paramiko 5.1.0

Source: https://github.com/paramiko/paramiko
Tag scanned: 5.1.0
Compared with: 5.0.1 (0 signals introduced since)
Files: 98 scanned, 83 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 34 info
Scan time: 15.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 24 of 24 warn and critical signals; 24 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-18 04:57

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review decoder-decompress-payload paramiko/compress.py:37:18

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
    def __init__(self):
        self.z = zlib.decompressobj()

    def __call__(self, data):
```
likely benign LLM, confidence 0.80 zlib decompressobj used for SSH transport compression in paramiko.
Reasoning
This is the standard zlib streaming decompressor used by paramiko's SSH compression support (zlib@openssh.com). Runtime decompression of network data is expected in an SSH library; there is no embedded payload being executed.

info long-line paramiko/kex_group14.py:42:1

line length 530 characters (raw pass, confidence 0.50)

    P = 0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F3

info long-line paramiko/kex_group16.py:32:1

line length 1042 characters (raw pass, confidence 0.50)

    P = 0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F3

info ~~warn~~ → info by review encoding-hex tests/test_client.py:50:18

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
    # type/identity.
    "ssh-rsa": b"\x60\x73\x38\x44\xcb\x51\x86\x65\x7f\xde\xda\xa2\x2b\x5a\x57\xd5",  # noqa
    "ecdsa-sha2-nistp256": b"\x25\x19\xeb\x55\xe6\xa1\x47\xff\x4f\x38\xd2\x75\x6f\xa5\xd5\x60",  # noqa
    "ssh-ed25519": b'\xb3\xd5"\xaa\xf9u^\xe8\xcd\x0e\xea\x02\xb9)\xa2\x80',
```
likely benign LLM, confidence 0.90 Binary host key bytes written as hex escapes in a paramiko test.
Reasoning
Hex escapes here are raw SSH host key fingerprint bytes in a test fixture, with a noqa marker. Byte literals for cryptographic test vectors are normal.
info ~~warn~~ → info by review encoding-hex tests/test_client.py:51:30

