pyasn1-modules 0.4.2

Source: https://github.com/pyasn1/pyasn1-modules
Tag scanned: v0.4.2
Compared with: v0.4.1 (0 signals introduced since)
Files: 276 scanned, 4 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 6 warn · 100 info
Scan time: 69.6 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): the 100 most severe of 106 warn and critical signals (100 with a verdict); 100 demoted to info. The rest are unreviewed.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:23

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

warn encoding-base64 tests/test_rfc8649.py:21:1

base64-like blob (132 bytes over 3 lines, compression ratio 0.96) (raw pass, confidence 0.60)

    extn_pem_text = """\
MGEGCisGAQQBg5IbAgEEUzBRMA0GCWCGSAFlAwQCAwUABEBxId+rK+WVDLOda2Yk
FFRbqQAztXhs91j/RxHjYJIv/3gleQg3Qix/yQy2rIg3xysjCvHWw8AuYOGVh/sL
GANG

warn encoding-base64 tests/test_rfc8696.py:25:1

base64-like blob (872 bytes over 13 lines, compression ratio 0.77) (raw pass, confidence 0.60)

    key_trans_psk_pem_text = """\
MIICigYLKoZIhvcNAQkQARegggJ5MIICdQIBADGCAiekggIjBgsqhkiG9w0BCRANATCCAhIC
AQAEE3B0Zi1rbWM6MTM2MTQxMjIxMTIwDQYLKoZIhvcNAQkQAx0wCwYJYIZIAWUDBAEtMIIB
sDCCAawCAQKAFJ7rZ8m5WnTUTS8WOWaA6AG1y6ScMA0GCSqGSIb3DQEBAQUABIIBgKo/Hkhu

warn encoding-base64 tests/test_rfc8696.py:109:1

base64-like blob (444 bytes over 7 lines, compression ratio 0.77) (raw pass, confidence 0.60)

    key_agree_psk_pem_text = """\
MIIBRwYLKoZIhvcNAQkQARegggE2MIIBMgIBADGB5aSB4gYLKoZIhvcNAQkQDQIwgdICAQAE
FHB0Zi1rbWM6MjE2ODQwMTEwMTIxoFWhUzATBgYrgQQBCwEGCWCGSAFlAwQBLQM8AAQ5G0Em
Jk/2ks8sXY1kzbuG3Uu3ttWwQRXALFDJICjvYfr+yTpOQVkchm88FAh9MEkw4NKctokKNgps

warn encoding-base64 tests/test_rfc8702.py:54:1

base64-like blob (1256 bytes over 20 lines, compression ratio 0.73) (raw pass, confidence 0.60)

    auth_message_pem_text = """\
MIIDqgYLKoZIhvcNAQkQAQKgggOZMIIDlQIBADGCAk8wggJLAgEAMDMwJjEUMBIG
A1UECgwLZXhhbXBsZS5jb20xDjAMBgNVBAMMBUFsaWNlAgkAg/ULtwvVxA4wDQYJ
KoZIhvcNAQEBBQAEggIAdZphtN3x8a8kZoAFY15HYRD6JyPBueRUhLbTPoOH3pZ9

warn encoding-base64 tests/test_rfc8708.py:23:1

base64-like blob (112 bytes over 2 lines, compression ratio 1.03) (raw pass, confidence 0.60)

    public_key_pem_text = """\
MFAwDQYLKoZIhvcNAQkQAxEDPwAEPAAAAAIAAAAGAAAAA9CPq9SiCR/wqMtO2DTn
RTQypYiFzZugQxI1Rmv/llHGySEkQE1F+lPPFhwo8a1ajg==
"""

warn encoding-base64 tests/test_rfc8708.py:44:1

base64-like blob (3588 bytes over 60 lines, compression ratio 0.76) (raw pass, confidence 0.60)

    signed_data_pem_text = """\
MIIKfQYJKoZIhvcNAQcCoIIKbjCCCmoCAQMxADAtBgkqhkiG9w0BBwGgIAQe
VGhpcyBpcyBzb21lIHNhbXBsZSBjb250ZW50Lg0KMYIKMjCCCi4CAQOABkhp
TW9tITALBglghkgBZQMEAgGgMTAvBgkqhkiG9w0BCQQxIgQgF6DPgklChkQZ

info ~~warn~~ → info by review encoding-base64 tests/test_pem.py:15:1

base64-like blob (1032 bytes over 17 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIDATCCAekCAQAwgZkxCzAJBgNVBAYTAlJVMRYwFAYDVQQIEw1Nb3Njb3cgUmVn
aW9uMQ8wDQYDVQQHEwZNb3Njb3cxGjAYBgNVBAoTEVNOTVAgTGFib3JhdG9yaWVz
MQwwCgYDVQQLFANSJkQxFTATBgNVBAMTDHNubXBsYWJzLmNvbTEgMB4GCSqGSIb3
```
dismissed LLM, confidence 0.95 Embedded PEM certificate request used as test fixture data.
Reasoning
The raw-pass base64 hit is a PEM certificate request embedded as a multi-line test string literal in a test file. Its readable ASN.1 fragments (country, org and CN names) confirm real test vector data, not a dropper or hidden payload.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc2314.py:19:1

base64-like blob (1032 bytes over 17 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIDATCCAekCAQAwgZkxCzAJBgNVBAYTAlJVMRYwFAYDVQQIEw1Nb3Njb3cgUmVn
aW9uMQ8wDQYDVQQHEwZNb3Njb3cxGjAYBgNVBAoTEVNOTVAgTGFib3JhdG9yaWVz
MQwwCgYDVQQLFANSJkQxFTATBgNVBAMTDHNubXBsYWJzLmNvbTEgMB4GCSqGSIb3
```
dismissed LLM, confidence 0.95 RFC 2314 PEM test vector in a test file.
Reasoning
This is a PEM-encoded certificate request test vector, the same kind of ASN.1 test data used across the pyasn1 RFC test suite. It sits in a test module and is only parsed, not executed or decoded into code.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc2437.py:19:1

base64-like blob (428 bytes over 7 lines, compression ratio 0.83) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIBPAIBAAJBAMfAjvBNDDYBCl1w3yNcagZkPhqd0q5KqeOTgKSLuJWfe5+VSeR5
Y1PcF3DyH8dvS3t8PIQjxJLoKS7HVRlsfhECAwEAAQJBAIr93/gxhIenXbD7MykF
yvi7k8MtgkWoymICZwcX+c6RudFyuPPfQJ/sf6RmFZlRA9X9CQm5NwVG7+x1Yi6t
```
dismissed LLM, confidence 0.95 RFC 2437 RSA key PEM test vector.
Reasoning
The blob is a base64 RSA private key test vector from an RFC 2437 test file. Key material in test fixtures is expected, and the raw pass's base64 heuristic fires on any long base64 literal.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc2459.py:64:1

base64-like blob (464 bytes over 8 lines, compression ratio 0.76) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIBVjCBwAIBATANBgkqhkiG9w0BAQUFADB+MQswCQYDVQQGEwJBVTETMBEGA1UE
CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk
MRUwEwYDVQQDEwxzbm1wbGFicy5jb20xIDAeBgkqhkiG9w0BCQEWEWluZm9Ac25t
```
dismissed LLM, confidence 0.95 RFC 2459 certificate PEM test vector.
Reasoning
This is a PEM certificate test vector with readable ASN.1 structure (country, organisation and email fields) inside a test function. It is standard RFC test data with no execution path.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc2459.py:101:1

base64-like blob (596 bytes over 10 lines, compression ratio 0.81) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIBugIBAAKBgQCN91+Cma8UPw09gjwP9WOJCdpv3mv3/qFqzgiODGZx0Q002iTl
1dq36m5TsWYFEcMCEyC3tFuoQ0mGq5zUUOmJvHCIPufs0g8Av0fhY77uFqneHHUi
VQMCPCHX9vTCWskmDE21LJppU27bR4H2q+ysE30d6u3+84qrItsn4bjpcQIVAPR5
```
dismissed LLM, confidence 0.95 Second RFC 2459 PEM test vector in the same file.
Reasoning
Another RFC 2459 PEM test fixture in the same test module, consisting of base64-encoded DER structure with no decoding or execution logic around it.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc2511.py:19:1

base64-like blob (564 bytes over 9 lines, compression ratio 0.80) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIBozCCAZ8wggEFAgUAwTnj2jCByoABAqURMA8xDTALBgNVBAMTBHVzZXKmgZ8w
DQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJ6ZQ2cYbn/lFsmBOlRltbRbFQUvvE0Q
nbopOu1kC7Bmaaz7QTx8nxeiHi4m7uxCbGGxHNoGCt7EmdG8eZUBNAcHyGlXrJdm
```
dismissed LLM, confidence 0.94 RFC 2511 certificate request PEM test vector.
Reasoning
This is a base64-encoded RFC 2511 certificate request test vector. The content is ASN.1 DER data passed to a parser inside a test module.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc2560.py:19:1

base64-like blob (144 bytes over 2 lines, compression ratio 0.95) (raw pass, confidence 0.60)
```
    pem_text = """\
MGowaDBBMD8wPTAJBgUrDgMCGgUABBS3ZrMV9C5Dko03aH13cEZeppg3wgQUkqR1LKSevoFE63n8
isWVpesQdXMCBDXe9M+iIzAhMB8GCSsGAQUFBzABAgQSBBBjdJOiIW9EKJGELNNf/rdA
"""
```
dismissed LLM, confidence 0.95 RFC 2560 OCSP response test vector.
Reasoning
The blob is a short base64 OCSP response test vector, recognisable from its ASN.1 OID bytes. Test fixtures like this are routine in ASN.1 libraries.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc2631.py:20:17

base64-like blob (44 bytes, compression ratio 1.07) (raw pass, confidence 0.60)
```
class OtherInfoTestCase(unittest.TestCase):
    pem_text = "MB0wEwYLKoZIhvcNAQkQAwYEBAAAAAGiBgQEAAAAwA=="

    def setUp(self):
```
dismissed LLM, confidence 0.93 Short base64 ASN.1 structure used as a test constant.
Reasoning
A 44-byte base64 string assigned to a test attribute. The decoded content is a small CMS/ASN.1 structure used by the test case, and the length rules out a meaningful payload.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc2634.py:85:1

