") and on audio

info long-line api_reference/openapi.transformed.yml:61454:1

line length 535 characters (raw pass, confidence 0.50)

            The default system instructions (i.e. system message) prepended to model calls. This field allows the client to guide the model on desired responses. The model can be instructed on response content and format, (e.g. "be extremely succinct", "act friendly", "here are examples of good responses") and on audio

info long-line api_reference/openapi.transformed.yml:73681:1

line length 669 characters (raw pass, confidence 0.50)

      description: Options for prompt caching. Supported for `gpt-5.6` and later models. By default, OpenAI automatically chooses one implicit cache breakpoint. You can add explicit breakpoints to content blocks with `prompt_cache_breakpoint`. Each request can write up to four breakpoints. For cache matching, OpenAI co

info long-line api_reference/openapi.transformed.yml:78611:1

line length 751 characters (raw pass, confidence 0.50)

          description: The Cyber access program to use for this request. Supported values are `standard`, `daybreak_blue`, and `daybreak_red`. If omitted, the API resolves the program from the model's Cyber tier and your organization and project access, subject to model-specific eligibility restrictions. By default, mo

info long-line api_reference/openapi.transformed.yml:78636:1

line length 669 characters (raw pass, confidence 0.50)

      description: Options for prompt caching. Supported for `gpt-5.6` and later models. By default, OpenAI automatically chooses one implicit cache breakpoint. You can add explicit breakpoints to content blocks with `prompt_cache_breakpoint`. Each request can write up to four breakpoints. For cache matching, OpenAI co

info long-line api_reference/openapi.transformed.yml:80503:1

line length 951 characters (raw pass, confidence 0.50)

              Specifies the processing type used for serving the request.   - If set to 'auto', then the request will be processed with the service tier configured in the Project settings. Unless otherwise configured, the Project will use 'default'.   - If set to 'default', then the request will be processed with the s

info long-line api_reference/openapi.transformed.yml:82400:1

line length 673 characters (raw pass, confidence 0.50)

          description: Options for prompt caching. Supported for `gpt-5.6` and later models. By default, OpenAI automatically chooses one implicit cache breakpoint. You can add explicit breakpoints to content blocks with `prompt_cache_breakpoint`. Each request can write up to four breakpoints. For cache matching, OpenA

info long-line api_reference/openapi.transformed.yml:92423:1

line length 589 characters (raw pass, confidence 0.50)

      description: Play one complete audio fixture through the session output. Send this event over the primary WebSocket or a server sideband. Audio must be raw mono PCM16 little-endian at 24 kHz, regardless of the session audio format, and at most 30 seconds. The entire payload is validated before model speech is int

info long-line api_reference/openapi.transformed.yml:95206:1

line length 759 characters (raw pass, confidence 0.50)

          description: The size of the generated images. For `gpt-image-2`, `gpt-image-2-2026-04-21`, `gpt-image-2.5-sunburst`, `gpt-image-2.5-sunburst-2026-09-08`, `gpt-image-2.5-flare`, and `gpt-image-2.5-flare-2026-09-08`, arbitrary resolutions are supported as `WIDTHxHEIGHT` strings, for example `1536x864`. Width a

info long-line api_reference/openapi.transformed.yml:99405:1

line length 951 characters (raw pass, confidence 0.50)

              Specifies the processing type used for serving the request.   - If set to 'auto', then the request will be processed with the service tier configured in the Project settings. Unless otherwise configured, the Project will use 'default'.   - If set to 'default', then the request will be processed with the s

info long-line api_reference/openapi.transformed.yml:99430:1

line length 669 characters (raw pass, confidence 0.50)

      description: Options for prompt caching. Supported for `gpt-5.6` and later models. By default, OpenAI automatically chooses one implicit cache breakpoint. You can add explicit breakpoints to content blocks with `prompt_cache_breakpoint`. Each request can write up to four breakpoints. For cache matching, OpenAI co

info long-line api_reference/openapi.transformed.yml:106590:1

line length 669 characters (raw pass, confidence 0.50)

      description: Options for prompt caching. Supported for `gpt-5.6` and later models. By default, OpenAI automatically chooses one implicit cache breakpoint. You can add explicit breakpoints to content blocks with `prompt_cache_breakpoint`. Each request can write up to four breakpoints. For cache matching, OpenAI co

