paramiko 5.1.0

Source: https://github.com/paramiko/paramiko
Tag scanned: 5.1.0
Compared with: 5.0.1 (0 signals introduced since)
Files: 98 scanned, 83 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 34 info
Scan time: 17.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 24 of 24 warn and critical signals; 24 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 07:09

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review decoder-decompress-payload paramiko/compress.py:37:18

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
    def __init__(self):
        self.z = zlib.decompressobj()

    def __call__(self, data):
```
dismissed LLM, confidence 0.92 zlib decompressor object used for SSH transport compression in paramiko.
Reasoning
This is paramiko's SSH compression module. zlib decompressobj is the standard zlib transport compression for SSH sessions, and the decompression acts on network data the protocol negotiates, not on an embedded payload. Nothing in the snippet suggests obfuscation.

info long-line paramiko/kex_group14.py:42:1

line length 530 characters (raw pass, confidence 0.50)

    P = 0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F3

info long-line paramiko/kex_group16.py:32:1

line length 1042 characters (raw pass, confidence 0.50)

    P = 0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F3

info ~~warn~~ → info by review encoding-hex tests/test_client.py:50:18

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
    # type/identity.
    "ssh-rsa": b"\x60\x73\x38\x44\xcb\x51\x86\x65\x7f\xde\xda\xa2\x2b\x5a\x57\xd5",  # noqa
    "ecdsa-sha2-nistp256": b"\x25\x19\xeb\x55\xe6\xa1\x47\xff\x4f\x38\xd2\x75\x6f\xa5\xd5\x60",  # noqa
    "ssh-ed25519": b'\xb3\xd5"\xaa\xf9u^\xe8\xcd\x0e\xea\x02\xb9)\xa2\x80',
```
dismissed LLM, confidence 0.93 Test fixture containing binary SSH public key bytes for host key tests.
Reasoning
These are raw SSH host key blobs written as byte-escape literals in a test fixture file, with a noqa marker. The hex escapes encode key data, which is an ordinary way to write binary test vectors.
info ~~warn~~ → info by review encoding-hex tests/test_client.py:51:30

