openai 3.36.1

Source: https://github.com/openai/openai-python
Tag scanned: v3.36.1
Compared with: v3.36.0 (0 signals introduced since)
Files: 2497 scanned, 35 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 1 warn · 109 info
Scan time: 40.6 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 61 of 61 warn and critical signals; 60 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 07:15

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

warn dynamic-execution tests/test_uv_workflows.py:1543:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        try:
            exec(compiled_security_dependency_floor_program(), {"__name__": "__main__"})
        except SystemExit as error:
            if isinstance(error.code, int):
```
likely benign LLM, confidence 0.65 A test exec()s a program produced by a helper function and inspects any SystemExit code it raises.
Reasoning
The exec call runs the output of a helper that builds a program, inside a test that catches SystemExit and checks the exit code. That reads as a test harness executing a generated script, which is a legitimate pattern in test suites. The helper's body is not shown, and running dynamically generated code is an unusual choice, so this is not certain.
info ~~warn~~ → info by review long-line api_reference/openapi.transformed.yml:1077:1

line length 2410 characters (raw pass, confidence 0.65)
```
            data: {"type":"transcript.text.done","text":"I see skies of blue and clouds of white, the bright blessed days, the dark sacred nights, and I think to myself, what a wonderful world.","logprobs":[{"token":"I","logprob":-0.00007588794,"bytes":[73]},{"token":" see","logprob":-3.1281633e-7,"bytes":[32,115,101,1
```
likely benign LLM, confidence 0.95 Long YAML example line containing a transcript event with logprob data.
Reasoning
Long line is a JSON-encoded streaming event with logprobs in an OpenAPI example; raw long-line on generated documentation content, no obfuscation.

info long-line api_reference/openapi.transformed.yml:5743:1

line length 1879 characters (raw pass, confidence 0.50)

                -d '{"name":"gpt-6-astra","data_source":{"type":"completions","input_messages":{"type":"template","template":[{"role":"developer","content":"Categorize a given news headline into one of the following topics: Technology, Markets, World, Business, or Sports.\n\n# Steps\n\n1. Analyze the content of the new

info long-line api_reference/openapi.transformed.yml:7872:1

line length 783 characters (raw pass, confidence 0.50)

            python: "from openai import OpenAI\nfrom openai.types.fine_tuning import ReinforcementMethod, ReinforcementHyperparameters\nfrom openai.types.graders import StringCheckGrader\n\nclient = OpenAI()\n\nclient.fine_tuning.jobs.create(\n  training_file=\"file-abc\",\n  validation_file=\"file-123\",\n  model=\"o4

info long-line api_reference/openapi.transformed.yml:10870:1

line length 516 characters (raw pass, confidence 0.50)

        description: Group the costs by the specified fields. Supported fields include `project_id`, `user_id`, `line_item`, `api_key_id`, and `api_source`. Support for combining `user_id` with `project_id` grouping or the `project_ids` filter depends on the organization and requested time range. Unsupported combinatio

info long-line api_reference/openapi.transformed.yml:19767:1

line length 687 characters (raw pass, confidence 0.50)

          response: "{\n  \"id\": \"sess_001\",\n  \"object\": \"realtime.session\",\n  \"model\": \"gpt-realtime-2025-08-25\",\n  \"modalities\": [\"audio\", \"text\"],\n  \"instructions\": \"You are a friendly assistant.\",\n  \"voice\": \"alloy\",\n  \"input_audio_format\": \"pcm16\",\n  \"output_audio_format\": \"p

info long-line api_reference/openapi.transformed.yml:19771:1

line length 525 characters (raw pass, confidence 0.50)

      description: "Create an ephemeral API token for use in client-side applications with the\nRealtime API specifically for realtime transcriptions. \nCan be configured with the same session parameters as the `transcription_session.update` client event.\n\nIt responds with a session object, plus a `client_secret` key

info ~~warn~~ → info by review long-line api_reference/openapi.transformed.yml:20317:1

line length 2244 characters (raw pass, confidence 0.65)

                      "text": "The file seems to contain excerpts from a letter to the shareholders of Berkshire Hathaway Inc., likely written by Warren Buffett. It covers several topics:\n\n1. **Communication Philosophy**: Buffett emphasizes the importance of transparency and candidness in reporting mistakes and succe

likely benign LLM, confidence 0.95 Long example response text in generated OpenAPI docs.

Reasoning

Long line is a prose example string in an API reference example; no encoding or hidden content.

info long-line api_reference/openapi.transformed.yml:22060:1

line length 1261 characters (raw pass, confidence 0.50)

            data: {"id":"run_123","object":"thread.run","created_at":1710351818,"assistant_id":"asst_123","thread_id":"thread_123","status":"requires_action","started_at":1710351818,"expires_at":1710352418,"cancelled_at":null,"failed_at":null,"completed_at":null,"required_action":{"type":"submit_tool_outputs","submit_t

info ~~warn~~ → info by review long-line api_reference/openapi.transformed.yml:34883:1

line length 2244 characters (raw pass, confidence 0.65)

                      "text": "The file seems to contain excerpts from a letter to the shareholders of Berkshire Hathaway Inc., likely written by Warren Buffett. It covers several topics:\n\n1. **Communication Philosophy**: Buffett emphasizes the importance of transparency and candidness in reporting mistakes and succe

likely benign LLM, confidence 0.95 Repeated long example response text in generated OpenAPI docs.