base64-like blob (1668 bytes over 27 lines, compression ratio 0.70) (raw pass, confidence 0.60)
```
    signed_receipt_pem_text = """\
MIIE3gYJKoZIhvcNAQcCoIIEzzCCBMsCAQMxDTALBglghkgBZQMEAgEwga4GCyq
GSIb3DQEJEAEBoIGeBIGbMIGYAgEBBgkqhkiG9w0BBwEEIMdPIQ9kJ1cI9Q6HkR
CzbXWdD331uAUCL3MMFXP4KFOjBGYwZAIwOLV5WCbYjy5HLHE69IqXQQHVDJQzm
```
dismissed LLM, confidence 0.95 RFC 2634 signed receipt PEM test vector.
Reasoning
This is a base64 CMS signed-receipt test vector, with readable OID fragments such as the PKCS#7 signed-data identifier. It is test data for an RFC 2634 parser.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc2876.py:30:1

base64-like blob (2952 bytes over 47 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
    env_data_pem_text = """\
MIIIogYJKoZIhvcNAQcDoIIIkzCCCI8CAQKgggKRoIICjTCCAokwggIwoAMCAQIC
FGPMbd5dAfZyD1kqY7NIQyVCWZgqMAkGByqGSM44BAMwPzELMAkGA1UEBhMCVVMx
CzAJBgNVBAgTAlZBMRAwDgYDVQQHEwdIZXJuZG9uMREwDwYDVQQKEwhCb2d1cyBD
```
dismissed LLM, confidence 0.95 RFC 2876 CMS envelope PEM test vector.
Reasoning
This is a large base64 CMS environment-data test vector with standard ASN.1 structure, placed in a test module for the RFC 2876 parser. The size and format match legitimate fixture data.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc2986.py:22:1

base64-like blob (952 bytes over 15 lines, compression ratio 0.78) (raw pass, confidence 0.60)
```
    pem_text = """\
MIICxjCCAa4CAQAwgYAxCzAJBgNVBAYTAlVTMR0wGwYDVQQDDBRmY3UuZmFrZS5h
ZGRyZXNzLm9yZzEXMBUGA1UEBwwOUGxlYXNhbnQgR3JvdmUxHDAaBgNVBAoME0Zh
a2UgQ29tcGFueSBVbml0ZWQxDTALBgNVBAgMBFV0YWgxDDAKBgNVBAsMA0VuZzCC
```
dismissed LLM, confidence 0.95 RFC 2986 CSR PEM test vector.
Reasoning
This is a PEM certificate signing request test vector with readable organisation and locality fields, in a test file for the RFC 2986 parser. It is standard fixture data.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3058.py:26:1

base64-like blob (1888 bytes over 30 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
    env_data_pem_text = """\
MIIFgwYJKoZIhvcNAQcDoIIFdDCCBXACAQIxXaJbAgEEMCMEEDiCUYXKXu8SzLos
n2xeYP4YDzIwMTkwOTEyMTIwMDAwWjAPBgsrBgEEAYE8BwEBBgUABCB0G/YBGH3L
3RhoG0mK33M8IvRYAOsnHB5MfUAOGF6kuDCCBQoGCSqGSIb3DQEHATAZBgsrBgEE
```
dismissed LLM, confidence 0.95 Base64-encoded PEM test vector for a CMS envelope in an RFC 3058 test file.
Reasoning
Raw-pass base64 hit on a PEM-encoded CMS EnvelopedData test vector inside a test module. The blob is a certificate-format test fixture, not obfuscated code, and the raw pass has a high false-positive rate on base64 data.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3161.py:20:1

base64-like blob (120 bytes over 2 lines, compression ratio 1.01) (raw pass, confidence 0.60)
```
    tsp_query_pem_text = """\
MFYCAQEwUTANBglghkgBZQMEAgMFAARAGu1DauxDZZv8F7l4EKIbS00U40mUKfBW5C0giEz0
t1zOHCvK4A8i8zxwUXFHv4pAJZE+uFhZ+v53HTg9rLjO5Q==
"""
```
dismissed LLM, confidence 0.95 Base64-encoded PEM timestamp query fixture in an RFC 3161 test.
Reasoning
Raw base64 hit on a short PEM-encoded timestamp query test vector in a test file. This is standard ASN.1 test data with no executable or obfuscating role.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3161.py:38:1

base64-like blob (1780 bytes over 25 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
    tsp_response_pem_text = """\
MIIFMTADAgEAMIIFKAYJKoZIhvcNAQcCoIIFGTCCBRUCAQMxCzAJBgUrDgMCGgUAMIIBowYL
KoZIhvcNAQkQAQSgggGSBIIBjjCCAYoCAQEGBCoDBAEwUTANBglghkgBZQMEAgMFAARAGu1D
auxDZZv8F7l4EKIbS00U40mUKfBW5C0giEz0t1zOHCvK4A8i8zxwUXFHv4pAJZE+uFhZ+v53
```
dismissed LLM, confidence 0.95 Base64-encoded PEM timestamp response fixture in an RFC 3161 test.
Reasoning
Raw base64 hit on a PEM-encoded timestamp response test vector in a test module. The content is ASN.1 DER test data, consistent with a pyasn1/cryptography test suite.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3274.py:22:1

base64-like blob (668 bytes over 11 lines, compression ratio 0.81) (raw pass, confidence 0.60)
```
    compressed_data_pem_text = """\
MIIB7wYLKoZIhvcNAQkQAQmgggHeMIIB2gIBADANBgsqhkiG9w0BCRADCDCCAcQG
CSqGSIb3DQEHAaCCAbUEggGxeJxVksGO1DAQRO/+ir4xK4VlNSAhcUPRrgRiLgw/
0Il7Egu7bdntMOHraSezMJyixOWq19XpIwuxvP2xJvoEQld5lzw6Nub7Sw/vjx8/
```
dismissed LLM, confidence 0.95 Base64-encoded PEM compressed-data test vector in an RFC 3274 test.
Reasoning
Raw base64 hit on a PEM compressed-data test vector. It is a fixed certificate-format fixture in a test file, not a payload or dropper.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3279.py:23:1

base64-like blob (1692 bytes over 27 lines, compression ratio 0.70) (raw pass, confidence 0.60)
```
    rsa_cert_pem_text = """\
MIIE8TCCA9mgAwIBAgIQbyXcFa/fXqMIVgw7ek/H+DANBgkqhkiG9w0BAQUFADBv
MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFk
ZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBF
```
dismissed LLM, confidence 0.95 Base64-encoded PEM RSA certificate fixture in an RFC 3279 test.
Reasoning
Raw base64 hit on a PEM RSA certificate test vector with recognizable X.509 structure. Test fixture data in a test file.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3279.py:96:1

base64-like blob (1260 bytes over 20 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
    ec_cert_pem_text = """\
MIIDrDCCApSgAwIBAgIQCssoukZe5TkIdnRw883GEjANBgkqhkiG9w0BAQwFADBh
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
```
dismissed LLM, confidence 0.95 Base64-encoded PEM elliptic-curve certificate fixture in an RFC 3279 test.
Reasoning
Raw base64 hit on a PEM EC certificate test vector with standard X.509 DER structure. Benign test data in a test file.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3279.py:159:1

base64-like blob (1252 bytes over 20 lines, compression ratio 0.75) (raw pass, confidence 0.60)
```
    dsa_cert_pem_text = """\
MIIDpjCCA0ygAwIBAgIUY8xt3l0B9nIPWSpjs0hDJUJZmCkwCwYJYIZIAWUDBAMC
MD8xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJWQTEQMA4GA1UEBxMHSGVybmRvbjER
MA8GA1UEChMIQm9ndXMgQ0EwHhcNMTkxMDIwMjAxMjMwWhcNMjAxMDE5MjAxMjMw
```
dismissed LLM, confidence 0.95 Base64-encoded PEM DSA certificate fixture in an RFC 3279 test.
Reasoning
Raw base64 hit on a PEM DSA certificate test vector. Standard certificate fixture in a test file, with no obfuscation or execution path.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3279.py:235:1

base64-like blob (876 bytes over 14 lines, compression ratio 0.76) (raw pass, confidence 0.60)
```
    kea_cert_pem_text = """\
MIICizCCAjOgAwIBAgIUY8xt3l0B9nIPWSpjs0hDJUJZmCgwCQYHKoZIzjgEAzA/
MQswCQYDVQQGEwJVUzELMAkGA1UECBMCVkExEDAOBgNVBAcTB0hlcm5kb24xETAP
BgNVBAoTCEJvZ3VzIENBMB4XDTE5MTAyMDIwMDkyMVoXDTIwMTAxOTIwMDkyMVow
```
dismissed LLM, confidence 0.95 Base64-encoded PEM KEA certificate fixture in an RFC 3279 test.
Reasoning
Raw base64 hit on a PEM KEA certificate test vector in a test file. Consistent with a crypto library's ASN.1 test corpus.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3279.py:309:1

base64-like blob (1612 bytes over 26 lines, compression ratio 0.76) (raw pass, confidence 0.60)
```
    dh_cert_pem_text = """\
MIIEtDCCBFqgAwIBAgIUY8xt3l0B9nIPWSpjs0hDJUJZmCkwCwYJYIZIAWUDBAMC
MD8xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJWQTEQMA4GA1UEBxMHSGVybmRvbjER
MA8GA1UEChMIQm9ndXMgQ0EwHhcNMTkxMDIwMjAxMjMwWhcNMjAxMDE5MjAxMjMw
```
dismissed LLM, confidence 0.95 Base64-encoded PEM Diffie-Hellman certificate fixture in an RFC 3279 test.
Reasoning
Raw base64 hit on a PEM DH certificate test vector. Fixed certificate fixture in a test module, with no decoding or execution logic around it.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3280.py:53:1

base64-like blob (464 bytes over 8 lines, compression ratio 0.76) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIBVjCBwAIBATANBgkqhkiG9w0BAQUFADB+MQswCQYDVQQGEwJBVTETMBEGA1UE
CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk
MRUwEwYDVQQDEwxzbm1wbGFicy5jb20xIDAeBgkqhkiG9w0BCQEWEWluZm9Ac25t
```
dismissed LLM, confidence 0.95 Base64-encoded PEM certificate fixture in an RFC 3280 test.
Reasoning
Raw base64 hit on a PEM certificate test vector with embedded text fields such as org names and an email address. Test data in a test file.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3370.py:26:1

base64-like blob (1900 bytes over 30 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
    env_data_pem_text = """\
MIIFjAYJKoZIhvcNAQcDoIIFfTCCBXkCAQIxZqJkAgEEMCMEEH744tkBAA6gplAQ
nKYxCF8YDzIwMTkwOTEyMTIwMDAwWjAQBgsqhkiG9w0BCRADBwIBOgQocOaZ+1cB
94MzMPtx6HyFpCC9yZrwXSKvWg5I018xOJhsuq+0so1PNTCCBQoGCSqGSIb3DQEH
```
dismissed LLM, confidence 0.95 Base64-encoded PEM CMS envelope fixture in an RFC 3370 test.
Reasoning
Raw base64 hit on a PEM CMS EnvelopedData test vector in a test module. Standard ASN.1 fixture data with no obfuscating or executing role.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3370.py:120:1