info long-line api_reference/openapi.transformed.yml:106595:1

line length 751 characters (raw pass, confidence 0.50)

          description: The Cyber access program to use for this request. Supported values are `standard`, `daybreak_blue`, and `daybreak_red`. If omitted, the API resolves the program from the model's Cyber tier and your organization and project access, subject to model-specific eligibility restrictions. By default, mo

info long-line docs/architecture/security-model.md:35:1

line length 1109 characters (raw pass, confidence 0.50)

| Streaming and authenticated WebSockets | Incrementally decode SSE and exchange authenticated current or beta Realtime/Responses WebSocket messages through distinct sync and async connection paths. | [src/openai/_streaming.py:53](../../src/openai/_streaming.py), [src/openai/resources/realtime/realtime.py:683](../../sr

info ~~warn~~ → info by review long-line docs/architecture/security-model.md:54:1

line length 2482 characters (raw pass, confidence 0.65)
```
| Legacy module-level client | Global/environment-selected OpenAI, Azure, or Bedrock credential and destination | Module `api_type` starts from `OPENAI_API_TYPE`. `_load_client()` fills unset Azure endpoint/version globals from environment; only when `api_type` is unset, it rejects `OPENAI_API_KEY` in the environment t
```
dismissed LLM, confidence 0.95 A long security-model table row in Markdown documentation.
Reasoning
A long Markdown table row describing credential handling in prose. Wide table rows in documentation are normal and contain no code or payload.
info ~~warn~~ → info by review long-line docs/architecture/security-model.md:65:1

line length 2772 characters (raw pass, confidence 0.65)
```
| Current and beta Realtime/Responses WebSockets | WebSocket destination and client auth headers | All current and beta paths use explicit `websocket_base_url` or transform the configured HTTP base to a WebSocket scheme, then merge client auth with caller extra headers. Only Realtime branches into Azure `_configure_rea
```
dismissed LLM, confidence 0.95 A long WebSocket security table row in Markdown documentation.
Reasoning
A long Markdown table row of prose about WebSocket auth headers. It is documentation with no executable content.

info long-line docs/architecture/security-model.md:353:1

line length 1687 characters (raw pass, confidence 0.50)

| High | Legacy module-client selection or cache regression routes an OpenAI, Azure, or Bedrock credential through the wrong provider. | Mutable module globals or environment signals must cross a broken precedence, ambiguity, forwarding, or reset boundary; the caller deliberately setting a coherent provider configurati

info ~~warn~~ → info by review long-line docs/architecture/security-model.md:354:1

line length 2534 characters (raw pass, confidence 0.65)
```
| High | A current or beta Realtime/Responses WebSocket regression sends client auth to the wrong peer or redirect target. | A sync direct-connect or async wrapper path must lose its destination/header binding; caller-selected explicit WebSocket configuration alone is insufficient. | API credential disclosure; Azure `a
```
dismissed LLM, confidence 0.95 A long risk-table row in Markdown documentation.
Reasoning
A long Markdown table row describing a regression risk. It is prose, not code, and the raw-pass long-line flag is noise here.

info long-line docs/architecture/security-model.md:365:1

line length 1490 characters (raw pass, confidence 0.50)

| Medium | Monthly review input or output escapes its intended isolation or publication boundary. | A regression lets independently mutable lifecycle/PyPI data expose the action-held key, mutate protected workspace state, leak sensitive output to the step summary, escape the bounded issue body into publisher commands/m

info long-line docs/architecture/security-model.md:366:1

line length 1595 characters (raw pass, confidence 0.50)

| High | Castiron candidate data escapes the trusted reporter/publisher boundary and changes published commit statuses or PR comments. | Candidate Git objects, stale run metadata, or an untrusted artifact must bypass provenance/freshness/payload/artifact checks before a write-capable publisher acts; normal candidate in

info ~~warn~~ → info by review dynamic-import scripts/run-steady:5:1

`source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)
```
STEADY_ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
source "$STEADY_ROOT/scripts/steady/settings"
steady_verify
```
likely benign LLM, confidence 0.85 A launcher script sources its repo-local settings file through a computed root path.
Reasoning
The sourced path is built from the script's own directory via dirname and pwd, then points to a settings file inside the same repo. This is a standard bootstrap pattern, not an injection path.
info ~~critical~~ → info by review dynamic-execution scripts/run-steady:9:1