Reasoning

Duplicate of the same example prose in another location of generated API docs; benign long-line.

info long-line api_reference/openapi.transformed.yml:37462:1

line length 506 characters (raw pass, confidence 0.50)

        **Important:** when using JSON mode, you **must** also instruct the model to produce JSON yourself via a system or user message. Without this, the model may generate an unending stream of whitespace until the generation reaches the token limit, resulting in a long-running and seemingly "stuck" request. Also not

info long-line api_reference/openapi.transformed.yml:41898:1

line length 561 characters (raw pass, confidence 0.50)

            Accepts a JSON object that maps tokens (specified by their token ID in the GPT tokenizer) to an associated bias value from -100 to 100. You can use this [tokenizer tool](https://platform.openai.com/tokenizer?view=bpe) to convert text to token IDs. Mathematically, the bias is added to the logits generated by

info long-line api_reference/openapi.transformed.yml:42183:1

line length 604 characters (raw pass, confidence 0.50)

            Input text to embed, encoded as a string or array of tokens. To embed multiple inputs in a single request, pass an array of strings or array of token arrays. The input must not exceed the max input tokens for the model (8192 tokens for all embedding models), cannot be an empty string, and any array must be

info long-line api_reference/openapi.transformed.yml:43163:1

line length 779 characters (raw pass, confidence 0.50)

          description: The size of the generated images. Defaults to `auto`. For `gpt-image-2`, `gpt-image-2-2026-04-21`, `gpt-image-2.5-sunburst`, `gpt-image-2.5-sunburst-2026-09-08`, `gpt-image-2.5-flare`, and `gpt-image-2.5-flare-2026-09-08`, arbitrary resolutions are supported as `WIDTHxHEIGHT` strings, for example

info long-line api_reference/openapi.transformed.yml:43382:1

line length 759 characters (raw pass, confidence 0.50)

          description: The size of the generated images. For `gpt-image-2`, `gpt-image-2-2026-04-21`, `gpt-image-2.5-sunburst`, `gpt-image-2.5-sunburst-2026-09-08`, `gpt-image-2.5-flare`, and `gpt-image-2.5-flare-2026-09-08`, arbitrary resolutions are supported as `WIDTHxHEIGHT` strings, for example `1536x864`. Width a

info long-line api_reference/openapi.transformed.yml:44220:1

line length 566 characters (raw pass, confidence 0.50)

          description: 'The voice to use when generating the audio. Supported built-in voices are `alloy`, `ash`, `ballad`, `coral`, `echo`, `fable`, `onyx`, `nova`, `sage`, `shimmer`, `verse`, `marin`, and `cedar`. You may also provide a custom voice object with an `id`, for example `{ "id": "voice_1234" }`. Previews

info long-line api_reference/openapi.transformed.yml:45656:1

line length 759 characters (raw pass, confidence 0.50)

          description: The size of the generated images. For `gpt-image-2`, `gpt-image-2-2026-04-21`, `gpt-image-2.5-sunburst`, `gpt-image-2.5-sunburst-2026-09-08`, `gpt-image-2.5-flare`, and `gpt-image-2.5-flare-2026-09-08`, arbitrary resolutions are supported as `WIDTHxHEIGHT` strings, for example `1536x864`. Width a

info long-line api_reference/openapi.transformed.yml:49390:1

line length 759 characters (raw pass, confidence 0.50)

          description: The size of the generated images. For `gpt-image-2`, `gpt-image-2-2026-04-21`, `gpt-image-2.5-sunburst`, `gpt-image-2.5-sunburst-2026-09-08`, `gpt-image-2.5-flare`, and `gpt-image-2.5-flare-2026-09-08`, arbitrary resolutions are supported as `WIDTHxHEIGHT` strings, for example `1536x864`. Width a

info long-line api_reference/openapi.transformed.yml:54290:1

line length 600 characters (raw pass, confidence 0.50)

      description: "Send this event to truncate a previous assistant message’s audio. The server \nwill produce audio faster than realtime, so this event is useful when the user \ninterrupts to truncate audio that has already been sent to the client but not \nyet played. This will synchronize the server's understandi

info long-line api_reference/openapi.transformed.yml:54326:1

line length 631 characters (raw pass, confidence 0.50)

      description: "Send this event to append audio bytes to the input audio buffer. The audio \nbuffer is temporary storage you can write to and later commit. In Server VAD \nmode, the audio buffer is used to detect speech and the server will decide \nwhen to commit. When Server VAD is disabled, you must commit the au

info long-line api_reference/openapi.transformed.yml:54373:1

line length 583 characters (raw pass, confidence 0.50)

      description: "Send this event to commit the user input audio buffer, which will create a \nnew user message item in the conversation. This event will produce an error \nif the input audio buffer is empty. When in Server VAD mode, the client does \nnot need to send this event, the server will commit the audio buff

info long-line api_reference/openapi.transformed.yml:54444:1

line length 1303 characters (raw pass, confidence 0.50)

      description: "This event instructs the server to create a Response, which means triggering \nmodel inference. When in Server VAD mode, the server will create Responses \nautomatically.\n\nA Response will include at least one Item, and may have two, in which case \nthe second will be a function call. These Items w

info long-line api_reference/openapi.transformed.yml:54778:1

line length 750 characters (raw pass, confidence 0.50)

          description: "The default system instructions (i.e. system message) prepended to model \ncalls. This field allows the client to guide the model on desired \nresponses. The model can be instructed on response content and format, \n(e.g. \"be extremely succinct\", \"act friendly\", \"here are examples of good \

info long-line api_reference/openapi.transformed.yml:55391:1

line length 693 characters (raw pass, confidence 0.50)