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
    "ssh-rsa": b"\x60\x73\x38\x44\xcb\x51\x86\x65\x7f\xde\xda\xa2\x2b\x5a\x57\xd5",  # noqa
    "ecdsa-sha2-nistp256": b"\x25\x19\xeb\x55\xe6\xa1\x47\xff\x4f\x38\xd2\x75\x6f\xa5\xd5\x60",  # noqa
    "ssh-ed25519": b'\xb3\xd5"\xaa\xf9u^\xe8\xcd\x0e\xea\x02\xb9)\xa2\x80',
}
```
likely benign LLM, confidence 0.90 Test fixture byte literal of host key data.
Reasoning
Same test fixture of binary host key data as the adjacent finding; legitimate test vector encoding.
info ~~warn~~ → info by review encoding-base64 tests/test_hostkeys.py:35:1

4 rows of base64-like lines, lines 35-40 (first: base64-like blob (77 bytes, compression ratio 1.14)) (raw pass, confidence 0.60)
```
secure.example.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA1PD6U2/TVxET6lkpKhOk5r\
9q/kAYG6sP9f5zuUYP8i7FOFp/6ncCEbbtg/lB+A3iidyxoSWl+9jtoyyDOOVX4UIDV9G11Ml8om3\
D+jrpI9cycZHqilK0HmxDeCuxbwyMuaCygU9gS2qoRvNLWZk70OpIKSSpBo0Wl3/XUmz9uhc=
broken.example.com ssh-rsa AAAA
```
likely benign LLM, confidence 0.90 Sample known_hosts entries with base64-encoded public keys in a test.
Reasoning
Known_hosts-format sample lines with base64 public key blobs are required test input for the HostKeys parser. Wrapped base64 keys are expected format.
info ~~warn~~ → info by review encoding-base64 tests/test_hostkeys.py:44:1

base64-like blob (78 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
```
curvy.example.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlz\
dHAyNTYAAABBBAa+pY7djSpbg5viAcZhPt56AO3U3Sd7h7dnlUp0EjfDgyYHYQxl2QZ4JGgfwR5iv9\
T9iRZjQzvJd5s+kBAZtpk=
"""
```
likely benign LLM, confidence 0.90 ECDSA known_hosts sample line in test data.
Reasoning
Sample ecdsa known_hosts entry with a base64 public key in a parser test; no execution or hidden payload.
info ~~warn~~ → info by review encoding-base64 tests/test_hostkeys.py:50:1

4 rows of base64-like lines, lines 50-54 (first: base64-like blob (77 bytes, compression ratio 1.14)) (raw pass, confidence 0.60)
```
secure.example.com\tssh-rsa\tAAAAB3NzaC1yc2EAAAABIwAAAIEA1PD6U2/TVxET6lkpKhOk5r\
9q/kAYG6sP9f5zuUYP8i7FOFp/6ncCEbbtg/lB+A3iidyxoSWl+9jtoyyDOOVX4UIDV9G11Ml8om3\
D+jrpI9cycZHqilK0HmxDeCuxbwyMuaCygU9gS2qoRvNLWZk70OpIKSSpBo0Wl3/XUmz9uhc=
happy.example.com\tssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA8bP1ZA7DCZDB9J0s50l31M\
```
likely benign LLM, confidence 0.90 Tab-separated known_hosts sample with base64 keys.
Reasoning
Tab-separated known_hosts test fixture containing public key material; expected test data.
info ~~warn~~ → info by review encoding-base64 tests/test_hostkeys.py:58:1

base64-like blob (78 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
```
curvy.example.com\tecdsa-sha2-nistp256\tAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbml\
zdHAyNTYAAABBBAa+pY7djSpbg5viAcZhPt56AO3U3Sd7h7dnlUp0EjfDgyYHYQxl2QZ4JGgfwR5iv\
9T9iRZjQzvJd5s+kBAZtpk=
"""
```
likely benign LLM, confidence 0.90 Tab-separated ECDSA known_hosts sample in a test.
Reasoning
Another known_hosts test fixture variant with base64 public keys; benign test data.
info ~~warn~~ → info by review encoding-base64 tests/test_hostkeys.py:63:1

base64-like blob (77 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
```
keyblob = b"""\
AAAAB3NzaC1yc2EAAAABIwAAAIEA8bP1ZA7DCZDB9J0s50l31MBGQ3GQ/Fc7SX6gkpXkwcZryoi4k\
NFhHu5LvHcZPdxXV1D+uTMfGS1eyd2Yz/DoNWXNAl8TI0cAsW5ymME3bQ4J/k1IKxCtz/bAlAqFgK\
oc+EolMziDYqWIATtW0rYTJvzGAzTmMj80/QpsFH+Pc2M="""
```
likely benign LLM, confidence 0.90 Triple-quoted base64 RSA key constant in a test.
Reasoning
Multi-line base64 RSA key blob used as a test constant for hostkey parsing; expected content.
info ~~warn~~ → info by review encoding-base64 tests/test_hostkeys.py:64:1

base64-like blob (77 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
```
AAAAB3NzaC1yc2EAAAABIwAAAIEA8bP1ZA7DCZDB9J0s50l31MBGQ3GQ/Fc7SX6gkpXkwcZryoi4k\
