paramiko 5.0.1

Source: https://github.com/paramiko/paramiko
Tag scanned: 5.0.1
Compared with: 5.0.0+rtd1 (0 signals introduced since)
Files: 97 scanned, 83 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 34 info
Scan time: 16.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 24 of 24 warn and critical signals; 24 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-18 04:57

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review decoder-decompress-payload paramiko/compress.py:37:18

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
    def __init__(self):
        self.z = zlib.decompressobj()

    def __call__(self, data):
```
likely benign LLM, confidence 0.90 A zlib decompression object used as an SSH transport compressor in paramiko.
Reasoning
This is a zlib decompressobj wrapper in a compression module, the standard way SSH compression (zlib) is implemented. The snippet shows no embedded payload, only a stream decompressor receiving data from the protocol. The decoder-decompress-payload signal fires on normal library behaviour.

info long-line paramiko/kex_group14.py:42:1

line length 530 characters (raw pass, confidence 0.50)

    P = 0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F3

info long-line paramiko/kex_group16.py:32:1

line length 1042 characters (raw pass, confidence 0.50)

    P = 0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F3

info ~~warn~~ → info by review encoding-hex tests/test_client.py:50:18

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
    # type/identity.
    "ssh-rsa": b"\x60\x73\x38\x44\xcb\x51\x86\x65\x7f\xde\xda\xa2\x2b\x5a\x57\xd5",  # noqa
    "ecdsa-sha2-nistp256": b"\x25\x19\xeb\x55\xe6\xa1\x47\xff\x4f\x38\xd2\x75\x6f\xa5\xd5\x60",  # noqa
    "ssh-ed25519": b'\xb3\xd5"\xaa\xf9u^\xe8\xcd\x0e\xea\x02\xb9)\xa2\x80',
```
likely benign LLM, confidence 0.90 Test fixture holding hard-coded SSH host key byte strings written as hex escapes.
Reasoning
The escaped bytes are fixed public-key blobs (ssh-rsa, ecdsa, ed25519 fingerprints) in a test file, marked noqa. Hex escapes in test fixtures for binary key data are an expected pattern, not obfuscation.
info ~~warn~~ → info by review encoding-hex tests/test_client.py:51:30