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
    "ssh-rsa": b"\x60\x73\x38\x44\xcb\x51\x86\x65\x7f\xde\xda\xa2\x2b\x5a\x57\xd5",  # noqa
    "ecdsa-sha2-nistp256": b"\x25\x19\xeb\x55\xe6\xa1\x47\xff\x4f\x38\xd2\x75\x6f\xa5\xd5\x60",  # noqa
    "ssh-ed25519": b'\xb3\xd5"\xaa\xf9u^\xe8\xcd\x0e\xea\x02\xb9)\xa2\x80',
}
```
dismissed LLM, confidence 0.93 Test fixture dict mapping SSH key types to binary key bytes.
Reasoning
Same test file and pattern as the preceding finding: a dict of binary host key fixtures for ecdsa and ed25519 keys, written as byte literals. This is legitimate test data.
info ~~warn~~ → info by review encoding-base64 tests/test_hostkeys.py:35:1

4 rows of base64-like lines, lines 35-40 (first: base64-like blob (77 bytes, compression ratio 1.14)) (raw pass, confidence 0.60)
```
secure.example.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA1PD6U2/TVxET6lkpKhOk5r\
9q/kAYG6sP9f5zuUYP8i7FOFp/6ncCEbbtg/lB+A3iidyxoSWl+9jtoyyDOOVX4UIDV9G11Ml8om3\
D+jrpI9cycZHqilK0HmxDeCuxbwyMuaCygU9gS2qoRvNLWZk70OpIKSSpBo0Wl3/XUmz9uhc=
broken.example.com ssh-rsa AAAA
```
dismissed LLM, confidence 0.90 Multi-line known_hosts fixture with base64 RSA host keys.
Reasoning
These are real-looking known_hosts entries with base64-encoded RSA public keys, split across lines with backslash continuation. This is the expected format for a host key file parsing test, and the 'broken' line is a deliberate malformed case for the parser.
info ~~warn~~ → info by review encoding-base64 tests/test_hostkeys.py:44:1

base64-like blob (78 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
```
curvy.example.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlz\
dHAyNTYAAABBBAa+pY7djSpbg5viAcZhPt56AO3U3Sd7h7dnlUp0EjfDgyYHYQxl2QZ4JGgfwR5iv9\
T9iRZjQzvJd5s+kBAZtpk=
"""
```
dismissed LLM, confidence 0.92 Test fixture with a base64-encoded ECDSA host key line.
Reasoning
A known_hosts-style test fixture holding a base64-encoded ECDSA public key in a triple-quoted string. Base64 key material is the expected content of this test file.
info ~~warn~~ → info by review encoding-base64 tests/test_hostkeys.py:50:1

4 rows of base64-like lines, lines 50-54 (first: base64-like blob (77 bytes, compression ratio 1.14)) (raw pass, confidence 0.60)
```
secure.example.com\tssh-rsa\tAAAAB3NzaC1yc2EAAAABIwAAAIEA1PD6U2/TVxET6lkpKhOk5r\
9q/kAYG6sP9f5zuUYP8i7FOFp/6ncCEbbtg/lB+A3iidyxoSWl+9jtoyyDOOVX4UIDV9G11Ml8om3\
D+jrpI9cycZHqilK0HmxDeCuxbwyMuaCygU9gS2qoRvNLWZk70OpIKSSpBo0Wl3/XUmz9uhc=
happy.example.com\tssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA8bP1ZA7DCZDB9J0s50l31M\
```
dismissed LLM, confidence 0.90 Tab-separated known_hosts test fixture with base64 RSA keys.
Reasoning
Tab-separated known_hosts fixture containing base64 RSA keys for parser testing. The continuation lines and entries are ordinary test data.
info ~~warn~~ → info by review encoding-base64 tests/test_hostkeys.py:58:1

base64-like blob (78 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
```
curvy.example.com\tecdsa-sha2-nistp256\tAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbml\
zdHAyNTYAAABBBAa+pY7djSpbg5viAcZhPt56AO3U3Sd7h7dnlUp0EjfDgyYHYQxl2QZ4JGgfwR5iv\
9T9iRZjQzvJd5s+kBAZtpk=
"""
```
dismissed LLM, confidence 0.92 Tab-separated known_hosts fixture with a base64 ECDSA key.
Reasoning
A tab-separated known_hosts test entry with a base64 ECDSA key split across lines, consistent with the other hostkeys fixtures in the same file.
info ~~warn~~ → info by review encoding-base64 tests/test_hostkeys.py:63:1

base64-like blob (77 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
```
keyblob = b"""\
AAAAB3NzaC1yc2EAAAABIwAAAIEA8bP1ZA7DCZDB9J0s50l31MBGQ3GQ/Fc7SX6gkpXkwcZryoi4k\
NFhHu5LvHcZPdxXV1D+uTMfGS1eyd2Yz/DoNWXNAl8TI0cAsW5ymME3bQ4J/k1IKxCtz/bAlAqFgK\
oc+EolMziDYqWIATtW0rYTJvzGAzTmMj80/QpsFH+Pc2M="""
```
dismissed LLM, confidence 0.92 Base64-encoded RSA key body in a hostkeys test fixture.
Reasoning
A triple-quoted base64 blob continued across lines, which is the encoded RSA key body used by the host key tests. The pattern matches the other fixtures in the file.
info ~~warn~~ → info by review encoding-base64 tests/test_hostkeys.py:64:1

base64-like blob (77 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
```
AAAAB3NzaC1yc2EAAAABIwAAAIEA8bP1ZA7DCZDB9J0s50l31MBGQ3GQ/Fc7SX6gkpXkwcZryoi4k\