NFhHu5LvHcZPdxXV1D+uTMfGS1eyd2Yz/DoNWXNAl8TI0cAsW5ymME3bQ4J/k1IKxCtz/bAlAqFgK\
oc+EolMziDYqWIATtW0rYTJvzGAzTmMj80/QpsFH+Pc2M="""
```
likely benign LLM, confidence 0.90 Continuation of base64 RSA key test fixture.
Reasoning
Continuation of the same base64 key test constant; benign.
info ~~warn~~ → info by review encoding-base64 tests/test_hostkeys.py:65:1

base64-like blob (46 bytes, compression ratio 1.24) (raw pass, confidence 0.60)
```
NFhHu5LvHcZPdxXV1D+uTMfGS1eyd2Yz/DoNWXNAl8TI0cAsW5ymME3bQ4J/k1IKxCtz/bAlAqFgK\
oc+EolMziDYqWIATtW0rYTJvzGAzTmMj80/QpsFH+Pc2M="""
```
likely benign LLM, confidence 0.90 Tail of base64 key test fixture.
Reasoning
Final lines of the base64 key test constant; benign test data.

info long-line tests/test_kex.py:361:1

line length 637 characters (raw pass, confidence 0.50)

        K = 21526936926159575624241589599003964979640840086252478029709904308461709651400109485351462666820496096345766733042945918306284902585618061272525323382142547359684512114160415969631877620660064043178086464811345023251493620331559440565662862858765724251890489795332144543057725932216208403143759943169004775947

info long-line tests/test_kex.py:380:1

line length 637 characters (raw pass, confidence 0.50)

        K = 21526936926159575624241589599003964979640840086252478029709904308461709651400109485351462666820496096345766733042945918306284902585618061272525323382142547359684512114160415969631877620660064043178086464811345023251493620331559440565662862858765724251890489795332144543057725932216208403143759943169004775947

info long-line tests/test_kex.py:405:1

line length 1253 characters (raw pass, confidence 0.50)

        K = 93324283009537616210792550005769253483888318661556757489115410383690763069835864944310176490866735857673456555321300314294199636830699631291584483997219796160328354495065846754579991443573915235134491737635996358461421387423257773386904967023011263872499354099685459916631800105906578067400801157501545977205

info long-line tests/test_kex.py:424:1

line length 1253 characters (raw pass, confidence 0.50)

        K = 93324283009537616210792550005769253483888318661556757489115410383690763069835864944310176490866735857673456555321300314294199636830699631291584483997219796160328354495065846754579991443573915235134491737635996358461421387423257773386904967023011263872499354099685459916631800105906578067400801157501545977205

info ~~warn~~ → info by review encoding-escape-soup tests/test_message.py:35:13

25 consecutive `\xNN` escapes (entropy 3.6 bits/byte) (raw pass, confidence 0.80)
```
    )
    __b = b"\x01\x00\xf3\x00\x3f\x00\x00\x00\x10\x68\x75\x65\x79\x2c\x64\x65\x77\x65\x79\x2c\x6c\x6f\x75\x69\x65"  # noqa
    __c = b"\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\xf5\xe4\xd3\xc2\xb1\x09\x00\x00\x00\x01\x11\x00\x00\x00\x07\x00\xf5\xe4\xd3\xc2\xb1\x09\x00\x00\x00\x06\x9a\x1b\x2c\x3d\x4e\xf7"  # noqa
```
likely benign LLM, confidence 0.85 Binary SSH protocol packet fixture in test_message.py.
Reasoning
Binary SSH message packet bytes built as escape literals in a message parser test, with a noqa marker. Typical for protocol unit tests.
info ~~warn~~ → info by review payload-bytes-literal tests/test_message.py:36:11

bytes literal contains 42 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
    __b = b"\x01\x00\xf3\x00\x3f\x00\x00\x00\x10\x68\x75\x65\x79\x2c\x64\x65\x77\x65\x79\x2c\x6c\x6f\x75\x69\x65"  # noqa
    __c = b"\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\xf5\xe4\xd3\xc2\xb1\x09\x00\x00\x00\x01\x11\x00\x00\x00\x07\x00\xf5\xe4\xd3\xc2\xb1\x09\x00\x00\x00\x06\x9a\x1b\x2c\x3d\x4e\xf7"  # noqa
```
likely benign LLM, confidence 0.85 Binary protocol bytes literal used as Message test input.
Reasoning
Binary packet fixture in a protocol test; the payload-shaped bytes are expected test vectors for paramiko Message parsing, not executed code.
info ~~warn~~ → info by review payload-bytes-literal tests/test_message.py:37:11