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
    "ssh-rsa": b"\x60\x73\x38\x44\xcb\x51\x86\x65\x7f\xde\xda\xa2\x2b\x5a\x57\xd5",  # noqa
    "ecdsa-sha2-nistp256": b"\x25\x19\xeb\x55\xe6\xa1\x47\xff\x4f\x38\xd2\x75\x6f\xa5\xd5\x60",  # noqa
    "ssh-ed25519": b'\xb3\xd5"\xaa\xf9u^\xe8\xcd\x0e\xea\x02\xb9)\xa2\x80',
}
```
likely benign LLM, confidence 0.90 Continuation of the test fixture mapping key types to binary SSH key blobs.
Reasoning
Same test fixture: a dictionary of SSH key-type byte strings in a test module, written as hex escapes for binary data. Nothing executes or hides intent.
info ~~warn~~ → info by review encoding-base64 tests/test_hostkeys.py:35:1

4 rows of base64-like lines, lines 35-40 (first: base64-like blob (77 bytes, compression ratio 1.14)) (raw pass, confidence 0.60)
```
secure.example.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA1PD6U2/TVxET6lkpKhOk5r\
9q/kAYG6sP9f5zuUYP8i7FOFp/6ncCEbbtg/lB+A3iidyxoSWl+9jtoyyDOOVX4UIDV9G11Ml8om3\
D+jrpI9cycZHqilK0HmxDeCuxbwyMuaCygU9gS2qoRvNLWZk70OpIKSSpBo0Wl3/XUmz9uhc=
broken.example.com ssh-rsa AAAA
```
likely benign LLM, confidence 0.90 Test data of known_hosts entries containing base64 SSH public keys.
Reasoning
These are known_hosts-format lines with base64-encoded SSH public keys in a test for host key parsing. The blobs are data the parser must read, and the line-continuation layout is ordinary. The base64 signal is a false positive on expected test data.
info ~~warn~~ → info by review encoding-base64 tests/test_hostkeys.py:44:1

base64-like blob (78 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
```
curvy.example.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlz\
dHAyNTYAAABBBAa+pY7djSpbg5viAcZhPt56AO3U3Sd7h7dnlUp0EjfDgyYHYQxl2QZ4JGgfwR5iv9\
T9iRZjQzvJd5s+kBAZtpk=
"""
```
likely benign LLM, confidence 0.90 Test fixture with a base64-encoded ECDSA host key line.
Reasoning
A known_hosts-style fixture with an ecdsa public key encoded in base64, used to test host key parsing. Expected content for this test file.
info ~~warn~~ → info by review encoding-base64 tests/test_hostkeys.py:50:1

4 rows of base64-like lines, lines 50-54 (first: base64-like blob (77 bytes, compression ratio 1.14)) (raw pass, confidence 0.60)
```
secure.example.com\tssh-rsa\tAAAAB3NzaC1yc2EAAAABIwAAAIEA1PD6U2/TVxET6lkpKhOk5r\
9q/kAYG6sP9f5zuUYP8i7FOFp/6ncCEbbtg/lB+A3iidyxoSWl+9jtoyyDOOVX4UIDV9G11Ml8om3\
D+jrpI9cycZHqilK0HmxDeCuxbwyMuaCygU9gS2qoRvNLWZk70OpIKSSpBo0Wl3/XUmz9uhc=
happy.example.com\tssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA8bP1ZA7DCZDB9J0s50l31M\
```
likely benign LLM, confidence 0.88 Test fixture with tab-separated known_hosts entries and base64 keys.
Reasoning
Tab-separated known_hosts test data with base64 SSH key blobs. The format tests parsing of multiple hosts and keys, so the blobs are expected.
info ~~warn~~ → info by review encoding-base64 tests/test_hostkeys.py:58:1

base64-like blob (78 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
```
curvy.example.com\tecdsa-sha2-nistp256\tAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbml\
zdHAyNTYAAABBBAa+pY7djSpbg5viAcZhPt56AO3U3Sd7h7dnlUp0EjfDgyYHYQxl2QZ4JGgfwR5iv\
9T9iRZjQzvJd5s+kBAZtpk=
"""
```
likely benign LLM, confidence 0.88 Test fixture with a tab-separated ECDSA host key entry.
Reasoning
Another tab-separated known_hosts fixture containing an ECDSA key in base64, consistent with testing host key file parsing.
info ~~warn~~ → info by review encoding-base64 tests/test_hostkeys.py:63:1

base64-like blob (77 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
```
keyblob = b"""\
AAAAB3NzaC1yc2EAAAABIwAAAIEA8bP1ZA7DCZDB9J0s50l31MBGQ3GQ/Fc7SX6gkpXkwcZryoi4k\
NFhHu5LvHcZPdxXV1D+uTMfGS1eyd2Yz/DoNWXNAl8TI0cAsW5ymME3bQ4J/k1IKxCtz/bAlAqFgK\
oc+EolMziDYqWIATtW0rYTJvzGAzTmMj80/QpsFH+Pc2M="""
```
likely benign LLM, confidence 0.88 Test data containing a multi-line base64 RSA public key.
Reasoning
A triple-quoted base64 RSA public key used as test input for host key handling. It is a data literal, not a payload.
info ~~warn~~ → info by review encoding-base64 tests/test_hostkeys.py:64:1

base64-like blob (77 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
```
AAAAB3NzaC1yc2EAAAABIwAAAIEA8bP1ZA7DCZDB9J0s50l31MBGQ3GQ/Fc7SX6gkpXkwcZryoi4k\