      description: "Sent by the server when in `server_vad` mode to indicate that speech has been \ndetected in the audio buffer. This can happen any time audio is added to the \nbuffer (unless speech is already detected). The client may want to use this \nevent to interrupt audio playback or provide visual feedback to

info long-line api_reference/openapi.transformed.yml:56544:1

line length 538 characters (raw pass, confidence 0.50)

              "instructions": "Your knowledge cutoff is 2023-10. You are a helpful, witty, and friendly AI. Act like a human, but remember that you aren't a human and that you can't do human things in the real world. Your voice and personality should be warm and engaging, with a lively and playful tone. If interacting

info long-line api_reference/openapi.transformed.yml:56778:1

line length 511 characters (raw pass, confidence 0.50)

      description: "Add a new Item to the Conversation's context, including messages, function \ncalls, and function call responses. This event can be used both to populate a \n\"history\" of the conversation and to add new items mid-stream, but has the \ncurrent limitation that it cannot populate assistant audio messa

info long-line api_reference/openapi.transformed.yml:56874:1

line length 600 characters (raw pass, confidence 0.50)

      description: "Send this event to truncate a previous assistant message’s audio. The server \nwill produce audio faster than realtime, so this event is useful when the user \ninterrupts to truncate audio that has already been sent to the client but not \nyet played. This will synchronize the server's understandi

info long-line api_reference/openapi.transformed.yml:56911:1

line length 910 characters (raw pass, confidence 0.50)

      description: "Send this event to append audio bytes to the input audio buffer. The audio \nbuffer is temporary storage you can write to and later commit. A \"commit\" will create a new\nuser message item in the conversation history from the buffer content and clear the buffer.\nInput audio transcription (if enabl

info long-line api_reference/openapi.transformed.yml:57036:1

line length 1388 characters (raw pass, confidence 0.50)

      description: "This event instructs the server to create a Response, which means triggering \nmodel inference. When in Server VAD mode, the server will create Responses \nautomatically.\n\nA Response will include at least one Item, and may have two, in which case \nthe second will be a function call. These Items w

info long-line api_reference/openapi.transformed.yml:58110:1

line length 535 characters (raw pass, confidence 0.50)

            The default system instructions (i.e. system message) prepended to model calls. This field allows the client to guide the model on desired responses. The model can be instructed on response content and format, (e.g. "be extremely succinct", "act friendly", "here are examples of good responses") and on audio

info long-line api_reference/openapi.transformed.yml:58945:1

line length 693 characters (raw pass, confidence 0.50)

      description: "Sent by the server when in `server_vad` mode to indicate that speech has been \ndetected in the audio buffer. This can happen any time audio is added to the \nbuffer (unless speech is already detected). The client may want to use this \nevent to interrupt audio playback or provide visual feedback to

info long-line api_reference/openapi.transformed.yml:59669:1

line length 547 characters (raw pass, confidence 0.50)

      description: "Returned when a Response is done streaming. Always emitted, no matter the \nfinal state. The Response object included in the `response.done` event will \ninclude all output Items in the Response but will omit the raw audio data.\n\nClients should check the `status` field of the Response to determine

info long-line api_reference/openapi.transformed.yml:60261:1

line length 538 characters (raw pass, confidence 0.50)

              "instructions": "Your knowledge cutoff is 2023-10. You are a helpful, witty, and friendly AI. Act like a human, but remember that you aren't a human and that you can't do human things in the real world. Your voice and personality should be warm and engaging, with a lively and playful tone. If interacting

info long-line api_reference/openapi.transformed.yml:60335:1

line length 538 characters (raw pass, confidence 0.50)

              "instructions": "Your knowledge cutoff is 2023-10. You are a helpful, witty, and friendly AI. Act like a human, but remember that you aren't a human and that you can't do human things in the real world. Your voice and personality should be warm and engaging, with a lively and playful tone. If interacting

info long-line api_reference/openapi.transformed.yml:60544:1

line length 634 characters (raw pass, confidence 0.50)

              Configuration for input audio transcription, defaults to off and can be set to `null` to turn off once on. Input audio transcription is not native to the model, since the model consumes audio directly. Transcription runs asynchronously through [the /audio/transcriptions endpoint](https://developers.openai

info long-line api_reference/openapi.transformed.yml:60694:1

line length 535 characters (raw pass, confidence 0.50)

            The default system instructions (i.e. system message) prepended to model calls. This field allows the client to guide the model on desired responses. The model can be instructed on response content and format, (e.g. "be extremely succinct", "act friendly", "here are examples of good responses") and on audio

info long-line api_reference/openapi.transformed.yml:60935:1

line length 535 characters (raw pass, confidence 0.50)

            The default system instructions (i.e. system message) prepended to model calls. This field allows the client to guide the model on desired responses. The model can be instructed on response content and format, (e.g. "be extremely succinct", "act friendly", "here are examples of good responses") and on audio

info long-line api_reference/openapi.transformed.yml:61377:1

line length 535 characters (raw pass, confidence 0.50)

