pyasn1-modules 0.4.2

Source: https://github.com/pyasn1/pyasn1-modules
Tag scanned: v0.4.2
Compared with: v0.4.1 (0 signals introduced since)
Files: 276 scanned, 4 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 6 warn · 100 info
Scan time: 65.6 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): the 100 most severe of 106 warn and critical signals (100 with a verdict); 100 demoted to info. The rest are unreviewed.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 00:23

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

warn encoding-base64 tests/test_rfc8649.py:21:1

base64-like blob (132 bytes over 3 lines, compression ratio 0.96) (raw pass, confidence 0.60)

    extn_pem_text = """\
MGEGCisGAQQBg5IbAgEEUzBRMA0GCWCGSAFlAwQCAwUABEBxId+rK+WVDLOda2Yk
FFRbqQAztXhs91j/RxHjYJIv/3gleQg3Qix/yQy2rIg3xysjCvHWw8AuYOGVh/sL
GANG

warn encoding-base64 tests/test_rfc8696.py:25:1

base64-like blob (872 bytes over 13 lines, compression ratio 0.77) (raw pass, confidence 0.60)

    key_trans_psk_pem_text = """\
MIICigYLKoZIhvcNAQkQARegggJ5MIICdQIBADGCAiekggIjBgsqhkiG9w0BCRANATCCAhIC
AQAEE3B0Zi1rbWM6MTM2MTQxMjIxMTIwDQYLKoZIhvcNAQkQAx0wCwYJYIZIAWUDBAEtMIIB
sDCCAawCAQKAFJ7rZ8m5WnTUTS8WOWaA6AG1y6ScMA0GCSqGSIb3DQEBAQUABIIBgKo/Hkhu

warn encoding-base64 tests/test_rfc8696.py:109:1

base64-like blob (444 bytes over 7 lines, compression ratio 0.77) (raw pass, confidence 0.60)

    key_agree_psk_pem_text = """\
MIIBRwYLKoZIhvcNAQkQARegggE2MIIBMgIBADGB5aSB4gYLKoZIhvcNAQkQDQIwgdICAQAE
FHB0Zi1rbWM6MjE2ODQwMTEwMTIxoFWhUzATBgYrgQQBCwEGCWCGSAFlAwQBLQM8AAQ5G0Em
Jk/2ks8sXY1kzbuG3Uu3ttWwQRXALFDJICjvYfr+yTpOQVkchm88FAh9MEkw4NKctokKNgps

warn encoding-base64 tests/test_rfc8702.py:54:1

base64-like blob (1256 bytes over 20 lines, compression ratio 0.73) (raw pass, confidence 0.60)

    auth_message_pem_text = """\
MIIDqgYLKoZIhvcNAQkQAQKgggOZMIIDlQIBADGCAk8wggJLAgEAMDMwJjEUMBIG
A1UECgwLZXhhbXBsZS5jb20xDjAMBgNVBAMMBUFsaWNlAgkAg/ULtwvVxA4wDQYJ
KoZIhvcNAQEBBQAEggIAdZphtN3x8a8kZoAFY15HYRD6JyPBueRUhLbTPoOH3pZ9

warn encoding-base64 tests/test_rfc8708.py:23:1

base64-like blob (112 bytes over 2 lines, compression ratio 1.03) (raw pass, confidence 0.60)

    public_key_pem_text = """\
MFAwDQYLKoZIhvcNAQkQAxEDPwAEPAAAAAIAAAAGAAAAA9CPq9SiCR/wqMtO2DTn
RTQypYiFzZugQxI1Rmv/llHGySEkQE1F+lPPFhwo8a1ajg==
"""

warn encoding-base64 tests/test_rfc8708.py:44:1

base64-like blob (3588 bytes over 60 lines, compression ratio 0.76) (raw pass, confidence 0.60)

    signed_data_pem_text = """\
MIIKfQYJKoZIhvcNAQcCoIIKbjCCCmoCAQMxADAtBgkqhkiG9w0BBwGgIAQe
VGhpcyBpcyBzb21lIHNhbXBsZSBjb250ZW50Lg0KMYIKMjCCCi4CAQOABkhp
TW9tITALBglghkgBZQMEAgGgMTAvBgkqhkiG9w0BCQQxIgQgF6DPgklChkQZ

info ~~warn~~ → info by review encoding-base64 tests/test_pem.py:15:1

base64-like blob (1032 bytes over 17 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIDATCCAekCAQAwgZkxCzAJBgNVBAYTAlJVMRYwFAYDVQQIEw1Nb3Njb3cgUmVn
aW9uMQ8wDQYDVQQHEwZNb3Njb3cxGjAYBgNVBAoTEVNOTVAgTGFib3JhdG9yaWVz
MQwwCgYDVQQLFANSJkQxFTATBgNVBAMTDHNubXBsYWJzLmNvbTEgMB4GCSqGSIb3
```
likely benign LLM, confidence 0.93 A PEM-encoded certificate request embedded as a test fixture.
Reasoning
Raw-pass base64 signal on a PEM certificate request literal in a test file. The content is a standard ASN.1/X.509 structure with recognizable Subject fields (SNMP Labs), which is what a PEM parsing test needs. Nothing executes or hides code.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc2314.py:19:1

base64-like blob (1032 bytes over 17 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIDATCCAekCAQAwgZkxCzAJBgNVBAYTAlJVMRYwFAYDVQQIEw1Nb3Njb3cgUmVn
aW9uMQ8wDQYDVQQHEwZNb3Njb3cxGjAYBgNVBAoTEVNOTVAgTGFib3JhdG9yaWVz
MQwwCgYDVQQLFANSJkQxFTATBgNVBAMTDHNubXBsYWJzLmNvbTEgMB4GCSqGSIb3
```
likely benign LLM, confidence 0.93 A PEM-encoded RFC 2314 test certificate in a test module.
Reasoning
Same pattern as the other RFC test fixtures: a base64 PEM blob in a test file, decodable as ASN.1 DER with readable Subject text. The raw pass has a high false-positive rate on such data, and the file's purpose is standards conformance testing.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc2437.py:19:1

base64-like blob (428 bytes over 7 lines, compression ratio 0.83) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIBPAIBAAJBAMfAjvBNDDYBCl1w3yNcagZkPhqd0q5KqeOTgKSLuJWfe5+VSeR5
Y1PcF3DyH8dvS3t8PIQjxJLoKS7HVRlsfhECAwEAAQJBAIr93/gxhIenXbD7MykF
yvi7k8MtgkWoymICZwcX+c6RudFyuPPfQJ/sf6RmFZlRA9X9CQm5NwVG7+x1Yi6t
```
likely benign LLM, confidence 0.93 A PEM-encoded RSA key used as a test vector.
Reasoning
The base64 blob is an RSA private key in PEM form used as a parser test vector. Test keys like this are expected in cryptographic library test suites and are not an obfuscated payload.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc2459.py:64:1

base64-like blob (464 bytes over 8 lines, compression ratio 0.76) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIBVjCBwAIBATANBgkqhkiG9w0BAQUFADB+MQswCQYDVQQGEwJBVTETMBEGA1UE
CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk
MRUwEwYDVQQDEwxzbm1wbGFicy5jb20xIDAeBgkqhkiG9w0BCQEWEWluZm9Ac25t
```
likely benign LLM, confidence 0.92 A PEM certificate fixture from RFC 2459 conformance tests.
Reasoning
A base64 DER certificate in a test file, with readable issuer strings in the decoded prefix. It matches the RFC 2459 conformance fixtures, so there is no sign of hidden or malicious content.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc2459.py:101:1

base64-like blob (596 bytes over 10 lines, compression ratio 0.81) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIBugIBAAKBgQCN91+Cma8UPw09gjwP9WOJCdpv3mv3/qFqzgiODGZx0Q002iTl
1dq36m5TsWYFEcMCEyC3tFuoQ0mGq5zUUOmJvHCIPufs0g8Av0fhY77uFqneHHUi
VQMCPCHX9vTCWskmDE21LJppU27bR4H2q+ysE30d6u3+84qrItsn4bjpcQIVAPR5
```
likely benign LLM, confidence 0.92 A second PEM test vector in the RFC 2459 test module.
Reasoning
Another base64 DER fixture in the same RFC 2459 test file, with a DSA-style structure. It is test data for parsing, not an executable or encoded dropper.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc2511.py:19:1

base64-like blob (564 bytes over 9 lines, compression ratio 0.80) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIBozCCAZ8wggEFAgUAwTnj2jCByoABAqURMA8xDTALBgNVBAMTBHVzZXKmgZ8w
DQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJ6ZQ2cYbn/lFsmBOlRltbRbFQUvvE0Q
nbopOu1kC7Bmaaz7QTx8nxeiHi4m7uxCbGGxHNoGCt7EmdG8eZUBNAcHyGlXrJdm
```
likely benign LLM, confidence 0.92 A base64 ASN.1 test blob for RFC 2511 parsing.
Reasoning
Base64-encoded ASN.1 attribute certificate data inside a test module for the RFC 2511 schema. It is structured test data with no decoding or execution logic in the snippet.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc2560.py:19:1