`exec` called with a dynamic (variable/substitution) path (ast pass, confidence 0.85)
```
# Keep the caller's working directory so relative spec paths keep working.
exec "$DENO_DIRECTORY/$DENO_BINARY" run --cached-only --frozen \
  --config "$STEADY_SOURCE/deno.json" \
  --allow-read --allow-net --allow-env --allow-write \
```
likely benign LLM, confidence 0.70 A launcher execs the Deno binary using paths from repo settings.
Reasoning
The exec target comes from DENO_DIRECTORY and DENO_BINARY, defined in the repo's settings file. It runs deno with a locked, cached, frozen configuration, which fits a launcher. The dynamic path is expected here, though it is worth confirming the settings file is trusted.
info ~~warn~~ → info by review dynamic-import scripts/steady/install:5:1

`source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)
```
STEADY_ROOT="$(cd "$(dirname "$0")/../.." && pwd -P)"
source "$STEADY_ROOT/scripts/steady/settings"

mkdir -p "$STEADY_CACHE"
```
likely benign LLM, confidence 0.85 An install script sources its repo-local settings file.
Reasoning
The same repo-relative bootstrap as run-steady: the script computes its root from $0 and sources a sibling settings file. Nothing in the snippet is attacker-controlled.
info ~~warn~~ → info by review dynamic-execution scripts/steady/install:35:1

command name is a variable (`$DENO_DIRECTORY`, `$DENO_BINARY`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
steady_verify
"$DENO_DIRECTORY/$DENO_BINARY" cache --frozen --config "$STEADY_SOURCE/deno.json" "$STEADY_SOURCE/cmd/steady.ts" >&2

if [[ "${1:-}" == '--print-executable' ]]; then
```
likely benign LLM, confidence 0.75 An install script runs a cached Deno build using variables from settings.
Reasoning
The command variables are defined in the sourced settings file, and the invocation runs deno cache with --frozen on a repo-local entry point. This is a normal build step, though the indirection means the settings file should be reviewed.
info ~~warn~~ → info by review dynamic-attribute src/openai/__init__.py:139:13

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            value = getattr(import_module(module, __name__), name)
            globals()[name] = value
            return value
        raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
```
dismissed LLM, confidence 0.90 A lazy module __getattr__ that caches imported attributes in globals.
Reasoning
This is the standard PEP 562 lazy-loading pattern: module __getattr__ imports a submodule on first access and caches it in globals. It is a legitimate SDK idiom and not hidden execution.
info ~~warn~~ → info by review dynamic-attribute src/openai/lib/streaming/__init__.py:19:13