            The default system instructions (i.e. system message) prepended to model calls. This field allows the client to guide the model on desired responses. The model can be instructed on response content and format, (e.g. "be extremely succinct", "act friendly", "here are examples of good responses") and on audio

info long-line api_reference/openapi.transformed.yml:73610:1

line length 669 characters (raw pass, confidence 0.50)

      description: Options for prompt caching. Supported for `gpt-5.6` and later models. By default, OpenAI automatically chooses one implicit cache breakpoint. You can add explicit breakpoints to content blocks with `prompt_cache_breakpoint`. Each request can write up to four breakpoints. For cache matching, OpenAI co

info long-line api_reference/openapi.transformed.yml:78555:1

line length 751 characters (raw pass, confidence 0.50)

          description: The Cyber access program to use for this request. Supported values are `standard`, `daybreak_blue`, and `daybreak_red`. If omitted, the API resolves the program from the model's Cyber tier and your organization and project access, subject to model-specific eligibility restrictions. By default, mo

info long-line api_reference/openapi.transformed.yml:78580:1

line length 669 characters (raw pass, confidence 0.50)

      description: Options for prompt caching. Supported for `gpt-5.6` and later models. By default, OpenAI automatically chooses one implicit cache breakpoint. You can add explicit breakpoints to content blocks with `prompt_cache_breakpoint`. Each request can write up to four breakpoints. For cache matching, OpenAI co

info long-line api_reference/openapi.transformed.yml:80453:1

line length 951 characters (raw pass, confidence 0.50)

              Specifies the processing type used for serving the request.   - If set to 'auto', then the request will be processed with the service tier configured in the Project settings. Unless otherwise configured, the Project will use 'default'.   - If set to 'default', then the request will be processed with the s

info long-line api_reference/openapi.transformed.yml:82350:1

line length 673 characters (raw pass, confidence 0.50)

          description: Options for prompt caching. Supported for `gpt-5.6` and later models. By default, OpenAI automatically chooses one implicit cache breakpoint. You can add explicit breakpoints to content blocks with `prompt_cache_breakpoint`. Each request can write up to four breakpoints. For cache matching, OpenA

info long-line api_reference/openapi.transformed.yml:92375:1

line length 589 characters (raw pass, confidence 0.50)

      description: Play one complete audio fixture through the session output. Send this event over the primary WebSocket or a server sideband. Audio must be raw mono PCM16 little-endian at 24 kHz, regardless of the session audio format, and at most 30 seconds. The entire payload is validated before model speech is int

info long-line api_reference/openapi.transformed.yml:95158:1

line length 759 characters (raw pass, confidence 0.50)

          description: The size of the generated images. For `gpt-image-2`, `gpt-image-2-2026-04-21`, `gpt-image-2.5-sunburst`, `gpt-image-2.5-sunburst-2026-09-08`, `gpt-image-2.5-flare`, and `gpt-image-2.5-flare-2026-09-08`, arbitrary resolutions are supported as `WIDTHxHEIGHT` strings, for example `1536x864`. Width a

info long-line api_reference/openapi.transformed.yml:99363:1

line length 951 characters (raw pass, confidence 0.50)

              Specifies the processing type used for serving the request.   - If set to 'auto', then the request will be processed with the service tier configured in the Project settings. Unless otherwise configured, the Project will use 'default'.   - If set to 'default', then the request will be processed with the s

info long-line api_reference/openapi.transformed.yml:99388:1

line length 669 characters (raw pass, confidence 0.50)

      description: Options for prompt caching. Supported for `gpt-5.6` and later models. By default, OpenAI automatically chooses one implicit cache breakpoint. You can add explicit breakpoints to content blocks with `prompt_cache_breakpoint`. Each request can write up to four breakpoints. For cache matching, OpenAI co

info long-line api_reference/openapi.transformed.yml:106548:1

line length 669 characters (raw pass, confidence 0.50)

      description: Options for prompt caching. Supported for `gpt-5.6` and later models. By default, OpenAI automatically chooses one implicit cache breakpoint. You can add explicit breakpoints to content blocks with `prompt_cache_breakpoint`. Each request can write up to four breakpoints. For cache matching, OpenAI co

info long-line api_reference/openapi.transformed.yml:106553:1

line length 751 characters (raw pass, confidence 0.50)

          description: The Cyber access program to use for this request. Supported values are `standard`, `daybreak_blue`, and `daybreak_red`. If omitted, the API resolves the program from the model's Cyber tier and your organization and project access, subject to model-specific eligibility restrictions. By default, mo

info long-line docs/architecture/security-model.md:35:1

line length 1109 characters (raw pass, confidence 0.50)

| Streaming and authenticated WebSockets | Incrementally decode SSE and exchange authenticated current or beta Realtime/Responses WebSocket messages through distinct sync and async connection paths. | [src/openai/_streaming.py:53](../../src/openai/_streaming.py), [src/openai/resources/realtime/realtime.py:683](../../sr

info ~~warn~~ → info by review long-line docs/architecture/security-model.md:54:1

line length 2482 characters (raw pass, confidence 0.65)

| Legacy module-level client | Global/environment-selected OpenAI, Azure, or Bedrock credential and destination | Module `api_type` starts from `OPENAI_API_TYPE`. `_load_client()` fills unset Azure endpoint/version globals from environment; only when `api_type` is unset, it rejects `OPENAI_API_KEY` in the environment t

likely benign LLM, confidence 0.95 Security-model table row describing client credential sources.