NFhHu5LvHcZPdxXV1D+uTMfGS1eyd2Yz/DoNWXNAl8TI0cAsW5ymME3bQ4J/k1IKxCtz/bAlAqFgK\
oc+EolMziDYqWIATtW0rYTJvzGAzTmMj80/QpsFH+Pc2M="""
```
likely benign LLM, confidence 0.88 Continuation lines of the base64 RSA key test fixture.
Reasoning
Continuation of the same base64 RSA key fixture in the test file. Expected content.
info ~~warn~~ → info by review encoding-base64 tests/test_hostkeys.py:65:1

base64-like blob (46 bytes, compression ratio 1.24) (raw pass, confidence 0.60)
```
NFhHu5LvHcZPdxXV1D+uTMfGS1eyd2Yz/DoNWXNAl8TI0cAsW5ymME3bQ4J/k1IKxCtz/bAlAqFgK\
oc+EolMziDYqWIATtW0rYTJvzGAzTmMj80/QpsFH+Pc2M="""
```
likely benign LLM, confidence 0.88 Final lines of the base64 RSA key test fixture.
Reasoning
The final lines of the base64 key fixture. Only test data, consistent with the rest of the file.

info long-line tests/test_kex.py:358:1

line length 637 characters (raw pass, confidence 0.50)

        K = 21526936926159575624241589599003964979640840086252478029709904308461709651400109485351462666820496096345766733042945918306284902585618061272525323382142547359684512114160415969631877620660064043178086464811345023251493620331559440565662862858765724251890489795332144543057725932216208403143759943169004775947

info long-line tests/test_kex.py:378:1

line length 637 characters (raw pass, confidence 0.50)

        K = 21526936926159575624241589599003964979640840086252478029709904308461709651400109485351462666820496096345766733042945918306284902585618061272525323382142547359684512114160415969631877620660064043178086464811345023251493620331559440565662862858765724251890489795332144543057725932216208403143759943169004775947

info long-line tests/test_kex.py:404:1

line length 1253 characters (raw pass, confidence 0.50)

        K = 93324283009537616210792550005769253483888318661556757489115410383690763069835864944310176490866735857673456555321300314294199636830699631291584483997219796160328354495065846754579991443573915235134491737635996358461421387423257773386904967023011263872499354099685459916631800105906578067400801157501545977205

info long-line tests/test_kex.py:424:1

line length 1253 characters (raw pass, confidence 0.50)

        K = 93324283009537616210792550005769253483888318661556757489115410383690763069835864944310176490866735857673456555321300314294199636830699631291584483997219796160328354495065846754579991443573915235134491737635996358461421387423257773386904967023011263872499354099685459916631800105906578067400801157501545977205

info ~~warn~~ → info by review encoding-escape-soup tests/test_message.py:35:13

25 consecutive `\xNN` escapes (entropy 3.6 bits/byte) (raw pass, confidence 0.80)
```
    )
    __b = b"\x01\x00\xf3\x00\x3f\x00\x00\x00\x10\x68\x75\x65\x79\x2c\x64\x65\x77\x65\x79\x2c\x6c\x6f\x75\x69\x65"  # noqa
    __c = b"\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\xf5\xe4\xd3\xc2\xb1\x09\x00\x00\x00\x01\x11\x00\x00\x00\x07\x00\xf5\xe4\xd3\xc2\xb1\x09\x00\x00\x00\x06\x9a\x1b\x2c\x3d\x4e\xf7"  # noqa
```
likely benign LLM, confidence 0.85 Test fixture with binary SSH protocol message bytes written as hex escapes.
Reasoning
These are binary SSH protocol message fixtures in a test file, with the marker strings 'huey', 'dewey', 'louie' and typical SSH message bytes. Escape-heavy byte literals are the normal way to write wire-format test vectors, and the noqa marker indicates deliberate use.
info ~~warn~~ → info by review payload-bytes-literal tests/test_message.py:36:11

bytes literal contains 42 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
    __b = b"\x01\x00\xf3\x00\x3f\x00\x00\x00\x10\x68\x75\x65\x79\x2c\x64\x65\x77\x65\x79\x2c\x6c\x6f\x75\x69\x65"  # noqa
    __c = b"\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\xf5\xe4\xd3\xc2\xb1\x09\x00\x00\x00\x01\x11\x00\x00\x00\x07\x00\xf5\xe4\xd3\xc2\xb1\x09\x00\x00\x00\x06\x9a\x1b\x2c\x3d\x4e\xf7"  # noqa
```
likely benign LLM, confidence 0.85 Test fixture bytes representing a serialized SSH protocol message.
Reasoning
A binary wire-format message literal in a protocol test. Its shape matches the packet bytes the Message class is tested against. No execution or hidden logic is present, and the payload-bytes signal is expected for this kind of fixture.
info ~~warn~~ → info by review payload-bytes-literal tests/test_message.py:37:11