base64-like blob (144 bytes over 2 lines, compression ratio 0.95) (raw pass, confidence 0.60)
```
    pem_text = """\
MGowaDBBMD8wPTAJBgUrDgMCGgUABBS3ZrMV9C5Dko03aH13cEZeppg3wgQUkqR1LKSevoFE63n8
isWVpesQdXMCBDXe9M+iIzAhMB8GCSsGAQUFBzABAgQSBBBjdJOiIW9EKJGELNNf/rdA
"""
```
likely benign LLM, confidence 0.93 A base64 OCSP response fixture for RFC 2560 tests.
Reasoning
A short OCSP response encoded as base64 in a test file. OCSP fixtures like this are normal in X.509 parser test suites and show ASN.1 structure rather than an obfuscated payload.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc2631.py:20:17

base64-like blob (44 bytes, compression ratio 1.07) (raw pass, confidence 0.60)
```
class OtherInfoTestCase(unittest.TestCase):
    pem_text = "MB0wEwYLKoZIhvcNAQkQAwYEBAAAAAGiBgQEAAAAwA=="

    def setUp(self):
```
likely benign LLM, confidence 0.93 A short base64 ASN.1 structure used in an RFC 2631 unit test.
Reasoning
A 44-byte base64 Diffie-Hellman key-agreement structure assigned to a test variable in a unittest class. It is too small and structured to be a payload, and the file context is a standards test.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc2634.py:85:1

base64-like blob (1668 bytes over 27 lines, compression ratio 0.70) (raw pass, confidence 0.60)
```
    signed_receipt_pem_text = """\
MIIE3gYJKoZIhvcNAQcCoIIEzzCCBMsCAQMxDTALBglghkgBZQMEAgEwga4GCyq
GSIb3DQEJEAEBoIGeBIGbMIGYAgEBBgkqhkiG9w0BBwEEIMdPIQ9kJ1cI9Q6HkR
CzbXWdD331uAUCL3MMFXP4KFOjBGYwZAIwOLV5WCbYjy5HLHE69IqXQQHVDJQzm
```
likely benign LLM, confidence 0.93 A base64 signed-receipt test fixture for RFC 2634.
Reasoning
A base64 CMS/ESS signed receipt blob as a test vector. The decoded structure follows the ASN.1 patterns of signed-message fixtures, and it is consistent with testing the RFC 2634 parser.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc2876.py:30:1

base64-like blob (2952 bytes over 47 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
    env_data_pem_text = """\
MIIIogYJKoZIhvcNAQcDoIIIkzCCCI8CAQKgggKRoIICjTCCAokwggIwoAMCAQIC
FGPMbd5dAfZyD1kqY7NIQyVCWZgqMAkGByqGSM44BAMwPzELMAkGA1UEBhMCVVMx
CzAJBgNVBAgTAlZBMRAwDgYDVQQHEwdIZXJuZG9uMREwDwYDVQQKEwhCb2d1cyBD
```
likely benign LLM, confidence 0.93 A large base64 CMS environment-data fixture for RFC 2876 tests.
Reasoning
A large base64 CMS envelope containing a certificate chain, used as environment data in a test. Its size and ASN.1 structure match conformance test material, not a dropper.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc2986.py:22:1

base64-like blob (952 bytes over 15 lines, compression ratio 0.78) (raw pass, confidence 0.60)
```
    pem_text = """\
MIICxjCCAa4CAQAwgYAxCzAJBgNVBAYTAlVTMR0wGwYDVQQDDBRmY3UuZmFrZS5h
ZGRyZXNzLm9yZzEXMBUGA1UEBwwOUGxlYXNhbnQgR3JvdmUxHDAaBgNVBAoME0Zh
a2UgQ29tcGFueSBVbml0ZWQxDTALBgNVBAgMBFV0YWgxDDAKBgNVBAsMA0VuZzCC
```
likely benign LLM, confidence 0.93 A synthetic PKCS#10 certificate request used in RFC 2986 tests.
Reasoning
A base64 PKCS#10 certificate request with readable subject fields (fake.address.org) in a test module. The placeholder names show it is a synthetic test fixture.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3058.py:26:1

base64-like blob (1888 bytes over 30 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
    env_data_pem_text = """\
MIIFgwYJKoZIhvcNAQcDoIIFdDCCBXACAQIxXaJbAgEEMCMEEDiCUYXKXu8SzLos
n2xeYP4YDzIwMTkwOTEyMTIwMDAwWjAPBgsrBgEEAYE8BwEBBgUABCB0G/YBGH3L
3RhoG0mK33M8IvRYAOsnHB5MfUAOGF6kuDCCBQoGCSqGSIb3DQEHATAZBgsrBgEE
```
likely benign LLM, confidence 0.93 A large base64 CMS timestamp fixture for RFC 3058 tests.
Reasoning
A large base64 CMS structure with timestamp and signature content used as test data for RFC 3058. It is a parser fixture in a test directory, with no execution path shown.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3161.py:20:1

base64-like blob (120 bytes over 2 lines, compression ratio 1.01) (raw pass, confidence 0.60)
```
    tsp_query_pem_text = """\
MFYCAQEwUTANBglghkgBZQMEAgMFAARAGu1DauxDZZv8F7l4EKIbS00U40mUKfBW5C0giEz0
t1zOHCvK4A8i8zxwUXFHv4pAJZE+uFhZ+v53HTg9rLjO5Q==
"""
```
likely benign LLM, confidence 0.93 A base64 timestamp request fixture for RFC 3161 tests.
Reasoning
A short base64 RFC 3161 timestamp query in a test file. It is a standard protocol message used as a fixture and carries no obfuscation markers.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3161.py:38:1

base64-like blob (1780 bytes over 25 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
    tsp_response_pem_text = """\
MIIFMTADAgEAMIIFKAYJKoZIhvcNAQcCoIIFGTCCBRUCAQMxCzAJBgUrDgMCGgUAMIIBowYL
KoZIhvcNAQkQAQSgggGSBIIBjjCCAYoCAQEGBCoDBAEwUTANBglghkgBZQMEAgMFAARAGu1D
auxDZZv8F7l4EKIbS00U40mUKfBW5C0giEz0t1zOHCvK4A8i8zxwUXFHv4pAJZE+uFhZ+v53
```
dismissed LLM, confidence 0.95 Embedded PEM test vector for an RFC 3161 timestamp response.
Reasoning
The blob is a PEM-encoded RFC 3161 timestamp response inside a test module, a standard fixture for parsing ASN.1 structures. Base64 encoding of DER data is the expected format here, and the raw-pass signal is generic.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3274.py:22:1

base64-like blob (668 bytes over 11 lines, compression ratio 0.81) (raw pass, confidence 0.60)
```
    compressed_data_pem_text = """\
MIIB7wYLKoZIhvcNAQkQAQmgggHeMIIB2gIBADANBgsqhkiG9w0BCRADCDCCAcQG
CSqGSIb3DQEHAaCCAbUEggGxeJxVksGO1DAQRO/+ir4xK4VlNSAhcUPRrgRiLgw/
0Il7Egu7bdntMOHraSezMJyixOWq19XpIwuxvP2xJvoEQld5lzw6Nub7Sw/vjx8/
```
dismissed LLM, confidence 0.95 Embedded PEM test vector for a CMS compressed-data structure.
Reasoning
This is a PEM-encoded CMS compressed-data structure used as a test fixture in an ASN.1 test suite. It is ordinary encoded test data, not a payload or obfuscated code.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3279.py:23:1

base64-like blob (1692 bytes over 27 lines, compression ratio 0.70) (raw pass, confidence 0.60)
```
    rsa_cert_pem_text = """\
MIIE8TCCA9mgAwIBAgIQbyXcFa/fXqMIVgw7ek/H+DANBgkqhkiG9w0BAQUFADBv
MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFk
ZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBF
```
dismissed LLM, confidence 0.95 Embedded PEM test vector for an RSA X.509 certificate.
Reasoning
This is a PEM-encoded RSA certificate in a test file for RFC 3279 certificate parsing. Certificate fixtures are normally embedded as base64 text.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3279.py:96:1

base64-like blob (1260 bytes over 20 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
    ec_cert_pem_text = """\
MIIDrDCCApSgAwIBAgIQCssoukZe5TkIdnRw883GEjANBgkqhkiG9w0BAQwFADBh
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
```
dismissed LLM, confidence 0.95 Embedded PEM test vector for an EC X.509 certificate.
Reasoning
This is a PEM-encoded EC certificate used as a parser test fixture. The base64 content is expected for this kind of test data.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3279.py:159:1

base64-like blob (1252 bytes over 20 lines, compression ratio 0.75) (raw pass, confidence 0.60)
```
    dsa_cert_pem_text = """\
MIIDpjCCA0ygAwIBAgIUY8xt3l0B9nIPWSpjs0hDJUJZmCkwCwYJYIZIAWUDBAMC
MD8xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJWQTEQMA4GA1UEBxMHSGVybmRvbjER
MA8GA1UEChMIQm9ndXMgQ0EwHhcNMTkxMDIwMjAxMjMwWhcNMjAxMDE5MjAxMjMw
```
dismissed LLM, confidence 0.95 Embedded PEM test vector for a DSA X.509 certificate.
Reasoning
This is a PEM-encoded DSA certificate in a test fixture. It matches the structure of other certificate test vectors in the same file.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3279.py:235:1