Reasoning

Long markdown table row describing credential handling; ordinary documentation prose.

info ~~warn~~ → info by review long-line docs/architecture/security-model.md:65:1

line length 2772 characters (raw pass, confidence 0.65)

| Current and beta Realtime/Responses WebSockets | WebSocket destination and client auth headers | All current and beta paths use explicit `websocket_base_url` or transform the configured HTTP base to a WebSocket scheme, then merge client auth with caller extra headers. Only Realtime branches into Azure `_configure_rea

likely benign LLM, confidence 0.95 Security-model table row about WebSocket destinations.

Reasoning

Long markdown table row documenting WebSocket destinations and auth headers; ordinary documentation.

info long-line docs/architecture/security-model.md:353:1

line length 1687 characters (raw pass, confidence 0.50)

| High | Legacy module-client selection or cache regression routes an OpenAI, Azure, or Bedrock credential through the wrong provider. | Mutable module globals or environment signals must cross a broken precedence, ambiguity, forwarding, or reset boundary; the caller deliberately setting a coherent provider configurati

info ~~warn~~ → info by review long-line docs/architecture/security-model.md:354:1

line length 2534 characters (raw pass, confidence 0.65)

| High | A current or beta Realtime/Responses WebSocket regression sends client auth to the wrong peer or redirect target. | A sync direct-connect or async wrapper path must lose its destination/header binding; caller-selected explicit WebSocket configuration alone is insufficient. | API credential disclosure; Azure `a

likely benign LLM, confidence 0.95 Risk table row describing WebSocket credential disclosure regression.

Reasoning

Long markdown table row describing a risk scenario; plain documentation text.

info long-line docs/architecture/security-model.md:365:1

line length 1490 characters (raw pass, confidence 0.50)

| Medium | Monthly review input or output escapes its intended isolation or publication boundary. | A regression lets independently mutable lifecycle/PyPI data expose the action-held key, mutate protected workspace state, leak sensitive output to the step summary, escape the bounded issue body into publisher commands/m

info long-line docs/architecture/security-model.md:366:1

line length 1595 characters (raw pass, confidence 0.50)

| High | Castiron candidate data escapes the trusted reporter/publisher boundary and changes published commit statuses or PR comments. | Candidate Git objects, stale run metadata, or an untrusted artifact must bypass provenance/freshness/payload/artifact checks before a write-capable publisher acts; normal candidate in

info ~~warn~~ → info by review dynamic-import scripts/run-steady:5:1

`source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)
```
STEADY_ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
source "$STEADY_ROOT/scripts/steady/settings"
steady_verify
```
likely benign LLM, confidence 0.85 Bootstrap script sourcing its sibling settings file.
Reasoning
Sources a settings file whose path is derived from the script's own directory via dirname $0; the path is locally computed, a common and legitimate bootstrap pattern.
info ~~critical~~ → info by review dynamic-execution scripts/run-steady:9:1

`exec` called with a dynamic (variable/substitution) path (ast pass, confidence 0.85)
```
# Keep the caller's working directory so relative spec paths keep working.
exec "$DENO_DIRECTORY/$DENO_BINARY" run --cached-only --frozen \
  --config "$STEADY_SOURCE/deno.json" \
  --allow-read --allow-net --allow-env --allow-write \
```
likely benign LLM, confidence 0.80 Launcher that execs a cached Deno binary with configured paths.