bytes literal contains 44 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
    __d = b"\x00\x00\x00\x05\xff\x00\x00\x00\x05\x11\x22\x33\x44\x55\xff\x00\x00\x00\x0a\x00\xf0\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x03\x63\x61\x74\x00\x00\x00\x03\x61\x2c\x62"  # noqa

    def test_encode(self):
```
likely benign LLM, confidence 0.95 Binary packet fixture bytes used in a message encoding test.
Reasoning
A bytes literal of binary packet fixture data in a unit test, with a noqa marker. It is a test vector for message encoding, not a payload being executed or hidden.
info ~~warn~~ → info by review encoding-hex tests/test_packetizer.py:67:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
        self.assertEqual(
            b"\x43\x91\x97\xbd\x5b\x50\xac\x25\x87\xc2\xc4\x6b\xc7\xe9\x38\xc0",  # noqa
            data[:16],
        )
```
likely benign LLM, confidence 0.95 Expected cipher output bytes in a packetizer assertion.
Reasoning
Hex escapes form a known-answer test vector compared against data[:16] in a packetizer test. This is ordinary test data in a cryptography library test suite.
info ~~warn~~ → info by review payload-bytes-literal tests/test_packetizer.py:85:13

bytes literal contains 44 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
        wsock.send(
            b"\x43\x91\x97\xbd\x5b\x50\xac\x25\x87\xc2\xc4\x6b\xc7\xe9\x38\xc0\x90\xd2\x16\x56\x0d\x71\x73\x61\x38\x7c\x4c\x3d\xfb\x97\x7d\xe2\x6e\x03\xb1\xa0\xc2\x1c\xd6\x41\x41\x4c\xb4\x59"  # noqa
        )
        cmd, m = p.read_message()
```
likely benign LLM, confidence 0.95 Fixed binary packet sent to a mock socket in a packetizer test.
Reasoning
A binary packet sent over a mock socket in a test, with noqa. The payload is a fixed test vector for protocol parsing, not an obfuscated dropper.
info ~~warn~~ → info by review encoding-escape-soup tests/test_packetizer.py:85:15

44 consecutive `\xNN` escapes (entropy 5.2 bits/byte) (raw pass, confidence 0.80)
```
        wsock.send(
            b"\x43\x91\x97\xbd\x5b\x50\xac\x25\x87\xc2\xc4\x6b\xc7\xe9\x38\xc0\x90\xd2\x16\x56\x0d\x71\x73\x61\x38\x7c\x4c\x3d\xfb\x97\x7d\xe2\x6e\x03\xb1\xa0\xc2\x1c\xd6\x41\x41\x4c\xb4\x59"  # noqa
        )
        cmd, m = p.read_message()
```
likely benign LLM, confidence 0.95 Duplicate raw-pass flag on the same binary test vector.
Reasoning
Same snippet as the AST finding on this line: a fixed test vector of hex escapes. The raw pass flags the escape density, which is expected for binary test data.
info ~~warn~~ → info by review encoding-base64 tests/test_pkey.py:50:20

6 rows of base64-like lines, lines 50-57 (first: base64-like blob (200 bytes, compression ratio 0.93)) (raw pass, confidence 0.60)
```
# from openssh's ssh-keygen
PUB_RSA = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA049W6geFpmsljTwfvI1UmKWWJPNFI74+vNKTk4dmzkQY2yAMs6FhlvhlI8ysU4oj71ZsRYMecHbBbxdN79+JRFVYTKaLqjwGENeTd+yv4q+V2PvZv3fLnzApI3l7EJCqhWwJUHJ1jAkZzqDx0tyOL4uoZpww3nmE0kb3y21tH4c="  # noqa
```
likely benign LLM, confidence 0.97 Public RSA key string in a test fixture.
Reasoning
This is a public SSH RSA key from openssh's ssh-keygen, cited in a comment. Public keys in test fixtures are normal and not secrets.
info ~~warn~~ → info by review encoding-base64 tests/test_pkey.py:71:1

base64-like blob (808 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
-----BEGIN RSA PRIVATE KEY-----
MIICWgIBAAKBgQDTj1bqB4WmayWNPB+8jVSYpZYk80Ujvj680pOTh2bORBjbIAyz
oWGW+GUjzKxTiiPvVmxFgx5wdsFvF03v34lEVVhMpouqPAYQ15N37K/ir5XY+9m/
d8ufMCkjeXsQkKqFbAlQcnWMCRnOoPHS3I4vi6hmnDDeeYTSRvfLbW0fhwIBIwKB
```
likely benign LLM, confidence 0.97 Test RSA private key in PEM format.
Reasoning
A PEM-encoded RSA private key in a test module. Test keys are routinely committed for key-parsing tests, and the base64 is the standard PEM body.
info ~~warn~~ → info by review encoding-base64 tests/test_pkey.py:89:1