NFhHu5LvHcZPdxXV1D+uTMfGS1eyd2Yz/DoNWXNAl8TI0cAsW5ymME3bQ4J/k1IKxCtz/bAlAqFgK\
oc+EolMziDYqWIATtW0rYTJvzGAzTmMj80/QpsFH+Pc2M="""
```
dismissed LLM, confidence 0.92 Continuation of a base64-encoded RSA key fixture.
Reasoning
Continuation of the same base64 RSA key fixture in the hostkeys test file. The content is key data for parsing tests, not a payload.
info ~~warn~~ → info by review encoding-base64 tests/test_hostkeys.py:65:1

base64-like blob (46 bytes, compression ratio 1.24) (raw pass, confidence 0.60)
```
NFhHu5LvHcZPdxXV1D+uTMfGS1eyd2Yz/DoNWXNAl8TI0cAsW5ymME3bQ4J/k1IKxCtz/bAlAqFgK\
oc+EolMziDYqWIATtW0rYTJvzGAzTmMj80/QpsFH+Pc2M="""
```
dismissed LLM, confidence 0.90 Final line of a base64 RSA key test fixture.
Reasoning
Final line of the same base64 key fixture, ending with the closing triple quote. Nothing here indicates an encoded dropper or hidden instruction.

info long-line tests/test_kex.py:361:1

line length 637 characters (raw pass, confidence 0.50)

        K = 21526936926159575624241589599003964979640840086252478029709904308461709651400109485351462666820496096345766733042945918306284902585618061272525323382142547359684512114160415969631877620660064043178086464811345023251493620331559440565662862858765724251890489795332144543057725932216208403143759943169004775947

info long-line tests/test_kex.py:380:1

line length 637 characters (raw pass, confidence 0.50)

        K = 21526936926159575624241589599003964979640840086252478029709904308461709651400109485351462666820496096345766733042945918306284902585618061272525323382142547359684512114160415969631877620660064043178086464811345023251493620331559440565662862858765724251890489795332144543057725932216208403143759943169004775947

info long-line tests/test_kex.py:405:1

line length 1253 characters (raw pass, confidence 0.50)

        K = 93324283009537616210792550005769253483888318661556757489115410383690763069835864944310176490866735857673456555321300314294199636830699631291584483997219796160328354495065846754579991443573915235134491737635996358461421387423257773386904967023011263872499354099685459916631800105906578067400801157501545977205

info long-line tests/test_kex.py:424:1

line length 1253 characters (raw pass, confidence 0.50)

        K = 93324283009537616210792550005769253483888318661556757489115410383690763069835864944310176490866735857673456555321300314294199636830699631291584483997219796160328354495065846754579991443573915235134491737635996358461421387423257773386904967023011263872499354099685459916631800105906578067400801157501545977205

info ~~warn~~ → info by review encoding-escape-soup tests/test_message.py:35:13

25 consecutive `\xNN` escapes (entropy 3.6 bits/byte) (raw pass, confidence 0.80)
```
    )
    __b = b"\x01\x00\xf3\x00\x3f\x00\x00\x00\x10\x68\x75\x65\x79\x2c\x64\x65\x77\x65\x79\x2c\x6c\x6f\x75\x69\x65"  # noqa
    __c = b"\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\xf5\xe4\xd3\xc2\xb1\x09\x00\x00\x00\x01\x11\x00\x00\x00\x07\x00\xf5\xe4\xd3\xc2\xb1\x09\x00\x00\x00\x06\x9a\x1b\x2c\x3d\x4e\xf7"  # noqa
```
dismissed LLM, confidence 0.90 Test fixture of serialized SSH protocol message bytes.
Reasoning
The byte literals are serialized SSH message packets built for the Message class tests, with a noqa marker. They contain protocol fields such as lengths and strings, so the escape run is expected test data.
info ~~warn~~ → info by review payload-bytes-literal tests/test_message.py:36:11

bytes literal contains 42 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
    __b = b"\x01\x00\xf3\x00\x3f\x00\x00\x00\x10\x68\x75\x65\x79\x2c\x64\x65\x77\x65\x79\x2c\x6c\x6f\x75\x69\x65"  # noqa
    __c = b"\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\xf5\xe4\xd3\xc2\xb1\x09\x00\x00\x00\x01\x11\x00\x00\x00\x07\x00\xf5\xe4\xd3\xc2\xb1\x09\x00\x00\x00\x06\x9a\x1b\x2c\x3d\x4e\xf7"  # noqa
```
dismissed LLM, confidence 0.88 Binary SSH message packet fixture in a message parsing test.
Reasoning
This is the same kind of binary SSH message fixture as the other test_message finding. The bytes are protocol-shaped (length prefixes, ASCII strings, flags), which is what a message parsing test would use. The payload-bytes signal flags the form, not any malicious use.
info ~~warn~~ → info by review payload-bytes-literal tests/test_message.py:37:11