bytes literal contains 44 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
    __d = b"\x00\x00\x00\x05\xff\x00\x00\x00\x05\x11\x22\x33\x44\x55\xff\x00\x00\x00\x0a\x00\xf0\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x03\x63\x61\x74\x00\x00\x00\x03\x61\x2c\x62"  # noqa

    def test_encode(self):
```
likely benign LLM, confidence 0.93 A binary packet test vector written as a bytes literal in a unit test.
Reasoning
The bytes literal is a hand-written binary packet fixture for a message encoding test, with a noqa marker. Test data like this is expected in a protocol library's test suite, and nothing in the snippet suggests execution or exfiltration.
info ~~warn~~ → info by review encoding-hex tests/test_packetizer.py:67:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
        self.assertEqual(
            b"\x43\x91\x97\xbd\x5b\x50\xac\x25\x87\xc2\xc4\x6b\xc7\xe9\x38\xc0",  # noqa
            data[:16],
        )
```
dismissed LLM, confidence 0.92 A 16-byte expected value in a packetizer assertion.
Reasoning
This is a 16-byte expected-output constant used in an assertEqual against data[:16]. It is a raw test vector, and the raw pass is known to over-flag escape sequences like this.
info ~~warn~~ → info by review payload-bytes-literal tests/test_packetizer.py:85:13

bytes literal contains 44 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
        wsock.send(
            b"\x43\x91\x97\xbd\x5b\x50\xac\x25\x87\xc2\xc4\x6b\xc7\xe9\x38\xc0\x90\xd2\x16\x56\x0d\x71\x73\x61\x38\x7c\x4c\x3d\xfb\x97\x7d\xe2\x6e\x03\xb1\xa0\xc2\x1c\xd6\x41\x41\x4c\xb4\x59"  # noqa
        )
        cmd, m = p.read_message()
```
likely benign LLM, confidence 0.93 A binary packet sent to a mock socket in a packetizer test.
Reasoning
The bytes literal is a binary payload sent over a mock socket in a packetizer test. It is test input, not a dropper, and the context is ordinary protocol testing.
info ~~warn~~ → info by review encoding-escape-soup tests/test_packetizer.py:85:15

44 consecutive `\xNN` escapes (entropy 5.2 bits/byte) (raw pass, confidence 0.80)
```
        wsock.send(
            b"\x43\x91\x97\xbd\x5b\x50\xac\x25\x87\xc2\xc4\x6b\xc7\xe9\x38\xc0\x90\xd2\x16\x56\x0d\x71\x73\x61\x38\x7c\x4c\x3d\xfb\x97\x7d\xe2\x6e\x03\xb1\xa0\xc2\x1c\xd6\x41\x41\x4c\xb4\x59"  # noqa
        )
        cmd, m = p.read_message()
```
dismissed LLM, confidence 0.85 The same 44-byte test vector flagged as an escape sequence.
Reasoning
The same 44-byte literal is flagged by the raw pass as escape soup. It is a plain binary test vector and the escapes are the normal way to write bytes in Python.
info ~~warn~~ → info by review encoding-base64 tests/test_pkey.py:50:20

6 rows of base64-like lines, lines 50-57 (first: base64-like blob (200 bytes, compression ratio 0.93)) (raw pass, confidence 0.60)
```
# from openssh's ssh-keygen
PUB_RSA = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA049W6geFpmsljTwfvI1UmKWWJPNFI74+vNKTk4dmzkQY2yAMs6FhlvhlI8ysU4oj71ZsRYMecHbBbxdN79+JRFVYTKaLqjwGENeTd+yv4q+V2PvZv3fLnzApI3l7EJCqhWwJUHJ1jAkZzqDx0tyOL4uoZpww3nmE0kb3y21tH4c="  # noqa
```
likely benign LLM, confidence 0.85 A public RSA key string used as a fixture in key parsing tests.
Reasoning
The base64 blob is an RSA public key from openssh's ssh-keygen, pasted into a key-parsing test with a noqa marker. Public key fixtures are expected here and are not sensitive or obfuscated.
info ~~warn~~ → info by review encoding-base64 tests/test_pkey.py:71:1

base64-like blob (808 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
-----BEGIN RSA PRIVATE KEY-----
MIICWgIBAAKBgQDTj1bqB4WmayWNPB+8jVSYpZYk80Ujvj680pOTh2bORBjbIAyz
oWGW+GUjzKxTiiPvVmxFgx5wdsFvF03v34lEVVhMpouqPAYQ15N37K/ir5XY+9m/
d8ufMCkjeXsQkKqFbAlQcnWMCRnOoPHS3I4vi6hmnDDeeYTSRvfLbW0fhwIBIwKB
```
likely benign LLM, confidence 0.85 A PEM-encoded RSA private key fixture in a key-loading test.
Reasoning
This is an RSA private key in PEM form inside a key-loading test. It is a test fixture, which the context supports, but a committed private key always warrants a glance, so confidence is not maximal.
info ~~warn~~ → info by review encoding-base64 tests/test_pkey.py:89:1