base64-like blob (876 bytes over 14 lines, compression ratio 0.76) (raw pass, confidence 0.60)
```
    kea_cert_pem_text = """\
MIICizCCAjOgAwIBAgIUY8xt3l0B9nIPWSpjs0hDJUJZmCgwCQYHKoZIzjgEAzA/
MQswCQYDVQQGEwJVUzELMAkGA1UECBMCVkExEDAOBgNVBAcTB0hlcm5kb24xETAP
BgNVBAoTCEJvZ3VzIENBMB4XDTE5MTAyMDIwMDkyMVoXDTIwMTAxOTIwMDkyMVow
```
dismissed LLM, confidence 0.95 Embedded PEM test vector for a key-agreement certificate.
Reasoning
This is a PEM-encoded key-agreement certificate used as a test vector for ASN.1 parsing. The base64 is the normal encoding for such fixtures.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3279.py:309:1

base64-like blob (1612 bytes over 26 lines, compression ratio 0.76) (raw pass, confidence 0.60)
```
    dh_cert_pem_text = """\
MIIEtDCCBFqgAwIBAgIUY8xt3l0B9nIPWSpjs0hDJUJZmCkwCwYJYIZIAWUDBAMC
MD8xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJWQTEQMA4GA1UEBxMHSGVybmRvbjER
MA8GA1UEChMIQm9ndXMgQ0EwHhcNMTkxMDIwMjAxMjMwWhcNMjAxMDE5MjAxMjMw
```
dismissed LLM, confidence 0.95 Embedded PEM test vector for a DH X.509 certificate.
Reasoning
This is a PEM-encoded DH certificate in a test file. It is standard test data for certificate parsing.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3280.py:53:1

base64-like blob (464 bytes over 8 lines, compression ratio 0.76) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIBVjCBwAIBATANBgkqhkiG9w0BAQUFADB+MQswCQYDVQQGEwJBVTETMBEGA1UE
CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk
MRUwEwYDVQQDEwxzbm1wbGFicy5jb20xIDAeBgkqhkiG9w0BCQEWEWluZm9Ac25t
```
dismissed LLM, confidence 0.95 Embedded PEM test vector for an X.509 certificate.
Reasoning
This is a short PEM-encoded certificate in an RFC 3280 test module. Base64 text of this kind is expected in ASN.1 test fixtures.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3370.py:26:1

base64-like blob (1900 bytes over 30 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
    env_data_pem_text = """\
MIIFjAYJKoZIhvcNAQcDoIIFfTCCBXkCAQIxZqJkAgEEMCMEEH744tkBAA6gplAQ
nKYxCF8YDzIwMTkwOTEyMTIwMDAwWjAQBgsqhkiG9w0BCRADBwIBOgQocOaZ+1cB
94MzMPtx6HyFpCC9yZrwXSKvWg5I018xOJhsuq+0so1PNTCCBQoGCSqGSIb3DQEH
```
dismissed LLM, confidence 0.95 Embedded PEM test vector for a CMS enveloped-data structure.
Reasoning
This is a PEM-encoded CMS enveloped-data structure used as an RFC 3370 test vector. It is static test data with no execution or hidden logic.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3370.py:120:1

base64-like blob (1252 bytes over 20 lines, compression ratio 0.75) (raw pass, confidence 0.60)
```
    dsa_cert_pem_text = """\
MIIDpjCCA0ygAwIBAgIUY8xt3l0B9nIPWSpjs0hDJUJZmCkwCwYJYIZIAWUDBAMC
MD8xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJWQTEQMA4GA1UEBxMHSGVybmRvbjER
MA8GA1UEChMIQm9ndXMgQ0EwHhcNMTkxMDIwMjAxMjMwWhcNMjAxMDE5MjAxMjMw
```
dismissed LLM, confidence 0.95 Embedded PEM test vector for a DSA X.509 certificate.
Reasoning
This is a PEM-encoded DSA certificate in a test fixture, the same certificate that appears in other test files in this suite. It is ordinary test data.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3447.py:22:1

base64-like blob (1660 bytes over 26 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIE2QIBAQKCAQEAn82EqwXasE2TFNSmZucB8LNza2mOWLHF3nxpxKXalPMDvezc
5Dq7Ytcv/k9jJL4j4jYfvR4yyZdU9iHLaD6hOINZ8E6hVpx/4c96ZUSOLzD2g+u+
jIuoNfG+zygSBGYCS6BLCAIsZ+2wUyxYpLJknHJld9/jy+aLmmyrilhH9dH5AUiV
```
dismissed LLM, confidence 0.95 Embedded PEM test vector for an RSA private key.
Reasoning
This is a PEM-encoded RSA private key in a test file for RFC 3447 (PKCS#1). Test suites commonly embed throwaway keys for parsing tests, and the raw-pass match is generic base64.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3560.py:35:29

base64-like blob (84 bytes, compression ratio 0.96) (raw pass, confidence 0.60)
```
class OAEPSHA256TestCase(unittest.TestCase):
    oaep_sha256_pem_text = "MDwGCSqGSIb3DQEBBzAvoA8wDQYJYIZIAWUDBAIBBQChHDAaBgkqhkiG9w0BAQgwDQYJYIZIAWUDBAIBBQA="

    def setUp(self):
```
dismissed LLM, confidence 0.93 Short base64 test vector for an RSAES-OAEP algorithm identifier.
Reasoning
This is a short base64 string encoding a DER RSAES-OAEP algorithm identifier, assigned to a test-case attribute. It is a small static ASN.1 fixture with no decoding or execution path.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3565.py:35:28

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
class AESCBCTestCase(unittest.TestCase):
    aes_alg_id_pem_text = "MB0GCWCGSAFlAwQBKgQQEImWuoUOPwM5mTu1h4oONw=="

    def setUp(self):
```
dismissed LLM, confidence 0.93 Short base64 test vector for an AES-CBC algorithm identifier.
Reasoning
This is a short base64 string encoding a DER AES-CBC algorithm identifier, used as a test-case constant. It is static test data and carries no obfuscation.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3657.py:23:1

base64-like blob (1884 bytes over 30 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
    env_data_pem_text = """\
MIIFfwYJKoZIhvcNAQcDoIIFcDCCBWwCAQIxU6JRAgEEMCMEECBlcTFnxBsPlsug
4KOCj78YDzIwMTkwOTEyMTIwMDAwWjANBgsqgwiMmks9AQEDAgQYS3mK9jQmvth1
iuBV8PEa89ICvmoomJCvMIIFEAYJKoZIhvcNAQcBMB8GCyqDCIyaSz0BAQECBBBC
```
dismissed LLM, confidence 0.94 Embedded PEM test vector for RFC 3657 in a unit test.
Reasoning
Raw-pass base64 hit on a PEM certificate/CMS structure embedded as a multiline string in a test file named after an RFC test vector. The base64 is standard ASN.1/DER encoding, not a hidden payload, and the raw pass has a high false-positive rate.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3709.py:20:1

base64-like blob (1020 bytes over 16 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIC9zCCAn2gAwIBAgIJAKWzVCgbsG46MAoGCCqGSM49BAMDMD8xCzAJBgNVBAYT
AlVTMQswCQYDVQQIDAJWQTEQMA4GA1UEBwwHSGVybmRvbjERMA8GA1UECgwIQm9n
dXMgQ0EwHhcNMTkwNTE0MTAwMjAwWhcNMjAwNTEzMTAwMjAwWjBlMQswCQYDVQQG
```
dismissed LLM, confidence 0.94 Embedded PEM certificate test vector for RFC 3709.
Reasoning
Standard base64-encoded X.509 certificate text in a test fixture. The file name and content match RFC test data, so this is a legitimate parser test input.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3709.py:90:1

base64-like blob (3128 bytes over 49 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIJJDCCCAygAwIBAgIRAPIGo/5ScWbpAAAAAFwQBqkwDQYJKoZIhvcNAQELBQAw
gbkxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1FbnRydXN0LCBJbmMuMSgwJgYDVQQL
Ex9TZWUgd3d3LmVudHJ1c3QubmV0L2xlZ2FsLXRlcm1zMTkwNwYDVQQLEzAoYykg
```
dismissed LLM, confidence 0.94 Second embedded PEM certificate test vector in the RFC 3709 test.
Reasoning
Second PEM blob in the same RFC 3709 test file, again a DER-encoded certificate fixture with the expected ASN.1 header structure. Nothing executes or decodes into code.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3739.py:23:1

base64-like blob (1772 bytes over 28 lines, compression ratio 0.70) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIFLTCCBBWgAwIBAgIMVRaIE9MInBkG6aUaMA0GCSqGSIb3DQEBCwUAMHMxCzAJ
BgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMRowGAYDVQQLExFG
b3IgRGVtbyBVc2UgT25seTEtMCsGA1UEAxMkR2xvYmFsU2lnbiBEZW1vIElzc3Vp
```
dismissed LLM, confidence 0.94 Embedded PEM certificate test vector for RFC 3739.
Reasoning
Base64 certificate data with recognizable X.509 structure and readable issuer strings such as GlobalSign and Demo Issuer. This is a test vector for certificate parsing.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3770.py:22:1