bytes literal contains 44 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
    __d = b"\x00\x00\x00\x05\xff\x00\x00\x00\x05\x11\x22\x33\x44\x55\xff\x00\x00\x00\x0a\x00\xf0\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x03\x63\x61\x74\x00\x00\x00\x03\x61\x2c\x62"  # noqa

    def test_encode(self):
```
likely benign LLM, confidence 0.95 Binary test vector for message encoding in a paramiko test.
Reasoning
A bytes literal of fixed binary packet data inside a unit test, with a noqa marker. It is a test fixture for message encoding, not a payload.
info ~~warn~~ → info by review encoding-hex tests/test_packetizer.py:67:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
        self.assertEqual(
            b"\x43\x91\x97\xbd\x5b\x50\xac\x25\x87\xc2\xc4\x6b\xc7\xe9\x38\xc0",  # noqa
            data[:16],
        )
```
likely benign LLM, confidence 0.90 Expected byte string in a packetizer test assertion.
Reasoning
A 16-byte hex-escaped expected value compared against packetizer output in a test. Raw-pass escape flags on test vectors are a known false-positive pattern.
info ~~warn~~ → info by review payload-bytes-literal tests/test_packetizer.py:85:13

bytes literal contains 44 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
        wsock.send(
            b"\x43\x91\x97\xbd\x5b\x50\xac\x25\x87\xc2\xc4\x6b\xc7\xe9\x38\xc0\x90\xd2\x16\x56\x0d\x71\x73\x61\x38\x7c\x4c\x3d\xfb\x97\x7d\xe2\x6e\x03\xb1\xa0\xc2\x1c\xd6\x41\x41\x4c\xb4\x59"  # noqa
        )
        cmd, m = p.read_message()
```
likely benign LLM, confidence 0.95 Test payload bytes sent to a fake socket in a packetizer test.
Reasoning
Binary payload literal sent over a mock socket to exercise packet parsing. This is ordinary protocol test data.
info ~~warn~~ → info by review encoding-escape-soup tests/test_packetizer.py:85:15

44 consecutive `\xNN` escapes (entropy 5.2 bits/byte) (raw pass, confidence 0.80)
```
        wsock.send(
            b"\x43\x91\x97\xbd\x5b\x50\xac\x25\x87\xc2\xc4\x6b\xc7\xe9\x38\xc0\x90\xd2\x16\x56\x0d\x71\x73\x61\x38\x7c\x4c\x3d\xfb\x97\x7d\xe2\x6e\x03\xb1\xa0\xc2\x1c\xd6\x41\x41\x4c\xb4\x59"  # noqa
        )
        cmd, m = p.read_message()
```
likely benign LLM, confidence 0.90 Duplicate escape-density flag on the same packetizer test payload.
Reasoning
The same byte literal as the AST finding, flagged by the raw pass for escape density. It is test data with a noqa marker.
info ~~warn~~ → info by review encoding-base64 tests/test_pkey.py:50:20

6 rows of base64-like lines, lines 50-57 (first: base64-like blob (200 bytes, compression ratio 0.93)) (raw pass, confidence 0.60)
```
# from openssh's ssh-keygen
PUB_RSA = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA049W6geFpmsljTwfvI1UmKWWJPNFI74+vNKTk4dmzkQY2yAMs6FhlvhlI8ysU4oj71ZsRYMecHbBbxdN79+JRFVYTKaLqjwGENeTd+yv4q+V2PvZv3fLnzApI3l7EJCqhWwJUHJ1jAkZzqDx0tyOL4uoZpww3nmE0kb3y21tH4c="  # noqa
```
likely benign LLM, confidence 0.95 Public RSA key string constant in a key-parsing test.
Reasoning
A public RSA key in OpenSSH format, copied from ssh-keygen and used as a test constant. Public keys are not secrets and base64 is the normal format.
info ~~warn~~ → info by review encoding-base64 tests/test_pkey.py:71:1

base64-like blob (808 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
-----BEGIN RSA PRIVATE KEY-----
MIICWgIBAAKBgQDTj1bqB4WmayWNPB+8jVSYpZYk80Ujvj680pOTh2bORBjbIAyz
oWGW+GUjzKxTiiPvVmxFgx5wdsFvF03v34lEVVhMpouqPAYQ15N37K/ir5XY+9m/
d8ufMCkjeXsQkKqFbAlQcnWMCRnOoPHS3I4vi6hmnDDeeYTSRvfLbW0fhwIBIwKB
```
likely benign LLM, confidence 0.95 Test RSA private key in PEM format.
Reasoning
A PEM-encoded RSA private key used as a test fixture in a key-loading test. It is an example key, not a live credential, and this is typical of paramiko's test suite.
info ~~warn~~ → info by review encoding-base64 tests/test_pkey.py:89:1