base64-like blob (164 bytes over 3 lines, compression ratio 0.93) (raw pass, confidence 0.60)
```
-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIKB6ty3yVyKEnfF/zprx0qwC76MsMlHY4HXCnqho2eKioAoGCCqGSM49
AwEHoUQDQgAElI9mbdlaS+T9nHxY/59lFnn80EEecZDBHq4gLpccY8Mge5ZTMiMD
ADRvOqQ5R98Sxst765CAqXmRtz8vwoD96g==
```
likely benign LLM, confidence 0.85 A PEM-encoded EC private key fixture in a test file.
Reasoning
This is an EC private key in PEM form in a test file. Standard key fixtures like this are expected in a library that parses keys, so the base64 is ordinary encoding rather than obfuscation.
info ~~warn~~ → info by review encoding-base64 tests/test_pkey.py:97:1

base64-like blob (224 bytes over 4 lines, compression ratio 0.89) (raw pass, confidence 0.60)
```
-----BEGIN EC PRIVATE KEY-----
MIGkAgEBBDBDdO8IXvlLJgM7+sNtPl7tI7FM5kzuEUEEPRjXIPQM7mISciwJPBt+
y43EuG8nL4mgBwYFK4EEACKhZANiAAQWxom0C1vQAGYhjdoREMVmGKBWlisDdzyk
mgyUjKpiJ9WfbIEVLsPGP8OdNjhr1y/8BZNIts+dJd6VmYw+4HzB+4F+U1Igs8K0
```
likely benign LLM, confidence 0.85 A PEM-encoded EC private key fixture in the key tests.
Reasoning
This is another EC private key PEM fixture in the key tests. Its base64 is the standard PEM body, and the surrounding file is a key-parsing test suite.
info ~~warn~~ → info by review encoding-base64 tests/test_pkey.py:106:1

base64-like blob (300 bytes over 5 lines, compression ratio 0.85) (raw pass, confidence 0.60)
```
-----BEGIN EC PRIVATE KEY-----
MIHcAgEBBEIAprQtAS3OF6iVUkT8IowTHWicHzShGgk86EtuEXvfQnhZFKsWm6Jo
iqAr1yEaiuI9LfB3Xs8cjuhgEEfbduYr/f6gBwYFK4EEACOhgYkDgYYABACaOaFL
ZGuxa5AW16qj6VLypFbLrEWrt9AZUloCMefxO8bNLjK/O5g0rAVasar1TnyHE9qj
```
likely benign LLM, confidence 0.85 A PEM-encoded EC private key fixture in the key tests.
Reasoning
This is a PEM-encoded EC private key in the same key test module. The base64 body is a standard key encoding, consistent with a parsing test.

info unicode-mixed-script tests/test_pkey.py:116:77

identifier `ӏV` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)


TEST_KEY_BYTESTR = "\x00\x00\x00\x07ssh-rsa\x00\x00\x00\x01#\x00\x00\x00\x00ӏV\x07k%<\x1fT$E#>ғfD\x18 \x0cae#̬S#VlE\x1epvo\x17M߉DUXL<\x06\x10דw\u2bd5ٿw˟0)#y{\x10l\tPru\t\x19Π\u070e/f0yFmm\x1f"  # noqa

info unicode-mixed-script tests/test_pkey.py:116:96

identifier `ғfD` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)


TEST_KEY_BYTESTR = "\x00\x00\x00\x07ssh-rsa\x00\x00\x00\x01#\x00\x00\x00\x00ӏV\x07k%<\x1fT$E#>ғfD\x18 \x0cae#̬S#VlE\x1epvo\x17M߉DUXL<\x06\x10דw\u2bd5ٿw˟0)#y{\x10l\tPru\t\x19Π\u070e/f0yFmm\x1f"  # noqa

info unicode-mixed-script tests/test_pkey.py:116:146

identifier `דw` mixes scripts: Hebrew + Latin (in string/comment) (raw pass, confidence 0.40)