base64-like blob (916 bytes over 15 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
    cert_pem_text = """\
MIICqzCCAjCgAwIBAgIJAKWzVCgbsG4/MAoGCCqGSM49BAMDMD8xCzAJBgNVBAYT
AlVTMQswCQYDVQQIDAJWQTEQMA4GA1UEBwwHSGVybmRvbjERMA8GA1UECgwIQm9n
dXMgQ0EwHhcNMTkwNzE5MTk0MjQ3WhcNMjAwNzE4MTk0MjQ3WjBjMQswCQYDVQQG
```
dismissed LLM, confidence 0.94 Embedded PEM certificate test vector for RFC 3770.
Reasoning
PEM certificate fixture with standard DER/base64 prefixes in an RFC-named test file. Its high entropy is expected for certificate data.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3779.py:20:1

base64-like blob (1384 bytes over 22 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIECjCCAvKgAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UEAxMLcmlw
ZS1uY2MtdGEwIBcNMTcxMTI4MTQzOTU1WhgPMjExNzExMjgxNDM5NTVaMBYxFDAS
BgNVBAMTC3JpcGUtbmNjLXRhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
```
dismissed LLM, confidence 0.94 Embedded PEM certificate test vector for RFC 3779.
Reasoning
Base64 DER certificate with an RIPE-style issuer string, typical of test data for RFC 3779 resource extensions. Benign.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3820.py:22:1

base64-like blob (1356 bytes over 22 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
    pem_text = """\
MIID9DCCAtygAwIBAgIEDODd4TANBgkqhkiG9w0BAQUFADCBjTESMBAGCgmSJomT
8ixkARkWAm5sMRcwFQYKCZImiZPyLGQBGRYHZS1pbmZyYTEaMBgGA1UEChMRVHJh
aW5pbmcgU2VydmljZXMxDjAMBgNVBAsTBXVzZXJzMRowGAYDVQQLExFTZWN1cml0
```
dismissed LLM, confidence 0.94 Embedded PEM certificate test vector for RFC 3820.
Reasoning
PEM-encoded certificate text in a test file, with readable ASN.1 issuer fragments. Legitimate parser fixture.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc3852.py:22:1

base64-like blob (1420 bytes over 19 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIEJQYJKoZIhvcNAQcCoIIEFjCCBBICAQMxCzAJBgUrDgMCGgUAMIIDAgYIKwYBBQUHDAKgggL0
BIIC8DCCAuwweDB2AgECBgorBgEEAYI3CgoBMWUwYwIBADADAgEBMVkwVwYJKwYBBAGCNxUUMUow
SAIBBQwZcGl0dWNoYTEuZW1lYS5ocHFjb3JwLm5ldAwMRU1FQVxwaXR1Y2hhDBpDTUNSZXFHZW5l
```
dismissed LLM, confidence 0.94 Embedded CMS/PKCS#7 test vector for RFC 3852.
Reasoning
Base64 CMS/PKCS#7 structure with OID-like prefixes, used as test input for the RFC 3852 CMS parser. No decoding into executable content is shown.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4010.py:26:1

base64-like blob (1876 bytes over 30 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
    env_data_pem_text = """\
MIIFewYJKoZIhvcNAQcDoIIFbDCCBWgCAQIxUqJQAgEEMCMEEKBBI2KxDUPS5TCo
RCEDJo4YDzIwMTkwOTEyMTIwMDAwWjAMBgoqgxqMmkQHAQEBBBipFE2DxCLAx2Og
E53Jt21V8kAoscU7K3wwggUNBgkqhkiG9w0BBwEwHAYIKoMajJpEAQQEEEJPR1VT
```
dismissed LLM, confidence 0.94 Embedded CMS PEM test vector for RFC 4010.
Reasoning
CMS envelope PEM fixture in an RFC test file with standard ASN.1 base64 patterns. This is expected test data.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4108.py:20:1

base64-like blob (1624 bytes over 26 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIEvAYJKoZIhvcNAQcCoIIErTCCBKkCAQExDTALBglghkgBZQMEAgEwggIVBgsq
hkiG9w0BCRABEKCCAgQEggIA3ntqPr5kDpx+//pgWGfHCH/Ht4pbenGwXv80txyE
Y0I2mT9BUGz8ILkbhD7Xz89pBS5KhEJpthxH8WREJtvS+wL4BqYLt23wjWoZy5Gt
```
dismissed LLM, confidence 0.94 Embedded CMS PEM test vector for RFC 4108.
Reasoning
PEM CMS structure in an RFC 4108 test file, with standard DER base64 headers. Legitimate test fixture.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4211.py:20:1

base64-like blob (564 bytes over 9 lines, compression ratio 0.80) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIBozCCAZ8wggEFAgUAwTnj2jCByoABAqURMA8xDTALBgNVBAMTBHVzZXKmgZ8w
DQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJ6ZQ2cYbn/lFsmBOlRltbRbFQUvvE0Q
nbopOu1kC7Bmaaz7QTx8nxeiHi4m7uxCbGGxHNoGCt7EmdG8eZUBNAcHyGlXrJdm
```
dismissed LLM, confidence 0.94 Embedded certificate request test vector for RFC 4211.
Reasoning
Base64 certificate request data in an RFC 4211 test file, with readable subject strings. Standard test fixture with no execution or obfuscation.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4334.py:21:1

base64-like blob (916 bytes over 15 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
    cert_pem_text = """\
MIICqzCCAjCgAwIBAgIJAKWzVCgbsG4/MAoGCCqGSM49BAMDMD8xCzAJBgNVBAYT
AlVTMQswCQYDVQQIDAJWQTEQMA4GA1UEBwwHSGVybmRvbjERMA8GA1UECgwIQm9n
dXMgQ0EwHhcNMTkwNzE5MTk0MjQ3WhcNMjAwNzE4MTk0MjQ3WjBjMQswCQYDVQQG
```
dismissed LLM, confidence 0.94 Embedded PEM certificate test vector for RFC 4334.
Reasoning
Same certificate blob as the RFC 3770 test, reused in an RFC 4334 test file. Expected fixture data.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4357.py:23:1

base64-like blob (400 bytes over 7 lines, compression ratio 0.75) (raw pass, confidence 0.60)
```
    signed_pem_text = """\
MIIBKAYJKoZIhvcNAQcCoIIBGTCCARUCAQExDDAKBgYqhQMCAgkFADAbBgkqhkiG
9w0BBwGgDgQMc2FtcGxlIHRleHQKMYHkMIHhAgEBMIGBMG0xHzAdBgNVBAMMFkdv
c3RSMzQxMC0yMDAxIGV4YW1wbGUxEjAQBgNVBAoMCUNyeXB0b1BybzELMAkGA1UE
```
dismissed LLM, confidence 0.93 Embedded signed-data PEM test vector for RFC 4357.
Reasoning
Short base64 GOST-signed CMS fixture with readable CryptoPro strings in an RFC 4357 test. Legitimate signature test vector.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4357.py:79:1

base64-like blob (568 bytes over 9 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
    keyagree_pem_text = """\
MIIBpAYJKoZIhvcNAQcDoIIBlTCCAZECAQIxggFQoYIBTAIBA6BloWMwHAYGKoUD
AgITMBIGByqFAwICJAAGByqFAwICHgEDQwAEQLNVOfRngZcrpcTZhB8n+4HtCDLm
mtTyAHi4/4Nk6tIdsHg8ff4DwfQG5DvMFrnF9vYZNxwXuKCqx9GhlLOlNiChCgQI
```
likely benign LLM, confidence 0.95 Base64-encoded PEM test vector for a GOST key-agreement test.
Reasoning
Raw-pass base64 signal in a test file that embeds a PEM test vector (GOST key agreement) for RFC 4357 conformance. Such blobs are expected in crypto test suites and carry no execution or hiding behaviour.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4357.py:167:1

base64-like blob (572 bytes over 9 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
    keytrans_pem_text = """\
MIIBpwYJKoZIhvcNAQcDoIIBmDCCAZQCAQAxggFTMIIBTwIBADCBgTBtMR8wHQYD
VQQDDBZHb3N0UjM0MTAtMjAwMSBleGFtcGxlMRIwEAYDVQQKDAlDcnlwdG9Qcm8x
CzAJBgNVBAYTAlJVMSkwJwYJKoZIhvcNAQkBFhpHb3N0UjM0MTAtMjAwMUBleGFt
```
likely benign LLM, confidence 0.95 Base64-encoded PEM test vector for a GOST key-transport test.
Reasoning
Raw-pass base64 blob inside a test file holding a PEM key-transport test vector from RFC 4357. This is a standard ASN.1/PEM fixture, not obfuscation.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4490.py:24:1