Reasoning
Exec of a deno binary from DENO_DIRECTORY/DENO_BINARY set by the settings file, with --cached-only and --frozen flags; it is a launcher for a project tool. The variables come from the repo's own settings, so it is a legitimate dynamic launcher, though the dynamic path warrants reading the settings file.
info ~~warn~~ → info by review dynamic-import scripts/steady/install:5:1

`source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)
```
STEADY_ROOT="$(cd "$(dirname "$0")/../.." && pwd -P)"
source "$STEADY_ROOT/scripts/steady/settings"

mkdir -p "$STEADY_CACHE"
```
likely benign LLM, confidence 0.85 Installer script sourcing its sibling settings file.
Reasoning
Same self-relative bootstrap pattern sourcing the adjacent settings file; standard shell practice.
info ~~warn~~ → info by review dynamic-execution scripts/steady/install:35:1

command name is a variable (`$DENO_DIRECTORY`, `$DENO_BINARY`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
steady_verify
"$DENO_DIRECTORY/$DENO_BINARY" cache --frozen --config "$STEADY_SOURCE/deno.json" "$STEADY_SOURCE/cmd/steady.ts" >&2

if [[ "${1:-}" == '--print-executable' ]]; then
```
likely benign LLM, confidence 0.80 Installer invokes cached Deno binary path from settings.
Reasoning
Runs the Deno binary from settings-defined variables to cache dependencies; a typical build/install launcher. Variables are defined in the sourced settings file, so the flag reflects indirection rather than malice.
info ~~warn~~ → info by review dynamic-attribute src/openai/__init__.py:139:13

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            value = getattr(import_module(module, __name__), name)
            globals()[name] = value
            return value
        raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
```
likely benign LLM, confidence 0.85 Lazy submodule loader using __getattr__ and globals caching.
Reasoning
Module-level lazy attribute loader via __getattr__ that imports a known submodule and caches it in globals; a standard lazy-import idiom in the OpenAI SDK.
info ~~warn~~ → info by review dynamic-attribute src/openai/lib/streaming/__init__.py:19:13

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            value = getattr(import_module("._assistants", __name__), name)
            globals()[name] = value
            return value
        raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
```
likely benign LLM, confidence 0.85 Lazy submodule loader in streaming package.
Reasoning
Same lazy-import __getattr__ idiom for a relative submodule; benign package plumbing.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/__init__.py:350:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy-import __getattr__ in the openai resources package that caches resolved attributes into module globals.
Reasoning
This is the standard lazy-loading module __getattr__ pattern used in the OpenAI Python SDK's package __init__ files. It caches imported submodule attributes into globals() after a name lookup that raises AttributeError for unknown names. No decoding, network, or execution of untrusted data is present in the snippet.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/admin/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy-import __getattr__ caching resolved submodule attributes into globals in the admin subpackage.
Reasoning
Same lazy-import __getattr__ caching pattern as the package root; it only binds a resolved submodule attribute by name and raises AttributeError otherwise. Standard SDK boilerplate.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/admin/organization/__init__.py:233:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy-import __getattr__ caching into globals in the admin organization subpackage.
Reasoning
Standard lazy-loading __getattr__ with globals() caching in a generated SDK package __init__. No suspicious data flow shown.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/admin/organization/groups/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy-import __getattr__ caching into globals in the organization groups subpackage.
Reasoning
Identical lazy-import pattern of resolving a submodule attribute by name and caching it in globals; consistent with generated SDK code.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/admin/organization/projects/__init__.py:230:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy-import __getattr__ caching into globals in the organization projects subpackage.
Reasoning
Standard lazy-loading __getattr__ with globals caching; no decoding or execution of external input.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/admin/organization/projects/groups/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy-import __getattr__ caching into globals in the project groups subpackage.
Reasoning
Same generated lazy-import boilerplate; the name is only used to look up a known submodule and cache it.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/admin/organization/projects/service_accounts/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy-import __getattr__ caching into globals in the project service accounts subpackage.
Reasoning
Standard lazy-loading __getattr__ pattern with globals caching, matching all other SDK package initializers.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/admin/organization/projects/users/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy-import __getattr__ caching into globals in the project users subpackage.
Reasoning
Standard lazy-import boilerplate with no external data decoded or executed.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/admin/organization/users/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy-import __getattr__ caching into globals in the organization users subpackage.
Reasoning
Standard generated lazy-loading __getattr__ pattern; consistent with the rest of the SDK.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/audio/__init__.py:113:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy-import __getattr__ caching into globals in the audio resources package.
Reasoning
Standard lazy-import __getattr__ with globals caching for the audio resources package; no malicious indicators.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/__init__.py:113:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy-import __getattr__ caching into globals in the beta resources package.
Reasoning
Standard lazy-import boilerplate for the beta resources package; the snippet only resolves and caches named submodule attributes.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/agents/__init__.py:83:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy-import __getattr__ caching into globals in the beta agents package.
Reasoning
Same generated lazy-import pattern with globals caching; no decoding, execution, or network activity in the snippet.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/agents/environments/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy-import __getattr__ caching into globals in the beta agents environments package.
Reasoning
Standard lazy-loading __getattr__ pattern, consistent with other SDK package initializers.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/agents/sessions/__init__.py:128:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy-import __getattr__ caching into globals in the beta agents sessions package.
Reasoning
Standard lazy-import __getattr__ with globals caching; benign generated SDK boilerplate.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/agents/sessions/subagents/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy-import __getattr__ caching into globals in the subagents package.