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            value = getattr(import_module("._assistants", __name__), name)
            globals()[name] = value
            return value
        raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
```
dismissed LLM, confidence 0.90 A lazy module __getattr__ in the streaming package for deferred imports.
Reasoning
The same PEP 562 lazy-import idiom, importing a relative submodule by name. It is ordinary package code.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/__init__.py:350:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Module-level __getattr__ that lazily loads a submodule and caches it in globals().
Reasoning
This is the standard PEP 562 lazy-import __getattr__ pattern. It raises AttributeError for unknown names, imports the requested submodule, and caches the result in globals(). The file is an SDK package __init__, and the snippet shows no decoding, exec, or network activity.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/admin/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-loading module __getattr__ that caches the resolved attribute in globals().
Reasoning
Same lazy-loading __getattr__ pattern used across the SDK's resource packages. Writing to globals() only caches an already-imported attribute by name, with no payload or obfuscation.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/admin/organization/__init__.py:233:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-loading module __getattr__ that caches the resolved attribute in globals().
Reasoning
Standard PEP 562 lazy attribute resolution in an SDK package __init__. The globals() write only caches the resolved name and does not hide behaviour.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/admin/organization/groups/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-loading module __getattr__ that caches the resolved attribute in globals().
Reasoning
Standard lazy-import __getattr__ with a globals() cache in an SDK resource package. Nothing in the snippet is executed from decoded or remote data.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/admin/organization/projects/__init__.py:230:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-loading module __getattr__ that caches the resolved attribute in globals().
Reasoning
Standard PEP 562 lazy attribute pattern in an SDK package. The globals() assignment only memoizes a submodule attribute.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/admin/organization/projects/groups/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-loading module __getattr__ that caches the resolved attribute in globals().
Reasoning
Same lazy-loading __getattr__ idiom with globals() caching, found throughout the openai SDK's generated package layout. No suspicious execution or decoding.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/admin/organization/projects/service_accounts/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-loading module __getattr__ that caches the resolved attribute in globals().
Reasoning
Standard lazy-import __getattr__ with globals() caching in an SDK resource package. The pattern is generated boilerplate and shows no malicious behaviour.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/admin/organization/projects/users/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-loading module __getattr__ that caches the resolved attribute in globals().
Reasoning
Standard PEP 562 lazy attribute resolution in an SDK package __init__. globals() is used only to cache the loaded submodule.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/admin/organization/users/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-loading module __getattr__ that caches the resolved attribute in globals().
Reasoning
Standard lazy-loading __getattr__ with a globals() cache in the SDK's generated resource packages. Nothing suspicious is shown.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/audio/__init__.py:98:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-loading module __getattr__ that caches the resolved attribute in globals().
Reasoning
Standard PEP 562 lazy import pattern in an SDK package __init__. The globals() write is a normal memoization step.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/__init__.py:113:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-loading module __getattr__ that caches the resolved attribute in globals().
Reasoning
Standard lazy-import __getattr__ with globals() caching in an SDK package. The pattern is common and benign.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/agents/__init__.py:83:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-loading module __getattr__ that caches the resolved attribute in globals().
Reasoning
Standard lazy attribute resolution in an SDK package __init__. globals() only caches the resolved submodule attribute.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/agents/environments/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-loading module __getattr__ that caches the resolved attribute in globals().
Reasoning
Same lazy-loading __getattr__ idiom with globals() caching in a generated SDK package. It shows no obfuscation or payload.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/agents/sessions/__init__.py:128:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-loading module __getattr__ that caches the resolved attribute in globals().
Reasoning
Standard PEP 562 lazy import in an SDK package __init__. The globals() assignment is ordinary caching.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/agents/sessions/subagents/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-loading module __getattr__ that caches the resolved attribute in globals().
Reasoning
Standard lazy-loading __getattr__ with globals() caching in an SDK resource package. The pattern is benign boilerplate.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/agents/sessions/subagents/turns/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-loading module __getattr__ that caches the resolved attribute in globals().
Reasoning
Standard PEP 562 lazy attribute resolution in an SDK package __init__. globals() is only used to memoize the loaded submodule.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/agents/sessions/turns/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.92 Lazy-import helper caching attributes into module globals.
Reasoning
Standard PEP 562 lazy-loading __getattr__ in a package __init__. It caches a lazily imported submodule into globals() under a name that is already validated by the module lookup, with no execution of external data.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/agents/vaults/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-loading __getattr__ in an OpenAI SDK package __init__ that caches resolved attributes into module globals.
Reasoning
The snippet is the standard PEP 562 module-level __getattr__ lazy-import pattern. It raises AttributeError for unknown names and caches resolved submodule attributes via globals(). The name is a module attribute key, not an attacker-controlled payload, and this file is a generated SDK resource package.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/chatkit/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Standard lazy-import __getattr__ caching resolved attributes in module globals in an SDK __init__.
Reasoning
Same PEP 562 lazy-loading __getattr__ idiom: unknown attributes raise AttributeError and resolved values are cached in globals(). It contains no decoding, execution, or network behaviour, and the surrounding file is a standard SDK package.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/responses/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Module __getattr__ that lazily imports and caches a named SDK attribute in globals().
Reasoning
This is the conventional PEP 562 lazy-attribute loader. The globals() write only memoizes an attribute that was already imported by name, so it is a routine performance and API-surface pattern.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/threads/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy module-attribute loader in the beta threads SDK package that caches values in globals().
Reasoning
The snippet is the standard lazy-loading __getattr__ with globals() memoization. It raises on unknown names and does nothing that would hide code or reach a dangerous sink.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/threads/runs/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy __getattr__ in the threads/runs SDK package that memoizes resolved attributes into globals().
Reasoning
This is the familiar PEP 562 __getattr__ pattern used across generated SDK packages. The globals() assignment caches an already-resolved attribute and is not an obfuscated call or dropper.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/chat/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 PEP 562-style lazy attribute resolution in the chat resources package __init__.
Reasoning
The snippet shows the standard lazy-import idiom, raising AttributeError for missing names and caching results in globals(). This is ordinary Python packaging code with no suspicious behaviour.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/chat/completions/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Module __getattr__ that caches lazily loaded chat completions attributes in globals().
Reasoning
This is the same benign module __getattr__ memoization pattern. The name is looked up and cached, with no encoded payload, dynamic execution, or shell interaction.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/containers/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader for the containers SDK package, caching values in globals().
Reasoning
Standard PEP 562 lazy loader. The globals() write memoizes a named attribute, and the AttributeError branch is the normal not-found path.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/containers/files/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy __getattr__ in the container files SDK package that memoizes attributes into globals().
Reasoning
This is the conventional lazy-import __getattr__ with globals() caching. No obfuscated string construction or execution is present in the snippet.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/conversations/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Module-level lazy attribute loader in the conversations SDK package.
Reasoning
The snippet is the usual PEP 562 lazy loader. It only caches an attribute already resolved by name and raises AttributeError when the name is unknown.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/evals/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy module __getattr__ in the evals SDK package that caches resolved attributes.
Reasoning
This is the standard lazy-import __getattr__ pattern with globals() memoization. It has no decoding, dynamic execution, or network activity.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/evals/runs/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader for eval runs in the OpenAI SDK, caching values in globals().
Reasoning
Same benign PEP 562 __getattr__ idiom used throughout the SDK. The globals() assignment caches a named attribute and does not conceal any logic.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/fine_tuning/__init__.py:83:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy submodule attribute resolution in the fine_tuning SDK package __init__.
Reasoning
This is the conventional lazy-loading __getattr__ with globals() caching. Raising AttributeError for unknown names is the standard fallback, so there is no malicious indicator.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/fine_tuning/alpha/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy __getattr__ in the fine_tuning alpha SDK package that caches resolved attributes.
Reasoning
The snippet is the standard PEP 562 lazy loader, memoizing a named attribute in globals(). It is an ordinary packaging pattern in a generated SDK file.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/fine_tuning/checkpoints/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader for fine_tuning checkpoints in the SDK, caching values in globals().
Reasoning
This is the same benign module __getattr__ memoization. It is a routine lazy-import mechanism with no encoded content, execution, or shell use.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/fine_tuning/jobs/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy module attribute loader caching resolved names in module globals.
Reasoning
Standard lazy-loading __getattr__ pattern for submodule imports in the OpenAI SDK; the name comes from module attribute access and caches the resolved value in globals. No external input or malicious payload involved.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/live/__init__.py:67:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy module attribute loader caching resolved names in module globals.
Reasoning
Same benign lazy __getattr__ caching pattern as other generated SDK __init__ files; no encoded or hidden behavior.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/realtime/__init__.py:83:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy module attribute loader caching resolved names in module globals.
Reasoning
Standard lazy-import __getattr__ in a generated SDK package; the globals write only caches an already-imported resource class.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/realtime/translations/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy module attribute loader caching resolved names in module globals.
Reasoning
Benign lazy-loading __getattr__ pattern identical to the rest of the SDK's package initializers.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/responses/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy module attribute loader caching resolved names in module globals.
Reasoning
Standard lazy module __getattr__ that raises AttributeError for unknown names and caches valid ones; typical SDK code.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/safety/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy module attribute loader caching resolved names in module globals.
Reasoning
Benign lazy-import __getattr__ pattern used across generated SDK packages.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/skills/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy module attribute loader caching resolved names in module globals.
Reasoning
Standard lazy __getattr__ with globals caching; no suspicious behavior.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/skills/versions/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy module attribute loader caching resolved names in module globals.
Reasoning
Standard lazy-loading __getattr__ pattern in a generated SDK package; benign.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/uploads/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy module attribute loader caching resolved names in module globals.
Reasoning
Standard lazy-loading __getattr__ pattern; the name is validated against known exports before caching.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/vector_stores/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy module attribute loader caching resolved names in module globals.
Reasoning
Benign lazy-import __getattr__ pattern in the SDK's generated package init.
info ~~warn~~ → info by review encoding-base64 tests/lib/test_webhooks.py:24:22

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
# Standardized test constants (matches TypeScript implementation)
TEST_SECRET = "whsec_RdvaYFYUXuIFuEbvZHwMfYFhUf7aMYjYcmM24+Aj40c="
TEST_PAYLOAD = '{"id": "evt_685c059ae3a481909bdc86819b066fb6", "object": "event", "created_at": 1750861210, "type": "response.completed", "data": {"id": "resp_123"}}'
```
likely benign LLM, confidence 0.95 Test webhook secret constant in base64 form.
Reasoning
The value is a clearly labeled test secret constant ('whsec_' prefixed Standard Webhooks secret) used to verify signatures; base64 of a test key is expected in test fixtures, low-entropy and not a payload.
info ~~warn~~ → info by review encoding-base64 tests/lib/test_webhooks.py:28:22