base64-like blob (400 bytes over 7 lines, compression ratio 0.75) (raw pass, confidence 0.60)
```
    signed_pem_text = """\
MIIBKAYJKoZIhvcNAQcCoIIBGTCCARUCAQExDDAKBgYqhQMCAgkFADAbBgkqhkiG
9w0BBwGgDgQMc2FtcGxlIHRleHQKMYHkMIHhAgEBMIGBMG0xHzAdBgNVBAMMFkdv
c3RSMzQxMC0yMDAxIGV4YW1wbGUxEjAQBgNVBAoMCUNyeXB0b1BybzELMAkGA1UE
```
likely benign LLM, confidence 0.95 Base64-encoded PEM signed-message test vector.
Reasoning
Raw-pass base64 signal on a signed PEM fixture in an RFC 4490 test file. The content is a DER structure with recognisable ASN.1 and certificate-name text, consistent with a test vector.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4490.py:85:1

base64-like blob (568 bytes over 9 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
    keyagree_pem_text = """\
MIIBpAYJKoZIhvcNAQcDoIIBlTCCAZECAQIxggFQoYIBTAIBA6BloWMwHAYGKoUD
AgITMBIGByqFAwICJAAGByqFAwICHgEDQwAEQLNVOfRngZcrpcTZhB8n+4HtCDLm
mtTyAHi4/4Nk6tIdsHg8ff4DwfQG5DvMFrnF9vYZNxwXuKCqx9GhlLOlNiChCgQI
```
likely benign LLM, confidence 0.95 Base64-encoded PEM key-agreement test vector.
Reasoning
Same pattern as the other RFC 4490 fixtures: a raw-pass base64 blob holding a GOST key-agreement PEM vector in a test module. Expected for crypto conformance tests.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4490.py:193:1

base64-like blob (572 bytes over 9 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
    keytrans_pem_text = """\
MIIBpwYJKoZIhvcNAQcDoIIBmDCCAZQCAQAxggFTMIIBTwIBADCBgTBtMR8wHQYD
VQQDDBZHb3N0UjM0MTAtMjAwMSBleGFtcGxlMRIwEAYDVQQKDAlDcnlwdG9Qcm8x
CzAJBgNVBAYTAlJVMSkwJwYJKoZIhvcNAQkBFhpHb3N0UjM0MTAtMjAwMUBleGFt
```
likely benign LLM, confidence 0.95 Base64-encoded PEM key-transport test vector.
Reasoning
Raw-pass base64 blob holding a key-transport PEM fixture in a test file. The structure is standard and the context is a test, so this is a legitimate fixture.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4491.py:21:1

base64-like blob (704 bytes over 11 lines, compression ratio 0.75) (raw pass, confidence 0.60)
```
    gostR3410_94_cert_pem_text = """\
MIICCzCCAboCECMO42BGlSTOxwvklBgufuswCAYGKoUDAgIEMGkxHTAbBgNVBAMM
FEdvc3RSMzQxMC05NCBleGFtcGxlMRIwEAYDVQQKDAlDcnlwdG9Qcm8xCzAJBgNV
BAYTAlJVMScwJQYJKoZIhvcNAQkBFhhHb3N0UjM0MTAtOTRAZXhhbXBsZS5jb20w
```
likely benign LLM, confidence 0.95 Base64-encoded GOST certificate PEM test vector.
Reasoning
Raw-pass base64 blob holding a GOST certificate PEM fixture in an RFC 4491 test module. The content is a DER certificate with X.509 name fields, typical of test data.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4491.py:88:1

base64-like blob (624 bytes over 10 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
    gostR3410_2001_cert_pem_text = """\
MIIB0DCCAX8CECv1xh7CEb0Xx9zUYma0LiEwCAYGKoUDAgIDMG0xHzAdBgNVBAMM
Fkdvc3RSMzQxMC0yMDAxIGV4YW1wbGUxEjAQBgNVBAoMCUNyeXB0b1BybzELMAkG
A1UEBhMCUlUxKTAnBgkqhkiG9w0BCQEWGkdvc3RSMzQxMC0yMDAxQGV4YW1wbGUu
```
likely benign LLM, confidence 0.95 Base64-encoded GOST 2001 certificate PEM test vector.
Reasoning
Raw-pass base64 blob holding a GOST 2001 certificate PEM fixture in a test file. Standard conformance test data with no code-execution or concealment role.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4683.py:22:1

base64-like blob (1108 bytes over 18 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
    cert_pem_text = """\
MIIDOzCCAsCgAwIBAgIJAKWzVCgbsG5KMAoGCCqGSM49BAMDMD8xCzAJBgNVBAYT
AlVTMQswCQYDVQQIDAJWQTEQMA4GA1UEBwwHSGVybmRvbjERMA8GA1UECgwIQm9n
dXMgQ0EwHhcNMTkxMjExMjIzODUwWhcNMjAxMjEwMjIzODUwWjBOMQswCQYDVQQG
```
likely benign LLM, confidence 0.95 Base64-encoded X.509 certificate PEM test vector.
Reasoning
Raw-pass base64 blob holding an X.509 certificate PEM in an RFC 4683 test. The high-entropy-looking text is ordinary DER encoding of a certificate, a common test fixture.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc4985.py:21:1

base64-like blob (1000 bytes over 16 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
    xmpp_server_cert_pem_text = """\
MIIC6DCCAm+gAwIBAgIJAKWzVCgbsG5DMAoGCCqGSM49BAMDMD8xCzAJBgNVBAYT
AlVTMQswCQYDVQQIDAJWQTEQMA4GA1UEBwwHSGVybmRvbjERMA8GA1UECgwIQm9n
dXMgQ0EwHhcNMTkxMDI0MjMxNjA0WhcNMjAxMDIzMjMxNjA0WjBNMQswCQYDVQQG
```
likely benign LLM, confidence 0.95 Base64-encoded XMPP server certificate PEM test vector.
Reasoning
Raw-pass base64 blob holding an XMPP server certificate PEM in an RFC 4985 test file. This is a certificate fixture used for parsing tests, not a concealed payload.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5035.py:85:1

base64-like blob (1668 bytes over 24 lines, compression ratio 0.70) (raw pass, confidence 0.60)
```
    signed_receipt_pem_text = """\
MIIE3gYJKoZIhvcNAQcCoIIEzzCCBMsCAQMxDTALBglghkgBZQMEAgEwga4GCyqGSIb3DQEJ
EAEBoIGeBIGbMIGYAgEBBgkqhkiG9w0BBwEEIMdPIQ9kJ1cI9Q6HkRCzbXWdD331uAUCL3MM
FXP4KFOjBGYwZAIwOLV5WCbYjy5HLHE69IqXQQHVDJQzmo18WwkFrEYH3EMsvpXEIGqsFTFN
```
likely benign LLM, confidence 0.95 Base64-encoded signed-receipt PEM test vector.
Reasoning
Raw-pass base64 blob holding a signed receipt PEM (CMS structure) in an RFC 5035 test. The ASN.1 layout is typical of a cryptographic message fixture.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5083.py:22:1

base64-like blob (844 bytes over 12 lines, compression ratio 0.78) (raw pass, confidence 0.60)
```
    pem_text = """\
MIICdQIBADGCAiekggIjBgsqhkiG9w0BCRANATCCAhICAQAEE3B0Zi1rbWM6MTM2MTQxMjIx
MTIwDQYLKoZIhvcNAQkQAzAwCwYJYIZIAWUDBAEtMIIBsDCCAawCAQKAFJ7rZ8m5WnTUTS8W
OWaA6AG1y6ScMA0GCSqGSIb3DQEBAQUABIIBgHfnHNqDbyyql2NqX6UQggelWMTjwzJJ1L2e
```
likely benign LLM, confidence 0.95 Base64-encoded CMS authenticated-enveloped-data PEM test vector.
Reasoning
Raw-pass base64 blob holding an authenticated-enveloped-data PEM in an RFC 5083 test. The content is a standard CMS DER structure, consistent with test data and not executed or decoded at runtime.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5083.py:49:1

base64-like blob (940 bytes over 15 lines, compression ratio 0.75) (raw pass, confidence 0.60)
```
    pem_text = """\
MIICvQYLKoZIhvcNAQkQARegggKsMIICqAIBADGCAiekggIjBgsqhkiG9w0BCRAN
ATCCAhICAQAEE3B0Zi1rbWM6MTM2MTQxMjIxMTIwDQYLKoZIhvcNAQkQAzAwCwYJ
YIZIAWUDBAEtMIIBsDCCAawCAQKAFJ7rZ8m5WnTUTS8WOWaA6AG1y6ScMA0GCSqG
```
likely benign LLM, confidence 0.97 A PEM test vector of an RFC 5083 ASN.1 structure embedded in a Python test file.
Reasoning
The file is a test for RFC 5083 CMS/PKCS#7 encrypted-data structures, and the blob is a PEM-encoded ASN.1 test vector inside a triple-quoted string. Base64 of DER structures is the expected content for such a test; it is a raw-pass finding with a known high false-positive rate and no execution or decoding behavior.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5084.py:52:1

base64-like blob (2588 bytes over 36 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
    rfc8591_pem_pext = """\
MIIHkAYLKoZIhvcNAQkQARegggd/MIIHewIBADGCAk8wggJLAgEAMDMwJjEUMBIGA1UECgwL
ZXhhbXBsZS5jb20xDjAMBgNVBAMMBUFsaWNlAgkAg/ULtwvVxA4wDQYJKoZIhvcNAQEBBQAE
ggIAdZphtN3x8a8kZoAFY15HYRD6JyPBueRUhLbTPoOH3pZ9xeDK+zVXGlahl1y1UOe+McEx
```
dismissed LLM, confidence 0.93 Embedded PEM-encoded CMS test data in an RFC 5084 test.
Reasoning
Raw-pass base64 signal on a PEM test vector (PKCS#7/CMS structure) embedded as a string literal in a test file. Standard ASN.1 test data from a crypto library's test suite; no execution or decoding path is visible.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5126.py:21:1