Reasoning
Same generated lazy-loading pattern; the name only selects a known submodule to cache.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/agents/sessions/subagents/turns/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy-import __getattr__ caching into globals in the subagent turns package.
Reasoning
Standard lazy-import __getattr__ with globals caching, consistent with the rest of the SDK's generated package initializers.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/agents/sessions/turns/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Module-level __getattr__ that lazily loads and caches a submodule attribute.
Reasoning
The snippet is the standard PEP 562 module __getattr__ pattern: it raises AttributeError for unknown names, then caches a lazily imported submodule in globals(). This is a common lazy-import idiom in generated SDK __init__ files, with no network, shell, or decode behavior.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/agents/vaults/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Module-level __getattr__ that lazily loads and caches a submodule attribute.
Reasoning
Same PEP 562 lazy-loading __getattr__ idiom: it raises AttributeError for unknown names and caches resolved attributes in globals(). It is a legitimate import-deferral pattern in a generated package __init__.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/chatkit/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Module-level __getattr__ that lazily loads and caches a submodule attribute.
Reasoning
Standard lazy-attribute resolution via module __getattr__ and globals() caching. The flagged line only stores a resolved value under its own name, which is ordinary for lazy SDK imports.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/responses/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Module-level __getattr__ that lazily loads and caches a submodule attribute.
Reasoning
The snippet is the usual lazy-import __getattr__ with an AttributeError fallback and globals() caching. Nothing here executes dynamic code or hides a payload.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/threads/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Module-level __getattr__ that lazily loads and caches a submodule attribute.
Reasoning
This is the standard PEP 562 lazy-loading pattern. The globals() write only caches a value for a name that was already requested and resolved, which is a common SDK import optimization.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/beta/threads/runs/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Module-level __getattr__ that lazily loads and caches a submodule attribute.
Reasoning
Standard lazy module __getattr__ with a globals() cache write. The code only resolves names inside the package, with no decoding, eval, or external call.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/chat/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Module-level __getattr__ that lazily loads and caches a submodule attribute.
Reasoning
Lazy-import __getattr__ with AttributeError on miss and a globals() cache. This is a routine import-deferral idiom in generated SDK packages.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/chat/completions/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Module-level __getattr__ that lazily loads and caches a submodule attribute.
Reasoning
Same benign PEP 562 lazy-loading pattern; the globals() assignment only memoizes the resolved submodule attribute.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/containers/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Module-level __getattr__ that lazily loads and caches a submodule attribute.
Reasoning
Standard lazy-attribute loader that raises AttributeError for unknown names and caches resolved names in globals(). No malicious behavior is visible.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/containers/files/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Module-level __getattr__ that lazily loads and caches a submodule attribute.
Reasoning
Lazy-import idiom via module __getattr__ and globals() caching, consistent with the other generated SDK package initializers.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/conversations/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Module-level __getattr__ that lazily loads and caches a submodule attribute.
Reasoning
Standard PEP 562 lazy-loading __getattr__ with a globals() memoization write. This is ordinary import deferral, not obfuscation.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/evals/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Module-level __getattr__ that lazily loads and caches a submodule attribute.
Reasoning
The code is the usual lazy-import __getattr__ that caches resolved names in globals(). The flagged pattern is a legitimate Python idiom.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/evals/runs/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Module-level __getattr__ that lazily loads and caches a submodule attribute.
Reasoning
Standard lazy module attribute resolution with AttributeError fallback and globals() caching. It is benign SDK packaging code.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/fine_tuning/__init__.py:83:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Module-level __getattr__ that lazily loads and caches a submodule attribute.
Reasoning
Same lazy-import pattern: module __getattr__ raises AttributeError for unknown names and memoizes resolved attributes in globals(). No dynamic execution or encoded payload is present.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/fine_tuning/alpha/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Module-level __getattr__ that lazily loads and caches a submodule attribute.
Reasoning
Standard PEP 562 lazy-loading idiom with a globals() cache. The flagged line is an ordinary attribute memoization write.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/fine_tuning/checkpoints/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Module-level __getattr__ that lazily loads and caches a submodule attribute.
Reasoning
Lazy-import __getattr__ with AttributeError on miss and globals() caching, the same benign pattern used across this generated SDK.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/fine_tuning/jobs/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy module attribute loader that caches resolved attributes in module globals.
Reasoning
Standard lazy-loading module __getattr__ pattern caching resolved submodule attributes into globals; the snippet shows only a name-keyed cache write of an already-imported lazy attribute, a common Python idiom with no network or execution behavior.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/live/__init__.py:67:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy module attribute loader in the OpenAI SDK live resources package.
Reasoning
Same lazy-import __getattr__ idiom as the other generated SDK package __init__ files; caching into globals is ordinary and the file is an SDK resource package.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/realtime/__init__.py:83:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy module attribute loader in the OpenAI SDK realtime package.
Reasoning
Standard generated lazy-loading __getattr__ pattern caching attributes into globals; no suspicious behavior in the snippet.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/realtime/translations/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy module attribute loader in the realtime translations package.