base64-like blob (1252 bytes over 20 lines, compression ratio 0.75) (raw pass, confidence 0.60)
```
    dsa_cert_pem_text = """\
MIIDpjCCA0ygAwIBAgIUY8xt3l0B9nIPWSpjs0hDJUJZmCkwCwYJYIZIAWUDBAMC
MD8xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJWQTEQMA4GA1UEBxMHSGVybmRvbjER
MA8GA1UEChMIQm9ndXMgQ0EwHhcNMTkxMDIwMjAxMjMwWhcNMjAxMDE5MjAxMjMw
```
dismissed LLM, confidence 0.95 Multi-line PEM DSA certificate used as a test fixture for RFC 3370.
Reasoning
This is a PEM-encoded DSA certificate embedded as a test vector in an RFC conformance test file. The base64 is standard certificate structure, not an encoded payload, and the raw pass has a high false-positive rate on this kind of content.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3447.py:22:1

base64-like blob (1660 bytes over 26 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIE2QIBAQKCAQEAn82EqwXasE2TFNSmZucB8LNza2mOWLHF3nxpxKXalPMDvezc
5Dq7Ytcv/k9jJL4j4jYfvR4yyZdU9iHLaD6hOINZ8E6hVpx/4c96ZUSOLzD2g+u+
jIuoNfG+zygSBGYCS6BLCAIsZ+2wUyxYpLJknHJld9/jy+aLmmyrilhH9dH5AUiV
```
dismissed LLM, confidence 0.95 PEM RSA key block embedded as a test vector for RFC 3447.
Reasoning
A PEM-encoded RSA private key used as test input for RFC 3447 (PKCS#1) in a cryptography library's test suite. Test key material like this is expected and is not obfuscation or a dropper.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3560.py:35:29

base64-like blob (84 bytes, compression ratio 0.96) (raw pass, confidence 0.60)
```
class OAEPSHA256TestCase(unittest.TestCase):
    oaep_sha256_pem_text = "MDwGCSqGSIb3DQEBBzAvoA8wDQYJYIZIAWUDBAIBBQChHDAaBgkqhkiG9w0BAQgwDQYJYIZIAWUDBAIBBQA="

    def setUp(self):
```
dismissed LLM, confidence 0.96 Base64-encoded DER OAEP algorithm identifier used in an RFC 3560 test.
Reasoning
A short base64 string encoding an ASN.1 OAEP/SHA-256 algorithm identifier, assigned to a test class attribute. It is standard DER structure for a crypto test vector.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3565.py:35:28

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
class AESCBCTestCase(unittest.TestCase):
    aes_alg_id_pem_text = "MB0GCWCGSAFlAwQBKgQQEImWuoUOPwM5mTu1h4oONw=="

    def setUp(self):
```
dismissed LLM, confidence 0.96 Base64-encoded DER AES-CBC algorithm identifier used as a test value.
Reasoning
A short base64 AlgorithmIdentifier for AES-CBC in an RFC 3565 test case. It is ASN.1 DER data, consistent with the surrounding test vectors.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3657.py:23:1

base64-like blob (1884 bytes over 30 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
    env_data_pem_text = """\
MIIFfwYJKoZIhvcNAQcDoIIFcDCCBWwCAQIxU6JRAgEEMCMEECBlcTFnxBsPlsug
4KOCj78YDzIwMTkwOTEyMTIwMDAwWjANBgsqgwiMmks9AQEDAgQYS3mK9jQmvth1
iuBV8PEa89ICvmoomJCvMIIFEAYJKoZIhvcNAQcBMB8GCyqDCIyaSz0BAQECBBBC
```
dismissed LLM, confidence 0.95 PEM-encoded CMS envelope test vector for RFC 3657.
Reasoning
A PEM CMS EnvelopedData structure used as an RFC 3657 test vector. Its base64 is standard ASN.1 content for a crypto library's parser tests.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3709.py:20:1

base64-like blob (1020 bytes over 16 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIC9zCCAn2gAwIBAgIJAKWzVCgbsG46MAoGCCqGSM49BAMDMD8xCzAJBgNVBAYT
AlVTMQswCQYDVQQIDAJWQTEQMA4GA1UEBwwHSGVybmRvbjERMA8GA1UECgwIQm9n
dXMgQ0EwHhcNMTkwNTE0MTAwMjAwWhcNMjAwNTEzMTAwMjAwWjBlMQswCQYDVQQG
```
dismissed LLM, confidence 0.95 PEM certificate test fixture for RFC 3709.
Reasoning
A PEM X.509 certificate with a standard header, used as a test vector for RFC 3709 in a crypto test suite. The base64 is ordinary certificate data.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3709.py:90:1

base64-like blob (3128 bytes over 49 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIJJDCCCAygAwIBAgIRAPIGo/5ScWbpAAAAAFwQBqkwDQYJKoZIhvcNAQELBQAw
gbkxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1FbnRydXN0LCBJbmMuMSgwJgYDVQQL
Ex9TZWUgd3d3LmVudHJ1c3QubmV0L2xlZ2FsLXRlcm1zMTkwNwYDVQQLEzAoYykg
```
dismissed LLM, confidence 0.95 Large PEM certificate test fixture in the RFC 3709 test file.
Reasoning
A large PEM certificate chain with standard certificate content used as a test fixture. Long base64 is expected for certificates in this file.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3739.py:23:1

base64-like blob (1772 bytes over 28 lines, compression ratio 0.70) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIFLTCCBBWgAwIBAgIMVRaIE9MInBkG6aUaMA0GCSqGSIb3DQEBCwUAMHMxCzAJ
BgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMRowGAYDVQQLExFG
b3IgRGVtbyBVc2UgT25seTEtMCsGA1UEAxMkR2xvYmFsU2lnbiBEZW1vIElzc3Vp
```
dismissed LLM, confidence 0.95 PEM qualified-certificate test vector for RFC 3739.
Reasoning
A PEM-encoded certificate for an RFC 3739 qualified certificate test. Standard X.509 DER in a test vector, with no execution or decoding path.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3770.py:22:1

base64-like blob (916 bytes over 15 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
    cert_pem_text = """\
MIICqzCCAjCgAwIBAgIJAKWzVCgbsG4/MAoGCCqGSM49BAMDMD8xCzAJBgNVBAYT
AlVTMQswCQYDVQQIDAJWQTEQMA4GA1UEBwwHSGVybmRvbjERMA8GA1UECgwIQm9n
dXMgQ0EwHhcNMTkwNzE5MTk0MjQ3WhcNMjAwNzE4MTk0MjQ3WjBjMQswCQYDVQQG
```
dismissed LLM, confidence 0.95 PEM certificate fixture for RFC 3770 certificate-extension tests.
Reasoning
A PEM certificate with a standard header in an RFC 3770 test file. The base64 is ordinary certificate content used as a parser test input.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3779.py:20:1

base64-like blob (1384 bytes over 22 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIECjCCAvKgAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UEAxMLcmlw
ZS1uY2MtdGEwIBcNMTcxMTI4MTQzOTU1WhgPMjExNzExMjgxNDM5NTVaMBYxFDAS
BgNVBAMTC3JpcGUtbmNjLXRhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
```
dismissed LLM, confidence 0.95 PEM certificate fixture for RFC 3779 resource-extension tests.
Reasoning
A PEM certificate with IP/AS resource extensions used as an RFC 3779 test vector. The base64 encodes standard certificate structure.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3820.py:22:1

base64-like blob (1356 bytes over 22 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
    pem_text = """\
MIID9DCCAtygAwIBAgIEDODd4TANBgkqhkiG9w0BAQUFADCBjTESMBAGCgmSJomT
8ixkARkWAm5sMRcwFQYKCZImiZPyLGQBGRYHZS1pbmZyYTEaMBgGA1UEChMRVHJh
aW5pbmcgU2VydmljZXMxDjAMBgNVBAsTBXVzZXJzMRowGAYDVQQLExFTZWN1cml0
```
dismissed LLM, confidence 0.95 PEM proxy-certificate test fixture for RFC 3820.
Reasoning
A PEM proxy certificate used as a test fixture for RFC 3820. Ordinary certificate content in a crypto library's test suite, with no decoding or execution logic.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3852.py:22:1

base64-like blob (1420 bytes over 19 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIEJQYJKoZIhvcNAQcCoIIEFjCCBBICAQMxCzAJBgUrDgMCGgUAMIIDAgYIKwYBBQUHDAKgggL0
BIIC8DCCAuwweDB2AgECBgorBgEEAYI3CgoBMWUwYwIBADADAgEBMVkwVwYJKwYBBAGCNxUUMUow
SAIBBQwZcGl0dWNoYTEuZW1lYS5ocHFjb3JwLm5ldAwMRU1FQVxwaXR1Y2hhDBpDTUNSZXFHZW5l
```
likely benign LLM, confidence 0.97 Embedded PEM test vector for CMS signed data in an RFC conformance test.
Reasoning
Raw base64 pattern inside a test file embedding a PEM-encoded CMS/PKCS#7 test vector (RFC 3852 test data). Legitimate fixture data, not obfuscation.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4010.py:26:1

base64-like blob (1876 bytes over 30 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
    env_data_pem_text = """\
MIIFewYJKoZIhvcNAQcDoIIFbDCCBWgCAQIxUqJQAgEEMCMEEKBBI2KxDUPS5TCo
RCEDJo4YDzIwMTkwOTEyMTIwMDAwWjAMBgoqgxqMmkQHAQEBBBipFE2DxCLAx2Og
E53Jt21V8kAoscU7K3wwggUNBgkqhkiG9w0BBwEwHAYIKoMajJpEAQQEEEJPR1VT
```
likely benign LLM, confidence 0.97 Embedded PEM test vector for RFC 4010 data in a test.
Reasoning
Base64 PEM test fixture of an RFC 4010 CMS structure in a test file; expected content for parser tests.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4108.py:20:1

base64-like blob (1624 bytes over 26 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIEvAYJKoZIhvcNAQcCoIIErTCCBKkCAQExDTALBglghkgBZQMEAgEwggIVBgsq
hkiG9w0BCRABEKCCAgQEggIA3ntqPr5kDpx+//pgWGfHCH/Ht4pbenGwXv80txyE
Y0I2mT9BUGz8ILkbhD7Xz89pBS5KhEJpthxH8WREJtvS+wL4BqYLt23wjWoZy5Gt
```
likely benign LLM, confidence 0.97 Embedded PEM test vector for RFC 4108 in a test file.
Reasoning
PEM-encoded test data for RFC 4108 CMS structures; the blob decodes to ASN.1 structure consistent with the test's purpose.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4211.py:20:1