base64-like blob (460 bytes over 8 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
    pem_text = """\
MYIBUzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMCsGCSqGSIb3DQEJNDEeMBww
DQYJYIZIAWUDBAIBBQChCwYJKoZIhvcNAQELMC8GCSqGSIb3DQEJBDEiBCCyqtCC
Gosj/GT4YPPAqKheze4A1QBU5O3tniTsVPGr7jBBBgsqhkiG9w0BCRACETEyMDCg
```
dismissed LLM, confidence 0.93 Embedded PEM test vector for an RFC 5126 CMS test.
Reasoning
Raw base64 match on a PEM test certificate/structure in a test module for RFC 5126. Expected content for ASN.1 parsing tests, with no sign of concealment or dropper behaviour.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5208.py:19:1

base64-like blob (464 bytes over 8 lines, compression ratio 0.83) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIBVgIBADANBgkqhkiG9w0BAQEFAASCAUAwggE8AgEAAkEAx8CO8E0MNgEKXXDf
I1xqBmQ+Gp3Srkqp45OApIu4lZ97n5VJ5HljU9wXcPIfx29Le3w8hCPEkugpLsdV
GWx+EQIDAQABAkEAiv3f+DGEh6ddsPszKQXK+LuTwy2CRajKYgJnBxf5zpG50XK4
```
dismissed LLM, confidence 0.94 Embedded PEM test private key for an RFC 5208 test.
Reasoning
Base64 blob is a PEM-encoded PKCS#8 private key test vector in a test file for RFC 5208. Test fixtures like this are routine in ASN.1 libraries.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5208.py:46:1

base64-like blob (520 bytes over 9 lines, compression ratio 0.82) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIBgTAbBgkqhkiG9w0BBQMwDgQIdtFgDWnipT8CAggABIIBYN0hkm2xqkTCt8dJ
iZS8+HNiyHxy8g+rmWSXv/i+bTHFUReZA2GINtTRUkWpXqWcSHxNslgf7QdfgbVJ
xQiUM+lLhwOFh85iAHR3xmPU1wfN9NvY9DiLSpM0DMhF3OvAMZD75zIhA0GSKu7w
```
dismissed LLM, confidence 0.93 Second embedded PEM test vector in the RFC 5208 test.
Reasoning
Another PEM test vector in the same RFC 5208 test module, with the same base64 structure and no decoding or execution around it.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5280.py:55:1

base64-like blob (464 bytes over 8 lines, compression ratio 0.76) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIBVjCBwAIBATANBgkqhkiG9w0BAQUFADB+MQswCQYDVQQGEwJBVTETMBEGA1UE
CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk
MRUwEwYDVQQDEwxzbm1wbGFicy5jb20xIDAeBgkqhkiG9w0BCQEWEWluZm9Ac25t
```
dismissed LLM, confidence 0.94 Embedded X.509 certificate test vector for RFC 5280.
Reasoning
Base64 X.509 certificate test vector in a pyasn1-style RFC 5280 test. Legitimate fixture data with a high false-positive rate for raw base64 detection.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5280.py:139:1

base64-like blob (464 bytes over 8 lines, compression ratio 0.76) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIBVjCBwAIBATANBgkqhkiG9w0BAQUFADB+MQswCQYDVQQGEwJBVTETMBEGA1UE
CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk
MRUwEwYDVQQDEwxzbm1wbGFicy5jb20xIDAeBgkqhkiG9w0BCQEWEWluZm9Ac25t
```
dismissed LLM, confidence 0.94 Repeated X.509 certificate test vector for RFC 5280.
Reasoning
Duplicate of the RFC 5280 certificate fixture at line 55; the same benign test data.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5280.py:226:1

base64-like blob (92 bytes over 2 lines, compression ratio 1.01) (raw pass, confidence 0.60)
```
    oraddress_pem_text = """\
MEMwK2EEEwJHQmIKEwhHT0xEIDQwMKIHEwVVSy5BQ4MHU2FsZm9yZKYFEwNSLUQx
FDASgAEBoQ0TC1N0ZXZlIEtpbGxl
"""
```
dismissed LLM, confidence 0.92 Embedded X.400 OR-address ASN.1 test data.
Reasoning
Short base64 blob holding an ASN.1 OR-address structure in a test string, the kind of encoded test data a certificate-parsing suite uses.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5480.py:21:1

base64-like blob (1260 bytes over 20 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
    digicert_ec_cert_pem_text = """\
MIIDrDCCApSgAwIBAgIQCssoukZe5TkIdnRw883GEjANBgkqhkiG9w0BAQwFADBh
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
```
dismissed LLM, confidence 0.94 Embedded EC X.509 certificate test vector for RFC 5480.
Reasoning
Base64 DER/PEM certificate for an EC cert test, with DigiCert certificate content in a test string. Ordinary test fixture.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5636.py:21:1

base64-like blob (2132 bytes over 30 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIGOgYJKoZIhvcNAQcCoIIGKzCCBicCAQMxDTALBglghkgBZQMEAgEwRQYKKoMajJpECgEB
AaA3BDUwMwQgTgtiLdByNcZGP/PPE1I2lvxDA/6bajEE4VAWF13N9E4YDzIwMTkxMjMxMTIw
MDAwWqCCBB0wggQZMIIDAaADAgECAhQLxXbZnuC+8r+RhlN0rgUga/of6TANBgkqhkiG9w0B
```
dismissed LLM, confidence 0.93 Embedded PEM test vector for RFC 5636.
Reasoning
PEM-encoded test structure in an RFC 5636 test file, consistent with ASN.1 test vectors. No code path decodes or runs it.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5639.py:22:1

base64-like blob (628 bytes over 10 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
    brainpool_ec_cert_pem_text = """\
MIIB0jCCAXmgAwIBAgITPUXQAyl3ZE5iAHYGZYSp1FkqzTAKBggqhkjOPQQDAjA/
MQswCQYDVQQGEwJVUzELMAkGA1UECAwCVkExEDAOBgNVBAcMB0hlcm5kb24xETAP
BgNVBAoMCEJvZ3VzIENBMB4XDTE5MTIwOTIxNDM0NFoXDTIxMTIwODIxNDM0NFow
```
dismissed LLM, confidence 0.94 Embedded Brainpool EC certificate test vector for RFC 5639.
Reasoning
Brainpool EC certificate test vector in a test module. Standard fixture data for elliptic-curve parsing tests.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5652.py:23:1

base64-like blob (1420 bytes over 19 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIEJQYJKoZIhvcNAQcCoIIEFjCCBBICAQMxCzAJBgUrDgMCGgUAMIIDAgYIKwYBBQUHDAKgggL0
BIIC8DCCAuwweDB2AgECBgorBgEEAYI3CgoBMWUwYwIBADADAgEBMVkwVwYJKwYBBAGCNxUUMUow
SAIBBQwZcGl0dWNoYTEuZW1lYS5ocHFjb3JwLm5ldAwMRU1FQVxwaXR1Y2hhDBpDTUNSZXFHZW5l
```
dismissed LLM, confidence 0.93 Embedded CMS test vector for RFC 5652.
Reasoning
Base64 CMS/PKCS#7 test structure in an RFC 5652 test. Legitimate ASN.1 fixture data.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5697.py:22:1

base64-like blob (2164 bytes over 34 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
    cert_pem_text = """\
MIIGUTCCBfegAwIBAgIUY8xt3l0B9nIPWSpjs0hDJUJZmCswCwYJYIZIAWUDBAMC
MD8xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJWQTEQMA4GA1UEBxMHSGVybmRvbjER
MA8GA1UEChMIQm9ndXMgQ0EwHhcNMTkxMjExMTczMzQ0WhcNMjAxMjEwMTczMzQ0
```
dismissed LLM, confidence 0.94 Embedded certificate test vector for RFC 5697.
Reasoning
Base64 certificate test vector in an RFC 5697 test file. Routine fixture content that a raw-pass entropy heuristic flags by default.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5753.py:24:1