base64-like blob (164 bytes over 3 lines, compression ratio 0.93) (raw pass, confidence 0.60)
```
-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIKB6ty3yVyKEnfF/zprx0qwC76MsMlHY4HXCnqho2eKioAoGCCqGSM49
AwEHoUQDQgAElI9mbdlaS+T9nHxY/59lFnn80EEecZDBHq4gLpccY8Mge5ZTMiMD
ADRvOqQ5R98Sxst765CAqXmRtz8vwoD96g==
```
likely benign LLM, confidence 0.97 Test EC private key in PEM format.
Reasoning
A PEM-encoded EC private key used as a parsing fixture in a test file. This is the standard base64 body of a PEM key, not obfuscation.
info ~~warn~~ → info by review encoding-base64 tests/test_pkey.py:97:1

base64-like blob (224 bytes over 4 lines, compression ratio 0.89) (raw pass, confidence 0.60)
```
-----BEGIN EC PRIVATE KEY-----
MIGkAgEBBDBDdO8IXvlLJgM7+sNtPl7tI7FM5kzuEUEEPRjXIPQM7mISciwJPBt+
y43EuG8nL4mgBwYFK4EEACKhZANiAAQWxom0C1vQAGYhjdoREMVmGKBWlisDdzyk
mgyUjKpiJ9WfbIEVLsPGP8OdNjhr1y/8BZNIts+dJd6VmYw+4HzB+4F+U1Igs8K0
```
likely benign LLM, confidence 0.97 Test EC private key fixture in PEM format.
Reasoning
Another PEM EC private key fixture in the key tests. The encoding is the normal PEM format.
info ~~warn~~ → info by review encoding-base64 tests/test_pkey.py:106:1

base64-like blob (300 bytes over 5 lines, compression ratio 0.85) (raw pass, confidence 0.60)
```
-----BEGIN EC PRIVATE KEY-----
MIHcAgEBBEIAprQtAS3OF6iVUkT8IowTHWicHzShGgk86EtuEXvfQnhZFKsWm6Jo
iqAr1yEaiuI9LfB3Xs8cjuhgEEfbduYr/f6gBwYFK4EEACOhgYkDgYYABACaOaFL
ZGuxa5AW16qj6VLypFbLrEWrt9AZUloCMefxO8bNLjK/O5g0rAVasar1TnyHE9qj
```
likely benign LLM, confidence 0.97 Test EC private key fixture in PEM format.
Reasoning
Another PEM EC private key fixture in the key tests. Its base64 is the standard PEM body.

info unicode-mixed-script tests/test_pkey.py:116:77

identifier `ӏV` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)


TEST_KEY_BYTESTR = "\x00\x00\x00\x07ssh-rsa\x00\x00\x00\x01#\x00\x00\x00\x00ӏV\x07k%<\x1fT$E#>ғfD\x18 \x0cae#̬S#VlE\x1epvo\x17M߉DUXL<\x06\x10דw\u2bd5ٿw˟0)#y{\x10l\tPru\t\x19Π\u070e/f0yFmm\x1f"  # noqa

info unicode-mixed-script tests/test_pkey.py:116:96

identifier `ғfD` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)