base64-like blob (564 bytes over 9 lines, compression ratio 0.80) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIBozCCAZ8wggEFAgUAwTnj2jCByoABAqURMA8xDTALBgNVBAMTBHVzZXKmgZ8w
DQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJ6ZQ2cYbn/lFsmBOlRltbRbFQUvvE0Q
nbopOu1kC7Bmaaz7QTx8nxeiHi4m7uxCbGGxHNoGCt7EmdG8eZUBNAcHyGlXrJdm
```
likely benign LLM, confidence 0.97 Embedded PEM certificate request fixture for RFC 4211 tests.
Reasoning
PEM-encoded certificate request test fixture for RFC 4211 in a test module; standard ASN.1 base64 structure.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4334.py:21:1

base64-like blob (916 bytes over 15 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
    cert_pem_text = """\
MIICqzCCAjCgAwIBAgIJAKWzVCgbsG4/MAoGCCqGSM49BAMDMD8xCzAJBgNVBAYT
AlVTMQswCQYDVQQIDAJWQTEQMA4GA1UEBwwHSGVybmRvbjERMA8GA1UECgwIQm9n
dXMgQ0EwHhcNMTkwNzE5MTk0MjQ3WhcNMjAwNzE4MTk0MjQ3WjBjMQswCQYDVQQG
```
likely benign LLM, confidence 0.96 Embedded PEM certificate fixture for RFC 4334 tests.
Reasoning
PEM certificate test data for RFC 4334 in a test file; the base64 begins with standard X.509 ASN.1 headers.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4357.py:23:1

base64-like blob (400 bytes over 7 lines, compression ratio 0.75) (raw pass, confidence 0.60)
```
    signed_pem_text = """\
MIIBKAYJKoZIhvcNAQcCoIIBGTCCARUCAQExDDAKBgYqhQMCAgkFADAbBgkqhkiG
9w0BBwGgDgQMc2FtcGxlIHRleHQKMYHkMIHhAgEBMIGBMG0xHzAdBgNVBAMMFkdv
c3RSMzQxMC0yMDAxIGV4YW1wbGUxEjAQBgNVBAoMCUNyeXB0b1BybzELMAkGA1UE
```
likely benign LLM, confidence 0.96 Embedded signed PEM fixture for RFC 4357 GOST tests.
Reasoning
Signed PEM test vector for GOST CMS structures (RFC 4357) in a test file; expected fixture content.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4357.py:79:1

base64-like blob (568 bytes over 9 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
    keyagree_pem_text = """\
MIIBpAYJKoZIhvcNAQcDoIIBlTCCAZECAQIxggFQoYIBTAIBA6BloWMwHAYGKoUD
AgITMBIGByqFAwICJAAGByqFAwICHgEDQwAEQLNVOfRngZcrpcTZhB8n+4HtCDLm
mtTyAHi4/4Nk6tIdsHg8ff4DwfQG5DvMFrnF9vYZNxwXuKCqx9GhlLOlNiChCgQI
```
likely benign LLM, confidence 0.96 Embedded key agreement PEM fixture for RFC 4357 tests.
Reasoning
Key agreement PEM test data for RFC 4357 in a test file; standard ASN.1 encoding of test vector.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4357.py:167:1

base64-like blob (572 bytes over 9 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
    keytrans_pem_text = """\
MIIBpwYJKoZIhvcNAQcDoIIBmDCCAZQCAQAxggFTMIIBTwIBADCBgTBtMR8wHQYD
VQQDDBZHb3N0UjM0MTAtMjAwMSBleGFtcGxlMRIwEAYDVQQKDAlDcnlwdG9Qcm8x
CzAJBgNVBAYTAlJVMSkwJwYJKoZIhvcNAQkBFhpHb3N0UjM0MTAtMjAwMUBleGFt
```
likely benign LLM, confidence 0.96 Embedded key transport PEM fixture for RFC 4357 tests.
Reasoning
Key transport PEM test vector for RFC 4357 in a test file; legitimate test data.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4490.py:24:1

base64-like blob (400 bytes over 7 lines, compression ratio 0.75) (raw pass, confidence 0.60)
```
    signed_pem_text = """\
MIIBKAYJKoZIhvcNAQcCoIIBGTCCARUCAQExDDAKBgYqhQMCAgkFADAbBgkqhkiG
9w0BBwGgDgQMc2FtcGxlIHRleHQKMYHkMIHhAgEBMIGBMG0xHzAdBgNVBAMMFkdv
c3RSMzQxMC0yMDAxIGV4YW1wbGUxEjAQBgNVBAoMCUNyeXB0b1BybzELMAkGA1UE
```
likely benign LLM, confidence 0.96 Embedded signed PEM fixture for RFC 4490 GOST tests.
Reasoning
Duplicate of the RFC 4357 signed PEM fixture, present in the RFC 4490 test file; legitimate test data.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4490.py:85:1

base64-like blob (568 bytes over 9 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
    keyagree_pem_text = """\
MIIBpAYJKoZIhvcNAQcDoIIBlTCCAZECAQIxggFQoYIBTAIBA6BloWMwHAYGKoUD
AgITMBIGByqFAwICJAAGByqFAwICHgEDQwAEQLNVOfRngZcrpcTZhB8n+4HtCDLm
mtTyAHi4/4Nk6tIdsHg8ff4DwfQG5DvMFrnF9vYZNxwXuKCqx9GhlLOlNiChCgQI
```
likely benign LLM, confidence 0.96 Embedded key agreement PEM fixture for RFC 4490 tests.
Reasoning
Key agreement PEM test vector for RFC 4490 in a test file; standard encoded test data.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4490.py:193:1

base64-like blob (572 bytes over 9 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
    keytrans_pem_text = """\
MIIBpwYJKoZIhvcNAQcDoIIBmDCCAZQCAQAxggFTMIIBTwIBADCBgTBtMR8wHQYD
VQQDDBZHb3N0UjM0MTAtMjAwMSBleGFtcGxlMRIwEAYDVQQKDAlDcnlwdG9Qcm8x
CzAJBgNVBAYTAlJVMSkwJwYJKoZIhvcNAQkBFhpHb3N0UjM0MTAtMjAwMUBleGFt
```
likely benign LLM, confidence 0.96 Embedded key transport PEM fixture for RFC 4490 tests.
Reasoning
Key transport PEM test vector for RFC 4490 in a test file; legitimate fixture content.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4491.py:21:1

base64-like blob (704 bytes over 11 lines, compression ratio 0.75) (raw pass, confidence 0.60)
```
    gostR3410_94_cert_pem_text = """\
MIICCzCCAboCECMO42BGlSTOxwvklBgufuswCAYGKoUDAgIEMGkxHTAbBgNVBAMM
FEdvc3RSMzQxMC05NCBleGFtcGxlMRIwEAYDVQQKDAlDcnlwdG9Qcm8xCzAJBgNV
BAYTAlJVMScwJQYJKoZIhvcNAQkBFhhHb3N0UjM0MTAtOTRAZXhhbXBsZS5jb20w
```
likely benign LLM, confidence 0.97 Embedded GOST R 34.10-94 PEM certificate test vector.
Reasoning
Raw base64 pass flags a PEM certificate literal in a test file for an RFC 4491 GOST test vector. The content is standard X.509 DER encoded as base64, which is expected in cryptography test suites.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4491.py:88:1

base64-like blob (624 bytes over 10 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
    gostR3410_2001_cert_pem_text = """\
MIIB0DCCAX8CECv1xh7CEb0Xx9zUYma0LiEwCAYGKoUDAgIDMG0xHzAdBgNVBAMM
Fkdvc3RSMzQxMC0yMDAxIGV4YW1wbGUxEjAQBgNVBAoMCUNyeXB0b1BybzELMAkG
A1UEBhMCUlUxKTAnBgkqhkiG9w0BCQEWGkdvc3RSMzQxMC0yMDAxQGV4YW1wbGUu
```
likely benign LLM, confidence 0.97 Embedded GOST R 34.10-2001 PEM certificate test vector.
Reasoning
Same pattern: a PEM certificate test vector for GOST R 34.10-2001 in a test module. Base64 is the expected encoding for PEM and this is a known RFC test fixture.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4683.py:22:1

base64-like blob (1108 bytes over 18 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
    cert_pem_text = """\
MIIDOzCCAsCgAwIBAgIJAKWzVCgbsG5KMAoGCCqGSM49BAMDMD8xCzAJBgNVBAYT
AlVTMQswCQYDVQQIDAJWQTEQMA4GA1UEBwwHSGVybmRvbjERMA8GA1UECgwIQm9n
dXMgQ0EwHhcNMTkxMjExMjIzODUwWhcNMjAxMjEwMjIzODUwWjBOMQswCQYDVQQG
```
likely benign LLM, confidence 0.97 Embedded X.509 certificate test vector from RFC 4683.
Reasoning
A PEM certificate literal in an RFC 4683 test file. The base64 is ASN.1 DER structure (MIIC... headers), consistent with a real certificate fixture rather than obfuscated payload.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4985.py:21:1