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
TEST_WEBHOOK_ID = "wh_685c059ae39c8190af8c71ed1022a24d"
TEST_SIGNATURE = "v1,gUAg4R2hWouRZqRQG4uJypNS8YK885G838+EHb4nKBY="
SIP_EVENT_TYPES = ["live.call.incoming", "live.transport.incoming", "realtime.call.incoming"]
SIP_MEDIA_SECURITY_VALUES = [None, "rtp", "srtp", "future_media_security"]
```
likely benign LLM, confidence 0.95 Test webhook signature constant in base64 form.
Reasoning
A test webhook signature value ('v1,' prefix plus base64 HMAC) used as a fixture for webhook verification tests; expected test data.
info ~~warn~~ → info by review dynamic-execution tests/test_uv_workflows.py:1243:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    # Compile once per worker, but execute with fresh globals for every case.
    return compile(security_dependency_floor_program(), str(ROOT / "scripts/check-dependency-security.py"), "exec")
```
likely benign LLM, confidence 0.85 Test helper compiles a repo-local checker script for in-process execution.
Reasoning
Compiles a Python script read from the repository's own helper function (a checker program for dependency security) with a fixed filename under ROOT for in-process testing. The source is local test code, not attacker-controlled, so this is a test harness pattern.
info ~~warn~~ → info by review dynamic-execution tests/test_uv_workflows.py:1522:19