base64-like blob (2060 bytes over 33 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIGAwYJKoZIhvcNAQcDoIIF9DCCBfACAQIxgdihgdUCAQOgeKF2MBAGByqGSM49
AgEGBSuBBAAiA2IABGJ8n8NE7e0+gs36C3P+klXlvBXudwiw84lyW0U0pbo9U0Lz
tr6cknb+lbsRk21dXwHrK9ZW/SjBG+ONTvD+8P6+62xh2OO9lil5uSHmzDYNiTKn
```
dismissed LLM, confidence 0.93 Embedded CMS EC-key test vector for RFC 5753.
Reasoning
Base64 encrypted/enveloped structure in an RFC 5753 test, consistent with the other ASN.1 test vectors in this suite. No decoding or execution visible.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5915.py:21:1

base64-like blob (224 bytes over 4 lines, compression ratio 0.90) (raw pass, confidence 0.60)
```
    private_key_pem_text = """\
MIGkAgEBBDDLjzGbbLrR3T13lrrVum7WC/4Ua4Femc1RhhNVe1Q5XsArQ33kn9kx
3lOUfOcG+qagBwYFK4EEACKhZANiAAT4zZ8HL+xEDpXWkoWp5xFMTz4u4Ae1nF6z
XCYlmsEGD5vPu5hl9hDEjd1UHRgJIPoy3fJcWWeZ8FHCirICtuMgFisNscG/aTwK
```
likely benign LLM, confidence 0.97 Test fixture containing a PEM-encoded EC private key from RFC 5915.
Reasoning
Raw base64 PEM test vector for an EC private key in a test file of a crypto library; the blob is a legitimate ASN.1 structure, not obfuscation.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5916.py:22:1

base64-like blob (912 bytes over 15 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
    cert_pem_text = """\
MIICpzCCAiygAwIBAgIJAKWzVCgbsG5FMAoGCCqGSM49BAMDMD8xCzAJBgNVBAYT
AlVTMQswCQYDVQQIDAJWQTEQMA4GA1UEBwwHSGVybmRvbjERMA8GA1UECgwIQm9n
dXMgQ0EwHhcNMTkxMDMxMTQwMDE1WhcNMjAxMDMwMTQwMDE1WjB4MQswCQYDVQQG
```
likely benign LLM, confidence 0.97 Test fixture containing a PEM certificate from RFC 5916.
Reasoning
Base64 certificate PEM test vector in a pyasn1/pyca-style test suite; standard RFC test data.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5924.py:21:1

base64-like blob (872 bytes over 14 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
    cert_pem_text = """\
MIICiTCCAg+gAwIBAgIJAKWzVCgbsG5EMAoGCCqGSM49BAMDMD8xCzAJBgNVBAYT
AlVTMQswCQYDVQQIDAJWQTEQMA4GA1UEBwwHSGVybmRvbjERMA8GA1UECgwIQm9n
dXMgQ0EwHhcNMTkxMDMwMjEwMDM0WhcNMjAxMDI5MjEwMDM0WjBsMQswCQYDVQQG
```
likely benign LLM, confidence 0.97 Test fixture containing a PEM certificate from RFC 5924.
Reasoning
Certificate PEM test vector from an RFC test file; expected content for certificate parsing tests.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5934.py:199:1

base64-like blob (2228 bytes over 31 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
    tau_pem_text = """\
MIIGgwYJKoZIhvcNAQcCoIIGdDCCBnACAQMxDTALBglghkgBZQMEAgEwggFMBgpghkgBZQIB
Ak0DoIIBPASCATgwggE0MAiDAAIEXXp3kDCCASaiggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
ggEKAoIBAQDALMH2jTus/z881nG+uHQiB+xwQRX8q0DjB6rBw9if/tpMOr8/yNgoe0s2AcCs
```
likely benign LLM, confidence 0.96 Test fixture with base64 ASN.1 data from RFC 5934.
Reasoning
Base64 DER structure for a trust anchor test vector; typical ASN.1 test data in a crypto library.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5958.py:23:1

base64-like blob (156 bytes over 3 lines, compression ratio 0.95) (raw pass, confidence 0.60)
```
    priv_key_pem_text = """\
MHICAQEwBQYDK2VwBCIEINTuctv5E1hK1bbY8fdp+K06/nwoy/HU++CXqI9EdVhC
oB8wHQYKKoZIhvcNAQkJFDEPDA1DdXJkbGUgQ2hhaXJzgSEAGb9ECWmEzf6FQbrB
Z9w7lshQhqowtrbLDFw4rXAxZuE=
```
likely benign LLM, confidence 0.96 Test fixture containing a PEM-encoded private key from RFC 5958.
Reasoning
Encoded private key PKCS#8 test vector from RFC 5958 test suite; legitimate encoded test data.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5958.py:50:1

base64-like blob (180 bytes over 3 lines, compression ratio 0.89) (raw pass, confidence 0.60)
```
    asymmetric_key_pkg_pem_text = """\
MIGEBgpghkgBZQIBAk4FoHYwdDByAgEBMAUGAytlcAQiBCDU7nLb+RNYStW22PH3
afitOv58KMvx1Pvgl6iPRHVYQqAfMB0GCiqGSIb3DQEJCRQxDwwNQ3VyZGxlIENo
YWlyc4EhABm/RAlphM3+hUG6wWfcO5bIUIaqMLa2ywxcOK1wMWbh
```
likely benign LLM, confidence 0.96 Test fixture with asymmetric key package PEM from RFC 5958.
Reasoning
Another RFC 5958 base64 test vector for asymmetric key packages; legitimate test data.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc5990.py:21:1

base64-like blob (100 bytes over 2 lines, compression ratio 0.97) (raw pass, confidence 0.60)
```
    pem_text = """\
MEcGCyqGSIb3DQEJEAMOMDgwKQYHKIGMcQICBDAeMBkGCiuBBRCGSAksAQIwCwYJ
YIZIAWUDBAIBAgEQMAsGCWCGSAFlAwQBBQ==
"""
```
likely benign LLM, confidence 0.96 Test fixture with base64 ASN.1 structure from RFC 5990.
Reasoning
Short base64 DER test vector for CMS/RFC 5990 parsing in a test file; benign.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc6010.py:20:31

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
class UnconstrainedCCCExtensionTestCase(unittest.TestCase):
    unconstrained_pem_text = "MB0GCCsGAQUFBwESBBEwDzANBgsqhkiG9w0BCRABAA=="

    def setUp(self):
```
likely benign LLM, confidence 0.96 Inline base64 ASN.1 test value for an RFC 6010 extension.
Reasoning
Small base64 extension encoding inline in a unit test class; standard test data for certificate extension parsing.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc6031.py:21:1

base64-like blob (256 bytes over 4 lines, compression ratio 0.76) (raw pass, confidence 0.60)
```
    key_pkg_pem_text = """\
MIG7BgsqhkiG9w0BCRABGaCBqzCBqKBEMCMGCyqGSIb3DQEJEAwBMRQMElZpZ2ls
IFNlY3VyaXR5IExMQzAdBgsqhkiG9w0BCRAMAzEODAxQcmV0ZW5kIDA0OEEwYDBe
MFYwGwYLKoZIhvcNAQkQDBsxDAwKZXhhbXBsZUlEMTAVBgsqhkiG9w0BCRAMCjEG
```
likely benign LLM, confidence 0.96 Test fixture with base64 key package from RFC 6031.
Reasoning
Base64 CMS key package test vector from RFC 6031 test suite; benign test data.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc6032.py:21:1

base64-like blob (356 bytes over 6 lines, compression ratio 0.81) (raw pass, confidence 0.60)
```
    encrypted_key_pkg_pem_text = """\
MIIBBwYKYIZIAWUCAQJOAqCB+DCB9QIBAjCBzgYKYIZIAWUCAQJOAjAdBglghkgB
ZQMEASoEEN6HFteHMZ3DyeO35xIwWQOAgaCKTs0D0HguNzMhsLgiwG/Kw8OwX+GF
9/cZ1YVNesUTW/VsbXJcbTmFmWyfqZsM4DLBegIbrUEHQZnQRq6/NO4ricQdHApD
```
likely benign LLM, confidence 0.96 Test fixture with encrypted key package from RFC 6032.
Reasoning
Encrypted key package base64 test vector from RFC 6032 test file; benign.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc6120.py:21:1

base64-like blob (1000 bytes over 16 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
    xmpp_server_cert_pem_text = """\
MIIC6DCCAm+gAwIBAgIJAKWzVCgbsG5DMAoGCCqGSM49BAMDMD8xCzAJBgNVBAYT
AlVTMQswCQYDVQQIDAJWQTEQMA4GA1UEBwwHSGVybmRvbjERMA8GA1UECgwIQm9n
dXMgQ0EwHhcNMTkxMDI0MjMxNjA0WhcNMjAxMDIzMjMxNjA0WjBNMQswCQYDVQQG
```
likely benign LLM, confidence 0.96 Test fixture with PEM certificate from RFC 6120.
Reasoning
Certificate PEM test vector for XMPP server cert from RFC 6120 test data; benign.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc6187.py:20:1

base64-like blob (880 bytes over 14 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
    cert_pem_text = """\
MIICkDCCAhegAwIBAgIJAKWzVCgbsG5BMAoGCCqGSM49BAMDMD8xCzAJBgNVBAYT
AlVTMQswCQYDVQQIDAJWQTEQMA4GA1UEBwwHSGVybmRvbjERMA8GA1UECgwIQm9n
dXMgQ0EwHhcNMTkxMDI0MTgyNjA3WhcNMjAxMDIzMTgyNjA3WjB0MQswCQYDVQQG
```
likely benign LLM, confidence 0.96 Test fixture containing a PEM certificate from RFC 6187.
Reasoning
Certificate PEM test vector from RFC 6187 test file; standard parsing test data.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc6210.py:22:1

base64-like blob (780 bytes over 12 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
    pem_text = """\
MIICRQYLKoZIhvcNAQkQAQKgggI0MIICMAIBADGBwDCBvQIBADAmMBIxEDAOBgNVBAMMB0
NhcmxSU0ECEEY0a8eAAFa8EdNuLs1dcdAwDQYJKoZIhvcNAQEBBQAEgYCH70EpEikY7deb
859YJRAWfFondQv1D4NFltw6C1ceheWnlAU0C2WEXr3LUBXZp1/PSte29FnJxu5bXCTn1g
```
likely benign LLM, confidence 0.96 Test fixture with PEM-encoded ASN.1 data from RFC 6210.
Reasoning
Base64 PEM test vector containing certificate and key material from RFC 6210 test data; benign.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc6402.py:24:1