base64-like blob (164 bytes over 3 lines, compression ratio 0.93) (raw pass, confidence 0.60)
```
-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIKB6ty3yVyKEnfF/zprx0qwC76MsMlHY4HXCnqho2eKioAoGCCqGSM49
AwEHoUQDQgAElI9mbdlaS+T9nHxY/59lFnn80EEecZDBHq4gLpccY8Mge5ZTMiMD
ADRvOqQ5R98Sxst765CAqXmRtz8vwoD96g==
```
likely benign LLM, confidence 0.95 Test EC private key in PEM format.
Reasoning
A PEM EC private key in a test fixture for key-loading coverage. Its base64 body is expected for PEM.
info ~~warn~~ → info by review encoding-base64 tests/test_pkey.py:97:1

base64-like blob (224 bytes over 4 lines, compression ratio 0.89) (raw pass, confidence 0.60)
```
-----BEGIN EC PRIVATE KEY-----
MIGkAgEBBDBDdO8IXvlLJgM7+sNtPl7tI7FM5kzuEUEEPRjXIPQM7mISciwJPBt+
y43EuG8nL4mgBwYFK4EEACKhZANiAAQWxom0C1vQAGYhjdoREMVmGKBWlisDdzyk
mgyUjKpiJ9WfbIEVLsPGP8OdNjhr1y/8BZNIts+dJd6VmYw+4HzB+4F+U1Igs8K0
```
likely benign LLM, confidence 0.95 Test EC private key fixture in PEM format.
Reasoning
Another PEM EC private key test fixture, used to exercise key parsing. Its base64 is standard encoding.
info ~~warn~~ → info by review encoding-base64 tests/test_pkey.py:106:1

base64-like blob (300 bytes over 5 lines, compression ratio 0.85) (raw pass, confidence 0.60)
```
-----BEGIN EC PRIVATE KEY-----
MIHcAgEBBEIAprQtAS3OF6iVUkT8IowTHWicHzShGgk86EtuEXvfQnhZFKsWm6Jo
iqAr1yEaiuI9LfB3Xs8cjuhgEEfbduYr/f6gBwYFK4EEACOhgYkDgYYABACaOaFL
ZGuxa5AW16qj6VLypFbLrEWrt9AZUloCMefxO8bNLjK/O5g0rAVasar1TnyHE9qj
```
likely benign LLM, confidence 0.95 Test EC private key fixture in PEM format.
Reasoning
A PEM EC private key test fixture for a key-parsing test, with standard base64 content.

info unicode-mixed-script tests/test_pkey.py:116:77

identifier `ӏV` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)


TEST_KEY_BYTESTR = "\x00\x00\x00\x07ssh-rsa\x00\x00\x00\x01#\x00\x00\x00\x00ӏV\x07k%<\x1fT$E#>ғfD\x18 \x0cae#̬S#VlE\x1epvo\x17M߉DUXL<\x06\x10דw\u2bd5ٿw˟0)#y{\x10l\tPru\t\x19Π\u070e/f0yFmm\x1f"  # noqa

info unicode-mixed-script tests/test_pkey.py:116:96

identifier `ғfD` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)