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    # the same checker and Git stub in-process; keep real CLI coverage below.
    git_program = compile(fake_git.read_text(), str(fake_git), "exec")

    def run_git(args: list[str], **_kwargs: Any) -> subprocess.CompletedProcess[str]:
```
likely benign LLM, confidence 0.85 Test compiles a fake git stub script for in-process execution.
Reasoning
Compiles a fake git stub script read from a test fixture path to run in-process with patched subprocess calls. Test harness code with no external input or network activity.
info ~~warn~~ → info by review dynamic-execution tests/test_uv_workflows.py:1529:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
            patch.setattr(sys, "argv", args)
            exec(git_program, {"__name__": "__main__"})
        return subprocess.CompletedProcess(args, 0, output.getvalue(), "")
```
likely benign LLM, confidence 0.85 Test executes a fake git stub compiled from a fixture file.
Reasoning
Executes the precompiled fake git stub with a fresh globals dict to simulate git calls in tests. The code object comes from a repository test file, so the exec is a legitimate test mechanism.
info ~~warn~~ → info by review dynamic-execution tests/test_uv_workflows.py:1543:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        try:
            exec(compiled_security_dependency_floor_program(), {"__name__": "__main__"})
        except SystemExit as error:
            if isinstance(error.code, int):
```
likely benign LLM, confidence 0.80 Test code that execs a generated security-dependency-floor check program and inspects its SystemExit code.
Reasoning
The exec call runs a program generated by a helper named compiled_security_dependency_floor_program, which is a test-local generator, and the surrounding code catches SystemExit to check an exit code. This looks like a test harness executing generated check code in a test file, not an attack. The exec is non-literal, so it is still worth a human glance to confirm the generator is trusted and in-repo.
info ~~warn~~ → info by review dynamic-execution tests/utils.py:32:12

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
def evaluate_forwardref(forwardref: ForwardRef, globalns: dict[str, Any]) -> type:
    return eval(str(forwardref), globalns)  # type: ignore[no-any-return]
```
likely benign LLM, confidence 0.90 Test utility that resolves a ForwardRef annotation string via eval against a namespace dict.
Reasoning
This is a standard typing helper that evaluates a ForwardRef string against a globals dict, mirroring how typing.get_type_hints resolves forward references. It is in a test utilities module, the input is type annotation strings, and the type-ignore comment shows deliberate use. No untrusted input path is evident.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/openai/openai-python openai-python && cd openai-python
git checkout v3.33.0
disclude scan --severity info --diff v3.32.0 .