base64-like blob (1000 bytes over 16 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
    xmpp_server_cert_pem_text = """\
MIIC6DCCAm+gAwIBAgIJAKWzVCgbsG5DMAoGCCqGSM49BAMDMD8xCzAJBgNVBAYT
AlVTMQswCQYDVQQIDAJWQTEQMA4GA1UEBwwHSGVybmRvbjERMA8GA1UECgwIQm9n
dXMgQ0EwHhcNMTkxMDI0MjMxNjA0WhcNMjAxMDIzMjMxNjA0WjBNMQswCQYDVQQG
```
likely benign LLM, confidence 0.97 Embedded X.509 certificate test vector for XMPP SRV names.
Reasoning
PEM certificate test data for an RFC 4985 XMPP certificate case. Standard DER base64 in a test fixture; no execution or decoding logic shown.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5035.py:85:1

base64-like blob (1668 bytes over 24 lines, compression ratio 0.70) (raw pass, confidence 0.60)
```
    signed_receipt_pem_text = """\
MIIE3gYJKoZIhvcNAQcCoIIEzzCCBMsCAQMxDTALBglghkgBZQMEAgEwga4GCyqGSIb3DQEJ
EAEBoIGeBIGbMIGYAgEBBgkqhkiG9w0BBwEEIMdPIQ9kJ1cI9Q6HkRCzbXWdD331uAUCL3MM
FXP4KFOjBGYwZAIwOLV5WCbYjy5HLHE69IqXQQHVDJQzmo18WwkFrEYH3EMsvpXEIGqsFTFN
```
likely benign LLM, confidence 0.97 Embedded CMS signed receipt test vector.
Reasoning
PEM-encoded CMS signed receipt test vector from RFC 5035. The base64 is ASN.1 structure appropriate for testing the parser.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5083.py:22:1

base64-like blob (844 bytes over 12 lines, compression ratio 0.78) (raw pass, confidence 0.60)
```
    pem_text = """\
MIICdQIBADGCAiekggIjBgsqhkiG9w0BCRANATCCAhICAQAEE3B0Zi1rbWM6MTM2MTQxMjIx
MTIwDQYLKoZIhvcNAQkQAzAwCwYJYIZIAWUDBAEtMIIBsDCCAawCAQKAFJ7rZ8m5WnTUTS8W
OWaA6AG1y6ScMA0GCSqGSIb3DQEBAQUABIIBgHfnHNqDbyyql2NqX6UQggelWMTjwzJJ1L2e
```
likely benign LLM, confidence 0.97 Embedded CMS AuthEnvelopedData test vector.
Reasoning
PEM-encoded CMS authenticated-enveloped-data test vector from RFC 5083 in a test file. Expected binary-as-base64 content for ASN.1 parser tests.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5083.py:49:1

base64-like blob (940 bytes over 15 lines, compression ratio 0.75) (raw pass, confidence 0.60)
```
    pem_text = """\
MIICvQYLKoZIhvcNAQkQARegggKsMIICqAIBADGCAiekggIjBgsqhkiG9w0BCRAN
ATCCAhICAQAEE3B0Zi1rbWM6MTM2MTQxMjIxMTIwDQYLKoZIhvcNAQkQAzAwCwYJ
YIZIAWUDBAEtMIIBsDCCAawCAQKAFJ7rZ8m5WnTUTS8WOWaA6AG1y6ScMA0GCSqG
```
likely benign LLM, confidence 0.97 Second embedded CMS test vector from RFC 5083.
Reasoning
Another RFC 5083 PEM test vector in the test module, same benign pattern of standard ASN.1 DER encoded as base64.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5084.py:52:1

base64-like blob (2588 bytes over 36 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
    rfc8591_pem_pext = """\
MIIHkAYLKoZIhvcNAQkQARegggd/MIIHewIBADGCAk8wggJLAgEAMDMwJjEUMBIGA1UECgwL
ZXhhbXBsZS5jb20xDjAMBgNVBAMMBUFsaWNlAgkAg/ULtwvVxA4wDQYJKoZIhvcNAQEBBQAE
ggIAdZphtN3x8a8kZoAFY15HYRD6JyPBueRUhLbTPoOH3pZ9xeDK+zVXGlahl1y1UOe+McEx
```
likely benign LLM, confidence 0.97 Embedded CMS AuthEnvelopedData test vector with AES-GCM parameters.
Reasoning
Embedded RFC 5084 CMS test vector (variable name has a typo 'pem_pext' but is only a test literal). Base64 DER data is expected in this context.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5126.py:21:1

base64-like blob (460 bytes over 8 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
    pem_text = """\
MYIBUzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMCsGCSqGSIb3DQEJNDEeMBww
DQYJYIZIAWUDBAIBBQChCwYJKoZIhvcNAQELMC8GCSqGSIb3DQEJBDEiBCCyqtCC
Gosj/GT4YPPAqKheze4A1QBU5O3tniTsVPGr7jBBBgsqhkiG9w0BCRACETEyMDCg
```
likely benign LLM, confidence 0.97 Embedded CMS/CAdES test vector from RFC 5126.
Reasoning
PEM-encoded CAdES/timestamp-style test data from RFC 5126 in a test file. Base64 is the standard transport encoding for these structures.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5208.py:19:1

base64-like blob (464 bytes over 8 lines, compression ratio 0.83) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIBVgIBADANBgkqhkiG9w0BAQEFAASCAUAwggE8AgEAAkEAx8CO8E0MNgEKXXDf
I1xqBmQ+Gp3Srkqp45OApIu4lZ97n5VJ5HljU9wXcPIfx29Le3w8hCPEkugpLsdV
GWx+EQIDAQABAkEAiv3f+DGEh6ddsPszKQXK+LuTwy2CRajKYgJnBxf5zpG50XK4
```
likely benign LLM, confidence 0.97 Embedded PKCS#8 private key test vector from RFC 5208.
Reasoning
PEM-encoded PKCS#8 private key test vector from RFC 5208. Test fixtures for key parsing commonly contain such literals; no decoding or execution behavior is present in the snippet.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5208.py:46:1

base64-like blob (520 bytes over 9 lines, compression ratio 0.82) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIBgTAbBgkqhkiG9w0BBQMwDgQIdtFgDWnipT8CAggABIIBYN0hkm2xqkTCt8dJ
iZS8+HNiyHxy8g+rmWSXv/i+bTHFUReZA2GINtTRUkWpXqWcSHxNslgf7QdfgbVJ
xQiUM+lLhwOFh85iAHR3xmPU1wfN9NvY9DiLSpM0DMhF3OvAMZD75zIhA0GSKu7w
```
dismissed LLM, confidence 0.95 A PEM-encoded PKCS#8 test vector embedded as a triple-quoted string in an RFC 5208 test.
Reasoning
Raw-pass base64 signal on a PEM test vector inside a test module. The blob is a standard ASN.1/PKCS#8 structure for RFC 5208 test data, not a payload, and the raw pass has a high false-positive rate on this kind of content.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5280.py:55:1

base64-like blob (464 bytes over 8 lines, compression ratio 0.76) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIBVjCBwAIBATANBgkqhkiG9w0BAQUFADB+MQswCQYDVQQGEwJBVTETMBEGA1UE
CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk
MRUwEwYDVQQDEwxzbm1wbGFicy5jb20xIDAeBgkqhkiG9w0BCQEWEWluZm9Ac25t
```
dismissed LLM, confidence 0.95 A PEM-encoded X.509 certificate test vector in an RFC 5280 test file.
Reasoning
Base64 DER certificate fixture in a pyasn1-style RFC 5280 test. The content is a legitimate X.509 structure, and the raw signal reflects only its encoding.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5280.py:139:1

base64-like blob (464 bytes over 8 lines, compression ratio 0.76) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIBVjCBwAIBATANBgkqhkiG9w0BAQUFADB+MQswCQYDVQQGEwJBVTETMBEGA1UE
CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk
MRUwEwYDVQQDEwxzbm1wbGFicy5jb20xIDAeBgkqhkiG9w0BCQEWEWluZm9Ac25t
```
dismissed LLM, confidence 0.95 A duplicate PEM-encoded X.509 certificate test vector in the RFC 5280 test file.
Reasoning
Same certificate fixture as line 55, duplicated in the same test file. It is a legitimate test vector with no execution or obfuscation role.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5280.py:226:1

base64-like blob (92 bytes over 2 lines, compression ratio 1.01) (raw pass, confidence 0.60)
```
    oraddress_pem_text = """\
MEMwK2EEEwJHQmIKEwhHT0xEIDQwMKIHEwVVSy5BQ4MHU2FsZm9yZKYFEwNSLUQx
FDASgAEBoQ0TC1N0ZXZlIEtpbGxl
"""
```
dismissed LLM, confidence 0.93 A short base64 ASN.1 X.400 OR-address test fixture.
Reasoning
Short base64 fragment of ASN.1 OR-address data in a test string. It is a small raw-pass encoding match with no decode or execution path.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5480.py:21:1

base64-like blob (1260 bytes over 20 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
    digicert_ec_cert_pem_text = """\
MIIDrDCCApSgAwIBAgIQCssoukZe5TkIdnRw883GEjANBgkqhkiG9w0BAQwFADBh
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
```
dismissed LLM, confidence 0.95 A DigiCert elliptic-curve certificate PEM test vector.
Reasoning
Base64 DigiCert EC certificate PEM in a test file. It is a real public certificate used as test data and is not executed or decoded at runtime.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5636.py:21:1

base64-like blob (2132 bytes over 30 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIGOgYJKoZIhvcNAQcCoIIGKzCCBicCAQMxDTALBglghkgBZQMEAgEwRQYKKoMajJpECgEB
AaA3BDUwMwQgTgtiLdByNcZGP/PPE1I2lvxDA/6bajEE4VAWF13N9E4YDzIwMTkxMjMxMTIw
MDAwWqCCBB0wggQZMIIDAaADAgECAhQLxXbZnuC+8r+RhlN0rgUga/of6TANBgkqhkiG9w0B
```
dismissed LLM, confidence 0.95 A PEM-encoded CMS structure used as an RFC 5636 test vector.
Reasoning
Multi-line base64 CMS/PKCS#7 blob in a test module. Its size and structure match ordinary ASN.1 test data, and the raw pass flags only the encoding.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5639.py:22:1

base64-like blob (628 bytes over 10 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
    brainpool_ec_cert_pem_text = """\
MIIB0jCCAXmgAwIBAgITPUXQAyl3ZE5iAHYGZYSp1FkqzTAKBggqhkjOPQQDAjA/
MQswCQYDVQQGEwJVUzELMAkGA1UECAwCVkExEDAOBgNVBAcMB0hlcm5kb24xETAP
BgNVBAoMCEJvZ3VzIENBMB4XDTE5MTIwOTIxNDM0NFoXDTIxMTIwODIxNDM0NFow
```
dismissed LLM, confidence 0.95 A Brainpool elliptic-curve certificate PEM test vector.
Reasoning
Base64 certificate PEM for a Brainpool EC test case. It is standard test data and not an obfuscated or executable payload.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5652.py:23:1