TEST_KEY_BYTESTR = "\x00\x00\x00\x07ssh-rsa\x00\x00\x00\x01#\x00\x00\x00\x00ӏV\x07k%<\x1fT$E#>ғfD\x18 \x0cae#̬S#VlE\x1epvo\x17M߉DUXL<\x06\x10דw\u2bd5ٿw˟0)#y{\x10l\tPru\t\x19Π\u070e/f0yFmm\x1f"  # noqa

info unicode-mixed-script tests/test_pkey.py:116:146

identifier `דw` mixes scripts: Hebrew + Latin (in string/comment) (raw pass, confidence 0.40)


TEST_KEY_BYTESTR = "\x00\x00\x00\x07ssh-rsa\x00\x00\x00\x01#\x00\x00\x00\x00ӏV\x07k%<\x1fT$E#>ғfD\x18 \x0cae#̬S#VlE\x1epvo\x17M߉DUXL<\x06\x10דw\u2bd5ٿw˟0)#y{\x10l\tPru\t\x19Π\u070e/f0yFmm\x1f"  # noqa

info unicode-mixed-script tests/test_pkey.py:116:152

identifier `bd5ٿw` mixes scripts: Latin + Arabic (in string/comment) (raw pass, confidence 0.40)


TEST_KEY_BYTESTR = "\x00\x00\x00\x07ssh-rsa\x00\x00\x00\x01#\x00\x00\x00\x00ӏV\x07k%<\x1fT$E#>ғfD\x18 \x0cae#̬S#VlE\x1epvo\x17M߉DUXL<\x06\x10דw\u2bd5ٿw˟0)#y{\x10l\tPru\t\x19Π\u070e/f0yFmm\x1f"  # noqa

info ~~warn~~ → info by review encoding-escape-soup tests/test_pkey.py:133:17

30 consecutive `\xNN` escapes (entropy 4.7 bits/byte) (raw pass, confidence 0.80)
```
        key = util.generate_key_bytes(md5, x1234, "happy birthday", 30)
        exp = b"\x61\xe1\xf2\x72\xf4\xc1\xc4\x56\x15\x86\xbd\x32\x24\x98\xc0\xe9\x24\x67\x27\x80\xf4\x7b\xb3\x7d\xda\x7d\x54\x01\x9e\x64"  # noqa
        self.assertEqual(exp, key)
```
likely benign LLM, confidence 0.90 Expected key-derivation output bytes in a unit test.
Reasoning
A 30-byte expected value from a key-derivation test, compared with assertEqual. It is a known-answer test vector.
info ~~warn~~ → info by review encoding-hex tests/test_transport.py:169:23

20 consecutive `\xNN` escapes (entropy 4.3 bits/byte) (raw pass, confidence 0.65)
```
        self.tc.H = b"\x0c\x83\x07\xcd\xe6\x85\x6f\xf3\x0b\xa9\x36\x84\xeb\x0f\x04\xc2\x52\x0e\x9e\xd3"  # noqa
        self.tc.session_id = self.tc.H
        key = self.tc._compute_key("C", 32)
```
likely benign LLM, confidence 0.90 Fixed session hash bytes used as test input for key derivation.
Reasoning
A 20-byte session hash assigned for a key-computation test. It is a fixed test input, not hidden code.
info ~~warn~~ → info by review encoding-base64 tests/test_util.py:36:1

4 rows of base64-like lines, lines 36-40 (first: base64-like blob (77 bytes, compression ratio 1.14)) (raw pass, confidence 0.60)
```
secure.example.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA1PD6U2/TVxET6lkpKhOk5r\
9q/kAYG6sP9f5zuUYP8i7FOFp/6ncCEbbtg/lB+A3iidyxoSWl+9jtoyyDOOVX4UIDV9G11Ml8om3\
D+jrpI9cycZHqilK0HmxDeCuxbwyMuaCygU9gS2qoRvNLWZk70OpIKSSpBo0Wl3/XUmz9uhc=
happy.example.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA8bP1ZA7DCZDB9J0s50l31M\
```
likely benign LLM, confidence 0.90 Sample known_hosts entries with RSA public keys in a util test.
Reasoning
Multi-line known_hosts-style sample entries with line continuations, used to test host key parsing. It is ordinary test data.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/paramiko/paramiko paramiko && cd paramiko
git checkout 5.1.0
disclude scan --severity info --diff 5.0.1 .