TEST_KEY_BYTESTR = "\x00\x00\x00\x07ssh-rsa\x00\x00\x00\x01#\x00\x00\x00\x00ӏV\x07k%<\x1fT$E#>ғfD\x18 \x0cae#̬S#VlE\x1epvo\x17M߉DUXL<\x06\x10דw\u2bd5ٿw˟0)#y{\x10l\tPru\t\x19Π\u070e/f0yFmm\x1f"  # noqa

info unicode-mixed-script tests/test_pkey.py:116:152

identifier `bd5ٿw` mixes scripts: Latin + Arabic (in string/comment) (raw pass, confidence 0.40)


TEST_KEY_BYTESTR = "\x00\x00\x00\x07ssh-rsa\x00\x00\x00\x01#\x00\x00\x00\x00ӏV\x07k%<\x1fT$E#>ғfD\x18 \x0cae#̬S#VlE\x1epvo\x17M߉DUXL<\x06\x10דw\u2bd5ٿw˟0)#y{\x10l\tPru\t\x19Π\u070e/f0yFmm\x1f"  # noqa

info ~~warn~~ → info by review encoding-escape-soup tests/test_pkey.py:133:17

30 consecutive `\xNN` escapes (entropy 4.7 bits/byte) (raw pass, confidence 0.80)
```
        key = util.generate_key_bytes(md5, x1234, "happy birthday", 30)
        exp = b"\x61\xe1\xf2\x72\xf4\xc1\xc4\x56\x15\x86\xbd\x32\x24\x98\xc0\xe9\x24\x67\x27\x80\xf4\x7b\xb3\x7d\xda\x7d\x54\x01\x9e\x64"  # noqa
        self.assertEqual(exp, key)
```
dismissed LLM, confidence 0.92 A 30-byte expected key derivation output in an assertion.
Reasoning
The escape sequence is a 30-byte expected value for generate_key_bytes in a test assertion. The byte literal is a test constant, and the raw pass flags it on escape density alone.
info ~~warn~~ → info by review encoding-hex tests/test_transport.py:169:23

20 consecutive `\xNN` escapes (entropy 4.3 bits/byte) (raw pass, confidence 0.65)
```
        self.tc.H = b"\x0c\x83\x07\xcd\xe6\x85\x6f\xf3\x0b\xa9\x36\x84\xeb\x0f\x04\xc2\x52\x0e\x9e\xd3"  # noqa
        self.tc.session_id = self.tc.H
        key = self.tc._compute_key("C", 32)
```
dismissed LLM, confidence 0.92 A 20-byte session hash test vector for key computation.
Reasoning
The 20-byte literal sets a session hash H for a test of _compute_key, which is a deterministic test vector. The raw pass is flagging escape density in a fixture.
info ~~warn~~ → info by review encoding-base64 tests/test_util.py:36:1

4 rows of base64-like lines, lines 36-40 (first: base64-like blob (77 bytes, compression ratio 1.14)) (raw pass, confidence 0.60)
```
secure.example.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA1PD6U2/TVxET6lkpKhOk5r\
9q/kAYG6sP9f5zuUYP8i7FOFp/6ncCEbbtg/lB+A3iidyxoSWl+9jtoyyDOOVX4UIDV9G11Ml8om3\
D+jrpI9cycZHqilK0HmxDeCuxbwyMuaCygU9gS2qoRvNLWZk70OpIKSSpBo0Wl3/XUmz9uhc=
happy.example.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA8bP1ZA7DCZDB9J0s50l31M\
```
likely benign LLM, confidence 0.90 Test fixture containing public SSH host key lines for known_hosts parsing.
Reasoning
The base64 lines are an SSH known_hosts-style fixture with a public RSA key split across lines by backslash continuations. It is test data for host key parsing, and it is public key material.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/paramiko/paramiko paramiko && cd paramiko
git checkout 5.1.0
disclude scan --severity info --diff 5.0.1 .