base64-like blob (1420 bytes over 19 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIEJQYJKoZIhvcNAQcCoIIEFjCCBBICAQMxCzAJBgUrDgMCGgUAMIIDAgYIKwYBBQUHDAKgggL0
BIIC8DCCAuwweDB2AgECBgorBgEEAYI3CgoBMWUwYwIBADADAgEBMVkwVwYJKwYBBAGCNxUUMUow
SAIBBQwZcGl0dWNoYTEuZW1lYS5ocHFjb3JwLm5ldAwMRU1FQVxwaXR1Y2hhDBpDTUNSZXFHZW5l
```
dismissed LLM, confidence 0.95 A PEM-encoded CMS message test vector for RFC 5652.
Reasoning
Base64 CMS blob in a test file with the expected ASN.1 header structure. It is test fixture data that the raw pass flags only because of its encoding.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5697.py:22:1

base64-like blob (2164 bytes over 34 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
    cert_pem_text = """\
MIIGUTCCBfegAwIBAgIUY8xt3l0B9nIPWSpjs0hDJUJZmCswCwYJYIZIAWUDBAMC
MD8xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJWQTEQMA4GA1UEBxMHSGVybmRvbjER
MA8GA1UEChMIQm9ndXMgQ0EwHhcNMTkxMjExMTczMzQ0WhcNMjAxMjEwMTczMzQ0
```
dismissed LLM, confidence 0.95 A PEM-encoded X.509 certificate test vector for RFC 5697.
Reasoning
Base64 certificate PEM in a test module for RFC 5697. It is a legitimate X.509 fixture with no decode or execution context.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5753.py:24:1

base64-like blob (2060 bytes over 33 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIGAwYJKoZIhvcNAQcDoIIF9DCCBfACAQIxgdihgdUCAQOgeKF2MBAGByqGSM49
AgEGBSuBBAAiA2IABGJ8n8NE7e0+gs36C3P+klXlvBXudwiw84lyW0U0pbo9U0Lz
tr6cknb+lbsRk21dXwHrK9ZW/SjBG+ONTvD+8P6+62xh2OO9lil5uSHmzDYNiTKn
```
dismissed LLM, confidence 0.95 A PEM-encoded CMS structure with EC key data used as an RFC 5753 test vector.
Reasoning
Base64 CMS/ECC blob in a test file. The structure is consistent with ASN.1 test data, and the finding reflects only the encoding pattern.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5915.py:21:1

base64-like blob (224 bytes over 4 lines, compression ratio 0.90) (raw pass, confidence 0.60)
```
    private_key_pem_text = """\
MIGkAgEBBDDLjzGbbLrR3T13lrrVum7WC/4Ua4Femc1RhhNVe1Q5XsArQ33kn9kx
3lOUfOcG+qagBwYFK4EEACKhZANiAAT4zZ8HL+xEDpXWkoWp5xFMTz4u4Ae1nF6z
XCYlmsEGD5vPu5hl9hDEjd1UHRgJIPoy3fJcWWeZ8FHCirICtuMgFisNscG/aTwK
```
dismissed LLM, confidence 0.95 A PEM-encoded EC private key test vector for RFC 5915.
Reasoning
Base64 EC private key PEM used as a test fixture for RFC 5915. Key material in a test suite is expected here, and the blob is not decoded or executed at runtime.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5916.py:22:1

base64-like blob (912 bytes over 15 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
    cert_pem_text = """\
MIICpzCCAiygAwIBAgIJAKWzVCgbsG5FMAoGCCqGSM49BAMDMD8xCzAJBgNVBAYT
AlVTMQswCQYDVQQIDAJWQTEQMA4GA1UEBwwHSGVybmRvbjERMA8GA1UECgwIQm9n
dXMgQ0EwHhcNMTkxMDMxMTQwMDE1WhcNMjAxMDMwMTQwMDE1WjB4MQswCQYDVQQG
```
dismissed LLM, confidence 0.95 A PEM-encoded X.509 certificate embedded as a test string in an RFC 5916 test.
Reasoning
Raw-pass base64 hit on a PEM certificate literal in an RFC test module. The text is an ordinary X.509 certificate with standard DER/ASN.1 structure, and the file is a test fixture, so this is an encoded test vector, not obfuscation.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5924.py:21:1

base64-like blob (872 bytes over 14 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
    cert_pem_text = """\
MIICiTCCAg+gAwIBAgIJAKWzVCgbsG5EMAoGCCqGSM49BAMDMD8xCzAJBgNVBAYT
AlVTMQswCQYDVQQIDAJWQTEQMA4GA1UEBwwHSGVybmRvbjERMA8GA1UECgwIQm9n
dXMgQ0EwHhcNMTkxMDMwMjEwMDM0WhcNMjAxMDI5MjEwMDM0WjBsMQswCQYDVQQG
```
dismissed LLM, confidence 0.95 A PEM-encoded certificate fixture in an RFC 5924 test module.
Reasoning
Same pattern as the other pyasn1-style RFC test files: a PEM certificate literal in a test with no execution, decoding into code, or network use. The base64 is standard ASN.1 content.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5934.py:199:1

base64-like blob (2228 bytes over 31 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
    tau_pem_text = """\
MIIGgwYJKoZIhvcNAQcCoIIGdDCCBnACAQMxDTALBglghkgBZQMEAgEwggFMBgpghkgBZQIB
Ak0DoIIBPASCATgwggE0MAiDAAIEXXp3kDCCASaiggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
ggEKAoIBAQDALMH2jTus/z881nG+uHQiB+xwQRX8q0DjB6rBw9if/tpMOr8/yNgoe0s2AcCs
```
dismissed LLM, confidence 0.95 A PEM-encoded CMS structure used as a test vector in an RFC 5934 test.
Reasoning
Raw-pass hit on a long PEM CMS/trust-anchor blob in a test file. The content is structured ASN.1 with standard headers, consistent with a protocol test vector.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5958.py:23:1

base64-like blob (156 bytes over 3 lines, compression ratio 0.95) (raw pass, confidence 0.60)
```
    priv_key_pem_text = """\
MHICAQEwBQYDK2VwBCIEINTuctv5E1hK1bbY8fdp+K06/nwoy/HU++CXqI9EdVhC
oB8wHQYKKoZIhvcNAQkJFDEPDA1DdXJkbGUgQ2hhaXJzgSEAGb9ECWmEzf6FQbrB
Z9w7lshQhqowtrbLDFw4rXAxZuE=
```
dismissed LLM, confidence 0.94 A PEM-encoded private key test vector in an RFC 5958 test.
Reasoning
Standard base64 of a PKCS#8 private key test fixture (OneAsymmetricKey with Ed25519 OID). It is a documented test value, and the file is a unit test that only parses it.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5958.py:50:1

base64-like blob (180 bytes over 3 lines, compression ratio 0.89) (raw pass, confidence 0.60)
```
    asymmetric_key_pkg_pem_text = """\
MIGEBgpghkgBZQIBAk4FoHYwdDByAgEBMAUGAytlcAQiBCDU7nLb+RNYStW22PH3
afitOv58KMvx1Pvgl6iPRHVYQqAfMB0GCiqGSIb3DQEJCRQxDwwNQ3VyZGxlIENo
YWlyc4EhABm/RAlphM3+hUG6wWfcO5bIUIaqMLa2ywxcOK1wMWbh
```
dismissed LLM, confidence 0.94 A PEM-encoded asymmetric key package fixture in an RFC 5958 test.
Reasoning
Another PKCS#8/asymmetric key package PEM fixture in a test module. The base64 decodes to ASN.1 structure with recognizable OIDs, so it is a protocol test vector rather than a dropper.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5990.py:21:1

base64-like blob (100 bytes over 2 lines, compression ratio 0.97) (raw pass, confidence 0.60)
```
    pem_text = """\
MEcGCyqGSIb3DQEJEAMOMDgwKQYHKIGMcQICBDAeMBkGCiuBBRCGSAksAQIwCwYJ
YIZIAWUDBAIBAgEQMAsGCWCGSAFlAwQBBQ==
"""
```
dismissed LLM, confidence 0.94 A short PEM-encoded ASN.1 structure used as a test vector in an RFC 5990 test.
Reasoning
Short base64 ASN.1 blob with CMS/RSA-KEM-style OIDs inside a PEM test string. It is a standard test vector in a test file, with no decoding-and-execution behavior.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc6010.py:20:31

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
class UnconstrainedCCCExtensionTestCase(unittest.TestCase):
    unconstrained_pem_text = "MB0GCCsGAQUFBwESBBEwDzANBgsqhkiG9w0BCRABAA=="

    def setUp(self):
```
dismissed LLM, confidence 0.94 A base64-encoded ASN.1 extension used as a fixture in an RFC 6010 test case.
Reasoning
A single-line base64 string holding a small DER extension structure, assigned to a variable in a unittest TestCase. It is a fixture for parsing a CCC extension and has no execution path.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc6031.py:21:1

base64-like blob (256 bytes over 4 lines, compression ratio 0.76) (raw pass, confidence 0.60)
```
    key_pkg_pem_text = """\
MIG7BgsqhkiG9w0BCRABGaCBqzCBqKBEMCMGCyqGSIb3DQEJEAwBMRQMElZpZ2ls
IFNlY3VyaXR5IExMQzAdBgsqhkiG9w0BCRAMAzEODAxQcmV0ZW5kIDA0OEEwYDBe
MFYwGwYLKoZIhvcNAQkQDBsxDAwKZXhhbXBsZUlEMTAVBgsqhkiG9w0BCRAMCjEG
```
dismissed LLM, confidence 0.94 A PEM-encoded key package test vector in an RFC 6031 test.
Reasoning
PEM-style base64 ASN.1 blob with standard OIDs in an RFC 6031 test. The content is a structured test vector, not an encoded payload.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc6032.py:21:1

base64-like blob (356 bytes over 6 lines, compression ratio 0.81) (raw pass, confidence 0.60)
```
    encrypted_key_pkg_pem_text = """\
MIIBBwYKYIZIAWUCAQJOAqCB+DCB9QIBAjCBzgYKYIZIAWUCAQJOAjAdBglghkgB
ZQMEASoEEN6HFteHMZ3DyeO35xIwWQOAgaCKTs0D0HguNzMhsLgiwG/Kw8OwX+GF
9/cZ1YVNesUTW/VsbXJcbTmFmWyfqZsM4DLBegIbrUEHQZnQRq6/NO4ricQdHApD
```
dismissed LLM, confidence 0.94 A PEM-encoded encrypted key package fixture in an RFC 6032 test.
Reasoning
Encrypted key package PEM fixture in an RFC 6032 test module. It is standard ASN.1 test data consumed by a parser test.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc6120.py:21:1

base64-like blob (1000 bytes over 16 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
    xmpp_server_cert_pem_text = """\
MIIC6DCCAm+gAwIBAgIJAKWzVCgbsG5DMAoGCCqGSM49BAMDMD8xCzAJBgNVBAYT
AlVTMQswCQYDVQQIDAJWQTEQMA4GA1UEBwwHSGVybmRvbjERMA8GA1UECgwIQm9n
dXMgQ0EwHhcNMTkxMDI0MjMxNjA0WhcNMjAxMDIzMjMxNjA0WjBNMQswCQYDVQQG
```
dismissed LLM, confidence 0.95 A PEM-encoded XMPP server certificate fixture in an RFC 6120 test.
Reasoning
Raw-pass base64 hit on a PEM certificate literal in an RFC 6120 (XMPP) test. The content is a normal X.509 certificate used as test input.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc6187.py:20:1