TEST_KEY_BYTESTR = "\x00\x00\x00\x07ssh-rsa\x00\x00\x00\x01#\x00\x00\x00\x00ӏV\x07k%<\x1fT$E#>ғfD\x18 \x0cae#̬S#VlE\x1epvo\x17M߉DUXL<\x06\x10דw\u2bd5ٿw˟0)#y{\x10l\tPru\t\x19Π\u070e/f0yFmm\x1f"  # noqa

info unicode-mixed-script tests/test_pkey.py:116:146

identifier `דw` mixes scripts: Hebrew + Latin (in string/comment) (raw pass, confidence 0.40)


TEST_KEY_BYTESTR = "\x00\x00\x00\x07ssh-rsa\x00\x00\x00\x01#\x00\x00\x00\x00ӏV\x07k%<\x1fT$E#>ғfD\x18 \x0cae#̬S#VlE\x1epvo\x17M߉DUXL<\x06\x10דw\u2bd5ٿw˟0)#y{\x10l\tPru\t\x19Π\u070e/f0yFmm\x1f"  # noqa

info unicode-mixed-script tests/test_pkey.py:116:152

identifier `bd5ٿw` mixes scripts: Latin + Arabic (in string/comment) (raw pass, confidence 0.40)


TEST_KEY_BYTESTR = "\x00\x00\x00\x07ssh-rsa\x00\x00\x00\x01#\x00\x00\x00\x00ӏV\x07k%<\x1fT$E#>ғfD\x18 \x0cae#̬S#VlE\x1epvo\x17M߉DUXL<\x06\x10דw\u2bd5ٿw˟0)#y{\x10l\tPru\t\x19Π\u070e/f0yFmm\x1f"  # noqa

info ~~warn~~ → info by review encoding-escape-soup tests/test_pkey.py:133:17

30 consecutive `\xNN` escapes (entropy 4.7 bits/byte) (raw pass, confidence 0.80)
```
        key = util.generate_key_bytes(md5, x1234, "happy birthday", 30)
        exp = b"\x61\xe1\xf2\x72\xf4\xc1\xc4\x56\x15\x86\xbd\x32\x24\x98\xc0\xe9\x24\x67\x27\x80\xf4\x7b\xb3\x7d\xda\x7d\x54\x01\x9e\x64"  # noqa
        self.assertEqual(exp, key)
```
likely benign LLM, confidence 0.93 Expected key-derivation output bytes in an assertion.
Reasoning
Expected output bytes for a key derivation assertion (generate_key_bytes with a known passphrase). It is a test vector, and the noqa and assertEqual context confirm this.
info ~~warn~~ → info by review encoding-hex tests/test_transport.py:169:23

20 consecutive `\xNN` escapes (entropy 4.3 bits/byte) (raw pass, confidence 0.65)
```
        self.tc.H = b"\x0c\x83\x07\xcd\xe6\x85\x6f\xf3\x0b\xa9\x36\x84\xeb\x0f\x04\xc2\x52\x0e\x9e\xd3"  # noqa
        self.tc.session_id = self.tc.H
        key = self.tc._compute_key("C", 32)
```
likely benign LLM, confidence 0.93 Fixed session hash bytes used to test key computation.
Reasoning
A fixed session hash H used to test _compute_key in a transport test. It is deterministic test input, with noqa and the context of a unit test.
info ~~warn~~ → info by review encoding-base64 tests/test_util.py:36:1

4 rows of base64-like lines, lines 36-40 (first: base64-like blob (77 bytes, compression ratio 1.14)) (raw pass, confidence 0.60)
```
secure.example.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA1PD6U2/TVxET6lkpKhOk5r\
9q/kAYG6sP9f5zuUYP8i7FOFp/6ncCEbbtg/lB+A3iidyxoSWl+9jtoyyDOOVX4UIDV9G11Ml8om3\
D+jrpI9cycZHqilK0HmxDeCuxbwyMuaCygU9gS2qoRvNLWZk70OpIKSSpBo0Wl3/XUmz9uhc=
happy.example.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA8bP1ZA7DCZDB9J0s50l31M\
```
likely benign LLM, confidence 0.95 Sample known_hosts entries with public keys in a util test.
Reasoning
Multi-line known_hosts-style sample containing public SSH keys, used as test input for host key parsing. Public key material in a test fixture is expected.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/paramiko/paramiko paramiko && cd paramiko
git checkout 5.0.1
disclude scan --severity info --diff 5.0.0+rtd1 .