Reasoning
Same benign lazy-import __getattr__ caching idiom used across the SDK's resource packages.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/responses/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy module attribute loader in the responses resource package.
Reasoning
Standard lazy-import caching pattern in a generated SDK package; the snippet contains no execution or network activity.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/safety/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy module attribute loader in the safety resource package.
Reasoning
Benign lazy-loading __getattr__ idiom writing resolved names into globals, consistent with the rest of the SDK.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/skills/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy module attribute loader in the skills resource package.
Reasoning
Same generated lazy-import pattern; caching a looked-up attribute into globals is routine.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/skills/versions/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy module attribute loader in the skills versions package.
Reasoning
Standard lazy-loading __getattr__ caching idiom with no suspicious operations visible.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/uploads/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy module attribute loader in the uploads resource package.
Reasoning
Benign lazy-import caching in a generated SDK __init__; the snippet only shows name-based attribute caching.
info ~~warn~~ → info by review dynamic-attribute src/openai/resources/vector_stores/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy module attribute loader in the vector stores resource package.
Reasoning
Same generated lazy-loading __getattr__ pattern; benign module attribute resolution.
info ~~warn~~ → info by review encoding-base64 tests/lib/test_webhooks.py:24:22

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
# Standardized test constants (matches TypeScript implementation)
TEST_SECRET = "whsec_RdvaYFYUXuIFuEbvZHwMfYFhUf7aMYjYcmM24+Aj40c="
TEST_PAYLOAD = '{"id": "evt_685c059ae3a481909bdc86819b066fb6", "object": "event", "created_at": 1750861210, "type": "response.completed", "data": {"id": "resp_123"}}'
```
likely benign LLM, confidence 0.93 Test fixture webhook secret string in a webhook verification test.
Reasoning
The string is a clearly labeled test webhook secret ('whsec_' prefix, Standard Webhooks format) with a matching test payload; test fixtures like this are expected and it is not a hidden payload.
info ~~warn~~ → info by review encoding-base64 tests/lib/test_webhooks.py:28:22

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
TEST_WEBHOOK_ID = "wh_685c059ae39c8190af8c71ed1022a24d"
TEST_SIGNATURE = "v1,gUAg4R2hWouRZqRQG4uJypNS8YK885G838+EHb4nKBY="
SIP_EVENT_TYPES = ["live.call.incoming", "live.transport.incoming", "realtime.call.incoming"]
SIP_MEDIA_SECURITY_VALUES = [None, "rtp", "srtp", "future_media_security"]
```
likely benign LLM, confidence 0.93 Test fixture webhook signature and ID constants.
Reasoning
A base64 test signature for webhook verification tests, labeled as matching the TypeScript implementation; ordinary test constant with no malicious use.
info ~~warn~~ → info by review dynamic-execution tests/test_uv_workflows.py:1243:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    # Compile once per worker, but execute with fresh globals for every case.
    return compile(security_dependency_floor_program(), str(ROOT / "scripts/check-dependency-security.py"), "exec")
```
likely benign LLM, confidence 0.85 Test helper compiles a generated security-checker program for repeated execution.
Reasoning
Compiling a script file's source (scripts/check-dependency-security.py) once for in-process test execution is a test-harness pattern; the program is generated locally from the repo's own helper, so the dynamic compile is not evidently malicious.
info ~~warn~~ → info by review dynamic-execution tests/test_uv_workflows.py:1522:19

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    # the same checker and Git stub in-process; keep real CLI coverage below.
    git_program = compile(fake_git.read_text(), str(fake_git), "exec")

    def run_git(args: list[str], **_kwargs: Any) -> subprocess.CompletedProcess[str]:
```
likely benign LLM, confidence 0.88 Test compiles a fake git stub script for in-process execution.
Reasoning
Compiles a fake git stub script read from a test fixture to run in-process; a test-double technique, consistent with the nearby comment explaining in-process coverage.
info ~~warn~~ → info by review dynamic-execution tests/test_uv_workflows.py:1529:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
            patch.setattr(sys, "argv", args)
            exec(git_program, {"__name__": "__main__"})
        return subprocess.CompletedProcess(args, 0, output.getvalue(), "")
```
likely benign LLM, confidence 0.88 Test executes a fake git stub program in-process with patched argv.
Reasoning
exec runs the locally compiled fake git stub with a fresh globals dict to simulate git calls in tests; the code source is a repo test fixture, not attacker-supplied input.
info ~~warn~~ → info by review dynamic-execution tests/utils.py:32:12

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
def evaluate_forwardref(forwardref: ForwardRef, globalns: dict[str, Any]) -> type:
    return eval(str(forwardref), globalns)  # type: ignore[no-any-return]
```
likely benign LLM, confidence 0.90 A test helper evaluates a ForwardRef's string against module globals to resolve type annotations.
Reasoning
The function evaluates a typing.ForwardRef's string form against a supplied globals dict. This is the standard way to resolve forward references in type-introspection test utilities. The input is a type annotation string, not attacker-controlled data, and the file is a test utility.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/openai/openai-python openai-python && cd openai-python
git checkout v3.36.1
disclude scan --severity info --diff v3.36.0 .