base64-like blob (880 bytes over 14 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
    cert_pem_text = """\
MIICkDCCAhegAwIBAgIJAKWzVCgbsG5BMAoGCCqGSM49BAMDMD8xCzAJBgNVBAYT
AlVTMQswCQYDVQQIDAJWQTEQMA4GA1UEBwwHSGVybmRvbjERMA8GA1UECgwIQm9n
dXMgQ0EwHhcNMTkxMDI0MTgyNjA3WhcNMjAxMDIzMTgyNjA3WjB0MQswCQYDVQQG
```
dismissed LLM, confidence 0.95 A PEM-encoded certificate fixture in an RFC 6187 test.
Reasoning
PEM certificate literal in an RFC 6187 test file, with the same structure as the other pyasn1-modules certificate fixtures. It is a benign test vector.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc6210.py:22:1

base64-like blob (780 bytes over 12 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
    pem_text = """\
MIICRQYLKoZIhvcNAQkQAQKgggI0MIICMAIBADGBwDCBvQIBADAmMBIxEDAOBgNVBAMMB0
NhcmxSU0ECEEY0a8eAAFa8EdNuLs1dcdAwDQYJKoZIhvcNAQEBBQAEgYCH70EpEikY7deb
859YJRAWfFondQv1D4NFltw6C1ceheWnlAU0C2WEXr3LUBXZp1/PSte29FnJxu5bXCTn1g
```
likely benign LLM, confidence 0.96 Embedded base64 PEM test fixture for an RFC 6210 test.
Reasoning
Raw-pass base64 signal on a PEM test vector in a test file for RFC 6210. The content is standard ASN.1/DER encoded certificate request data embedded as a fixture, which is expected in a PKI parsing test suite.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc6402.py:24:1

base64-like blob (1420 bytes over 19 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIEJQYJKoZIhvcNAQcCoIIEFjCCBBICAQMxCzAJBgUrDgMCGgUAMIIDAgYIKwYBBQUHDAKgggL0
BIIC8DCCAuwweDB2AgECBgorBgEEAYI3CgoBMWUwYwIBADADAgEBMVkwVwYJKwYBBAGCNxUUMUow
SAIBBQwZcGl0dWNoYTEuZW1lYS5ocHFjb3JwLm5ldAwMRU1FQVxwaXR1Y2hhDBpDTUNSZXFHZW5l
```
likely benign LLM, confidence 0.96 Embedded base64 PEM test fixture for an RFC 6402 test.
Reasoning
Raw-pass base64 signal on a PEM CMC test vector in a test file. The blob is structured DER data with recognizable OIDs, consistent with a legitimate RFC test fixture.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc6482.py:20:1

base64-like blob (2308 bytes over 33 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
    roa_pem_text = """\
MIIGvwYJKoZIhvcNAQcCoIIGsDCCBqwCAQMxDTALBglghkgBZQMEAgEwKgYLKoZIhvcNAQkQ
ARigGwQZMBcCAwDj+zAQMA4EAgABMAgwBgMEAJMcLaCCBLwwggS4MIIDoKADAgECAgIGGDAN
BgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyg2ZDZmYmZhOTc1M2RiOGQ4NDY0MzNkYjUzNTFk
```
likely benign LLM, confidence 0.96 Embedded base64 PEM test fixture for an RFC 6482 ROA test.
Reasoning
Raw-pass base64 signal on a ROA PEM test vector. The content is ASN.1 DER with standard OIDs and certificate structure, typical of RPKI parser test data.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc6487.py:84:1

base64-like blob (1616 bytes over 26 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
    rpki_cert_pem_text = """\
MIIEuDCCA6CgAwIBAgICBhgwDQYJKoZIhvcNAQELBQAwMzExMC8GA1UEAxMoNmQ2
ZmJmYTk3NTNkYjhkODQ2NDMzZGI1MzUxZDlhOWVjMDdjOTZiZDAeFw0xOTA4MjAw
MDQ5MjlaFw0yMDA3MDEwMDAwMDBaMDMxMTAvBgNVBAMTKDVCODNERDg3REU5QUM3
```
likely benign LLM, confidence 0.96 Embedded base64 PEM certificate fixture for an RFC 6487 test.
Reasoning
Raw-pass base64 signal on an RPKI certificate PEM fixture. The blob is valid-looking DER certificate data, and its base64 structure matches a legitimate test vector.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc6664.py:21:1

base64-like blob (768 bytes over 12 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
    smime_capabilities_pem_text = """\
MIICOjAJBgUrDgMCGgUAMA0GCWCGSAFlAwQCBAUAMA0GCWCGSAFlAwQCAQUAMA0G
CWCGSAFlAwQCAgUAMA0GCWCGSAFlAwQCAwUAMBUGCSqGSIb3DQEBATAIAgIEAAIC
EAAwFQYJKoZIhvcNAQEHMAgCAgQAAgIQADAVBgkqhkiG9w0BAQowCAICBAACAhAA
```
likely benign LLM, confidence 0.96 Embedded base64 PEM test fixture for an RFC 6664 test.
Reasoning
Raw-pass base64 signal on an S/MIME capabilities PEM fixture. The repeated structured DER pattern is consistent with a standard test vector rather than an encoded payload.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc6955.py:24:1

base64-like blob (1112 bytes over 18 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIDPDCCArsCAQAwTjELMAkGA1UEBhMCVVMxETAPBgNVBAoTCFhFVEkgSW5jMRAw
DgYDVQQLEwdUZXN0aW5nMRowGAYDVQQDExFQS0lYIEV4YW1wbGUgVXNlcjCCAkEw
ggG2BgcqhkjOPgIBMIIBqQKBgQCUhOBFbH9pUWI+VoB8aOfFqZ6edHSU7ZCMHcTh
```
likely benign LLM, confidence 0.96 Embedded base64 PEM test fixture for an RFC 6955 test.
Reasoning
Raw-pass base64 signal on a PEM key/certificate request fixture for RFC 6955. The content is DER-structured with recognizable OIDs and subject strings, consistent with a test vector.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc6960.py:23:1

base64-like blob (144 bytes over 2 lines, compression ratio 0.95) (raw pass, confidence 0.60)
```
    ocsp_req_pem_text = """\
MGowaDBBMD8wPTAJBgUrDgMCGgUABBS3ZrMV9C5Dko03aH13cEZeppg3wgQUkqR1LKSevoFE63n8
isWVpesQdXMCBDXe9M+iIzAhMB8GCSsGAQUFBzABAgQSBBBjdJOiIW9EKJGELNNf/rdA
"""
```
likely benign LLM, confidence 0.96 Embedded base64 PEM test fixture for an RFC 6960 OCSP test.
Reasoning
Raw-pass base64 signal on a small OCSP request PEM fixture. The short DER structure with standard OCSP OIDs is a typical test vector in a test file.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc7030.py:22:1

base64-like blob (92 bytes over 2 lines, compression ratio 0.91) (raw pass, confidence 0.60)
```
    pem_text = """\
MEEGCSqGSIb3DQEJBzASBgcqhkjOPQIBMQcGBSuBBAAiMBYGCSqGSIb3DQEJDjEJ
BgcrBgEBAQEWBggqhkjOPQQDAw==
"""
```
likely benign LLM, confidence 0.96 Embedded base64 PEM test fixture for an RFC 7030 test.
Reasoning
Raw-pass base64 signal on a short PEM fixture in an EST (RFC 7030) test. Structured DER with standard OIDs, consistent with a test vector.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc7292.py:22:1

base64-like blob (3360 bytes over 47 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
    pfx_pem_text = """\
MIIJ0wIBAzCCCY8GCSqGSIb3DQEHAaCCCYAEggl8MIIJeDCCBggGCSqGSIb3DQEHAaCCBfkE
ggX1MIIF8TCCBe0GCyqGSIb3DQEMCgECoIIE/jCCBPowHAYKKoZIhvcNAQwBAzAOBAjuq0/+
0pyutQICB9AEggTYZe/mYBpmkDvKsve4EwIVwo1TNv4ldyx1qHZW2Ih6qQCY+Nv1Mnv9we0z
```
likely benign LLM, confidence 0.96 Embedded base64 PEM PKCS#12 test fixture for an RFC 7292 test.
Reasoning
Raw-pass base64 signal on a PKCS#12 PEM fixture. The large DER structure with PKCS#12 OIDs is the expected content of a PFX test vector, not an obfuscated payload.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc7894.py:21:1

base64-like blob (928 bytes over 15 lines, compression ratio 0.78) (raw pass, confidence 0.60)
```
    otp_pem_text = """\
MIICsjCCAZwCAQAwJDELMAkGA1UEBhMCVVMxFTATBgNVBAMTDDRUUzJWMk5MWEE2
WjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKmF0oUj5+1rBB+pUO8X
7FPxer+1BhWOa54RTSucJmBaLx0H95qNaBCcctNDl1kcmIro/a0zMcEvj5Do29vQ
```
likely benign LLM, confidence 0.96 Embedded base64 PEM test fixture for an RFC 7894 test.
Reasoning
Raw-pass base64 signal on an OTP/PKI PEM fixture for RFC 7894. The DER structure and embedded subject strings indicate a legitimate test vector.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc7914.py:25:1

base64-like blob (308 bytes over 5 lines, compression ratio 0.86) (raw pass, confidence 0.60)
```
    pem_text = """\
MIHiME0GCSqGSIb3DQEFDTBAMB8GCSsGAQQB2kcECzASBAVNb3VzZQIDEAAAAgEI
AgEBMB0GCWCGSAFlAwQBKgQQyYmguHMsOwzGMPoyObk/JgSBkJb47EWd5iAqJlyy
+ni5ftd6gZgOPaLQClL7mEZc2KQay0VhjZm/7MbBUNbqOAXNM6OGebXxVp6sHUAL
```
likely benign LLM, confidence 0.96 Embedded base64 PEM test fixture for an RFC 7914 test.
Reasoning
Raw-pass base64 signal on a PEM fixture for RFC 7914 (scrypt parameters). The DER with PBKDF2/scrypt OIDs and a readable name fragment fits a standard test vector.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8017.py:81:1

base64-like blob (1660 bytes over 26 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIE2QIBAQKCAQEAn82EqwXasE2TFNSmZucB8LNza2mOWLHF3nxpxKXalPMDvezc
5Dq7Ytcv/k9jJL4j4jYfvR4yyZdU9iHLaD6hOINZ8E6hVpx/4c96ZUSOLzD2g+u+
jIuoNfG+zygSBGYCS6BLCAIsZ+2wUyxYpLJknHJld9/jy+aLmmyrilhH9dH5AUiV
```
likely benign LLM, confidence 0.95 A multi-line PEM RSA private key literal used as a test fixture.
Reasoning
Raw-pass base64 blob is a PEM-encoded RSA private key inside a test module named after an RFC test vector. Test fixtures like this are expected in a cryptographic ASN.1 test suite, and nothing in the snippet suggests execution or hidden payloads.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8018.py:21:1

base64-like blob (116 bytes over 2 lines, compression ratio 1.01) (raw pass, confidence 0.60)
```
    rfc3211_ex1_pem_text = """\
o1MCAQCgGgYJKoZIhvcNAQUMMA0ECBI0Vnh4VjQSAgEFMCAGCyqGSIb3DQEJEAMJMBEGBSsO
AwIHBAjv5ZjvIbM9bQQQuBslZe43PKbe3KJqF4sMEA==
"""
```
likely benign LLM, confidence 0.95 A PEM-encoded PBES2/PKCS#5 structure used as a test vector.
Reasoning
Raw-pass base64 is a PEM-encoded PKCS#5/PBES structure embedded as a string constant in an RFC 8018 test file. This is standard test data for ASN.1 decoding, not obfuscation.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8103.py:20:24

base64-like blob (40 bytes, compression ratio 1.27) (raw pass, confidence 0.60)
```
class CAEADChaCha20Poly1305TestCase(unittest.TestCase):
    alg_id_pem_text = "MBsGCyqGSIb3DQEJEAMSBAzK/rq++s7brd7K+Ig="

    def setUp(self):
```
likely benign LLM, confidence 0.95 A short base64-encoded AlgorithmIdentifier constant in a unit test.
Reasoning
Short base64 string decodes to a DER AlgorithmIdentifier for ChaCha20-Poly1305 and is assigned to a test class attribute. It is a small ASN.1 test vector with no execution or decoding logic around it.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8209.py:21:1

base64-like blob (528 bytes over 9 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
    cert_pem_text = """\
MIIBiDCCAS+gAwIBAgIEAk3WfDAKBggqhkjOPQQDAjAaMRgwFgYDVQQDDA9ST1VU
RVItMDAwMEZCRjAwHhcNMTcwMTAxMDUwMDAwWhcNMTgwNzAxMDUwMDAwWjAaMRgw
FgYDVQQDDA9ST1VURVItMDAwMEZCRjAwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNC
```
likely benign LLM, confidence 0.95 A PEM-encoded X.509 certificate used as a test fixture.
Reasoning
Base64 blob is a PEM certificate literal in an RFC 8209 test file. It is expected fixture content for certificate parsing tests.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8226.py:55:1

base64-like blob (884 bytes over 14 lines, compression ratio 0.75) (raw pass, confidence 0.60)
```
    cert_pem_text = """\
MIICkTCCAhegAwIBAgIJAKWzVCgbsG4+MAoGCCqGSM49BAMDMD8xCzAJBgNVBAYT
AlVTMQswCQYDVQQIDAJWQTEQMA4GA1UEBwwHSGVybmRvbjERMA8GA1UECgwIQm9n
dXMgQ0EwHhcNMTkwNzE4MTUwNzQ5WhcNMjAwNzE3MTUwNzQ5WjBxMQswCQYDVQQG
```
likely benign LLM, confidence 0.95 A PEM-encoded X.509 certificate used as a test fixture.
Reasoning
Base64 blob is a PEM certificate literal in an RFC 8226 test file. This is typical certificate test data for an ASN.1 library.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8358.py:22:1

base64-like blob (3200 bytes over 45 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
"""\
MIIJWgYJKoZIhvcNAQcCoIIJSzCCCUcCAQMxDTALBglghkgBZQMEAgEwDQYLKoZIhvcNAQkQ
ARugggZ0MIIGcDCCBVigAwIBAgIRANa58hQvZ26svTWQaGtqo/YwDQYJKoZIhvcNAQELBQAw
gZcxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcT
```
likely benign LLM, confidence 0.95 A large PEM-encoded CMS structure with certificates used as test data.
Reasoning
Base64 blob is a PEM-encoded CMS/PKCS#7 signed structure with embedded certificates, held in a test module for RFC 8358. Such encoded test vectors are expected in this kind of test suite.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8358.py:69:1

base64-like blob (3200 bytes over 45 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
"""\
MIIJWgYJKoZIhvcNAQcCoIIJSzCCCUcCAQMxDTALBglghkgBZQMEAgEwDQYLKoZIhvcNAQkQ
ARygggZ0MIIGcDCCBVigAwIBAgIRANa58hQvZ26svTWQaGtqo/YwDQYJKoZIhvcNAQELBQAw
gZcxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcT
```
likely benign LLM, confidence 0.95 A second PEM-encoded CMS test vector variant in the same test module.
Reasoning
Same PEM-encoded CMS test vector as the neighboring finding, differing only by a byte or two. It is test data in an RFC 8358 test file with no executable behavior.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8358.py:116:1

base64-like blob (3200 bytes over 45 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
"""\
MIIJWgYJKoZIhvcNAQcCoIIJSzCCCUcCAQMxDTALBglghkgBZQMEAgEwDQYLKoZIhvcNAQkQ
AR2gggZ0MIIGcDCCBVigAwIBAgIRANa58hQvZ26svTWQaGtqo/YwDQYJKoZIhvcNAQELBQAw
gZcxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcT
```
likely benign LLM, confidence 0.95 A third PEM-encoded CMS test vector variant in the same test module.
Reasoning
Another PEM-encoded CMS test vector variant in the RFC 8358 test file. It is fixture data and the snippet shows no decoding or execution path.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8398.py:19:17

base64-like blob (48 bytes, compression ratio 1.23) (raw pass, confidence 0.60)
```
class EAITestCase(unittest.TestCase):
    pem_text = "oCAGCCsGAQUFBwgJoBQMEuiAgeW4q0BleGFtcGxlLmNvbQ=="

    def setUp(self):
```
likely benign LLM, confidence 0.95 A short base64-encoded ASN.1 structure used as a unit-test constant.
Reasoning
Short base64 string decodes to a DER-encoded SAN/OtherName structure assigned as a test attribute in an RFC 8398 test. This is an ASN.1 fixture, not obfuscated code.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8418.py:20:34

base64-like blob (40 bytes, compression ratio 1.27) (raw pass, confidence 0.60)
```
class KeyAgreeAlgTestCase(unittest.TestCase):
    key_agree_alg_id_pem_text = "MBoGCyqGSIb3DQEJEAMUMAsGCWCGSAFlAwQBLQ=="

    def setUp(self):
```
likely benign LLM, confidence 0.95 A short base64-encoded AlgorithmIdentifier constant in a unit test.
Reasoning
Short base64 string decodes to a DER AlgorithmIdentifier for a key agreement algorithm, stored as a test class attribute in an RFC 8418 test. It is standard ASN.1 test data.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8479.py:23:1

base64-like blob (1712 bytes over 27 lines, compression ratio 0.78) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIE/gIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCpPwXwfhDsWA3q
jN2BWg1xfDjvZDVNfgTV/b95g304Aty3z13xPXAhHZ3ROW3pgPxTj9fiq7ZMy4Ua
gMpPK81v3pHX1uokC2KcGXbgbAq2Q8ClxSXgEJllRwDENufjEdV10gArt8NlIP0N
```
likely benign LLM, confidence 0.95 A PEM-encoded PKCS#8 private key used as a test fixture.
Reasoning
Base64 blob is a PEM-encoded PKCS#8 private key literal in an RFC 8479 test file. It is test fixture data for key-parsing tests.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8494.py:19:1

base64-like blob (420 bytes over 7 lines, compression ratio 0.83) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIBNqADAgEAMIIBLaADAgEZoIIBJASCASB4nG2P0U7CQBBF3/cr5l2K3YpSF5YA
bYmbWArtQsJjKVuogd1mO0T8e0ti1IjJZB4md07OHZbWnMbqkp/qo+oW5jSCWDqL
VCSpkBveg2kSbrg/FTIWcQRpJPlLmGYQzdci5MvlA+3Rx2cyREO/KVrhCOaJFLMN
```
likely benign LLM, confidence 0.93 A PEM-encoded test certificate or ASN.1 structure embedded as a string in a test for RFC 8494.
Reasoning
This is a raw-pass base64 signal on a PEM-formatted block in a test file named after RFC 8494. The snippet is a DER-encoded structure in PEM armor, the kind of fixture a parser test uses. Raw findings have a high false-positive rate, and nothing here is executed, decoded into code, or tied to a dropper pattern. The file context points to a legitimate test vector.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8520.py:21:1

base64-like blob (1788 bytes over 28 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
    mud_cert_pem_text = """\
MIIFODCCAyCgAwIBAgICEEAwDQYJKoZIhvcNAQELBQAwZTELMAkGA1UEBhMCQ0gx
DzANBgNVBAgMBlp1cmljaDERMA8GA1UEBwwIV2V0emlrb24xEDAOBgNVBAoMB0lt
UmlnaHQxIDAeBgNVBAMMF0ltUmlnaHQgVGVzdCA4MDIuMUFSIENBMB4XDTE5MDUw
```
likely benign LLM, confidence 0.93 A PEM-encoded MUD test certificate embedded as a multiline string literal in a test file.
Reasoning
This is a raw-pass base64 signal on a PEM certificate block in a test named for RFC 8520 (MUD). The content includes readable X.509 subject strings such as 'ImRight Test 802.1AR CA', which indicates a test certificate fixture. The blob is long but is only a data literal consumed by a test. No decode-and-execute behavior is shown, and the file context supports a legitimate pattern.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/pyasn1/pyasn1-modules pyasn1-modules && cd pyasn1-modules
git checkout v0.4.2
disclude scan --severity info --diff v0.4.1 .