base64-like blob (1420 bytes over 19 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIEJQYJKoZIhvcNAQcCoIIEFjCCBBICAQMxCzAJBgUrDgMCGgUAMIIDAgYIKwYBBQUHDAKgggL0
BIIC8DCCAuwweDB2AgECBgorBgEEAYI3CgoBMWUwYwIBADADAgEBMVkwVwYJKwYBBAGCNxUUMUow
SAIBBQwZcGl0dWNoYTEuZW1lYS5ocHFjb3JwLm5ldAwMRU1FQVxwaXR1Y2hhDBpDTUNSZXFHZW5l
```
dismissed LLM, confidence 0.97 Embedded PEM test vector for an RFC 6402 certificate request in a test file.
Reasoning
Raw-pass base64 hit on a PEM string literal in a unit test named after RFC 6402. The content is a standard PKCS#10/CMS test vector with ASN.1 structure, not an encoded payload. Test vectors like this are expected in a pyasn1-modules style test suite.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc6482.py:20:1

base64-like blob (2308 bytes over 33 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
    roa_pem_text = """\
MIIGvwYJKoZIhvcNAQcCoIIGsDCCBqwCAQMxDTALBglghkgBZQMEAgEwKgYLKoZIhvcNAQkQ
ARigGwQZMBcCAwDj+zAQMA4EAgABMAgwBgMEAJMcLaCCBLwwggS4MIIDoKADAgECAgIGGDAN
BgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyg2ZDZmYmZhOTc1M2RiOGQ4NDY0MzNkYjUzNTFk
```
dismissed LLM, confidence 0.97 Embedded PEM ROA test vector in a test file.
Reasoning
Raw-pass base64 blob inside a PEM string constant in an RFC 6482 (ROA) test. The text is valid ASN.1/DER base64 for RPKI test data, consistent with the file's purpose.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc6487.py:84:1

base64-like blob (1616 bytes over 26 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
    rpki_cert_pem_text = """\
MIIEuDCCA6CgAwIBAgICBhgwDQYJKoZIhvcNAQELBQAwMzExMC8GA1UEAxMoNmQ2
ZmJmYTk3NTNkYjhkODQ2NDMzZGI1MzUxZDlhOWVjMDdjOTZiZDAeFw0xOTA4MjAw
MDQ5MjlaFw0yMDA3MDEwMDAwMDBaMDMxMTAvBgNVBAMTKDVCODNERDg3REU5QUM3
```
dismissed LLM, confidence 0.97 Embedded PEM RPKI certificate test vector in a test file.
Reasoning
Raw-pass base64 hit on a PEM certificate string in an RFC 6487 test. The content is a standard RPKI certificate test fixture and the base64 is ordinary DER encoding.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc6664.py:21:1

base64-like blob (768 bytes over 12 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
    smime_capabilities_pem_text = """\
MIICOjAJBgUrDgMCGgUAMA0GCWCGSAFlAwQCBAUAMA0GCWCGSAFlAwQCAQUAMA0G
CWCGSAFlAwQCAgUAMA0GCWCGSAFlAwQCAwUAMBUGCSqGSIb3DQEBATAIAgIEAAIC
EAAwFQYJKoZIhvcNAQEHMAgCAgQAAgIQADAVBgkqhkiG9w0BAQowCAICBAACAhAA
```
dismissed LLM, confidence 0.96 Embedded PEM S/MIME capabilities test vector in a test file.
Reasoning
Raw-pass base64 blob in a PEM S/MIME capabilities test constant. The repeated ASN.1 OID-style structure is typical of DER test data, and the file is a test for a named RFC.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc6955.py:24:1

base64-like blob (1112 bytes over 18 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIDPDCCArsCAQAwTjELMAkGA1UEBhMCVVMxETAPBgNVBAoTCFhFVEkgSW5jMRAw
DgYDVQQLEwdUZXN0aW5nMRowGAYDVQQDExFQS0lYIEV4YW1wbGUgVXNlcjCCAkEw
ggG2BgcqhkjOPgIBMIIBqQKBgQCUhOBFbH9pUWI+VoB8aOfFqZ6edHSU7ZCMHcTh
```
dismissed LLM, confidence 0.97 Embedded PEM test vector for an RFC 6955 key request in a test file.
Reasoning
Raw-pass base64 blob in a PEM test constant for RFC 6955 (Diffie-Hellman proof-of-possession). The text is a plausible DER-encoded key/request fixture in a test file.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc6960.py:23:1

base64-like blob (144 bytes over 2 lines, compression ratio 0.95) (raw pass, confidence 0.60)
```
    ocsp_req_pem_text = """\
MGowaDBBMD8wPTAJBgUrDgMCGgUABBS3ZrMV9C5Dko03aH13cEZeppg3wgQUkqR1LKSevoFE63n8
isWVpesQdXMCBDXe9M+iIzAhMB8GCSsGAQUFBzABAgQSBBBjdJOiIW9EKJGELNNf/rdA
"""
```
dismissed LLM, confidence 0.95 Short embedded OCSP request test vector in a test file.
Reasoning
Short raw-pass base64 blob in an OCSP request PEM constant in an RFC 6960 test. It is a small DER fixture of the kind OCSP tests use.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc7030.py:22:1

base64-like blob (92 bytes over 2 lines, compression ratio 0.91) (raw pass, confidence 0.60)
```
    pem_text = """\
MEEGCSqGSIb3DQEJBzASBgcqhkjOPQIBMQcGBSuBBAAiMBYGCSqGSIb3DQEJDjEJ
BgcrBgEBAQEWBggqhkjOPQQDAw==
"""
```
dismissed LLM, confidence 0.96 Short embedded PEM test vector for an RFC 7030 message in a test file.
Reasoning
Small base64 PEM constant in an RFC 7030 (EST) test. The content decodes to ASN.1 structures with standard OIDs, consistent with a test fixture.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc7292.py:22:1

base64-like blob (3360 bytes over 47 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
    pfx_pem_text = """\
MIIJ0wIBAzCCCY8GCSqGSIb3DQEHAaCCCYAEggl8MIIJeDCCBggGCSqGSIb3DQEHAaCCBfkE
ggX1MIIF8TCCBe0GCyqGSIb3DQEMCgECoIIE/jCCBPowHAYKKoZIhvcNAQwBAzAOBAjuq0/+
0pyutQICB9AEggTYZe/mYBpmkDvKsve4EwIVwo1TNv4ldyx1qHZW2Ih6qQCY+Nv1Mnv9we0z
```
dismissed LLM, confidence 0.97 Embedded PKCS#12 PEM test vector in a test file.
Reasoning
Raw-pass base64 blob for a PKCS#12 (PFX) PEM string in an RFC 7292 test. PKCS#12 test containers are normally embedded this way and the file is a named RFC test.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc7894.py:21:1

base64-like blob (928 bytes over 15 lines, compression ratio 0.78) (raw pass, confidence 0.60)
```
    otp_pem_text = """\
MIICsjCCAZwCAQAwJDELMAkGA1UEBhMCVVMxFTATBgNVBAMTDDRUUzJWMk5MWEE2
WjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKmF0oUj5+1rBB+pUO8X
7FPxer+1BhWOa54RTSucJmBaLx0H95qNaBCcctNDl1kcmIro/a0zMcEvj5Do29vQ
```
dismissed LLM, confidence 0.97 Embedded PEM test vector for an RFC 7894 OTP structure in a test file.
Reasoning
Raw-pass base64 blob in an OTP PEM test constant for RFC 7894. The DER structure and the file's purpose mark it as a standard test vector.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc7914.py:25:1

base64-like blob (308 bytes over 5 lines, compression ratio 0.86) (raw pass, confidence 0.60)
```
    pem_text = """\
MIHiME0GCSqGSIb3DQEFDTBAMB8GCSsGAQQB2kcECzASBAVNb3VzZQIDEAAAAgEI
AgEBMB0GCWCGSAFlAwQBKgQQyYmguHMsOwzGMPoyObk/JgSBkJb47EWd5iAqJlyy
+ni5ftd6gZgOPaLQClL7mEZc2KQay0VhjZm/7MbBUNbqOAXNM6OGebXxVp6sHUAL
```
dismissed LLM, confidence 0.96 Embedded PEM scrypt key test vector in a test file.
Reasoning
Raw-pass base64 PEM constant in an RFC 7914 (scrypt) test. The content is DER-encoded PKCS#8 or parameter data with standard OIDs, typical of a crypto test fixture.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8017.py:81:1

base64-like blob (1660 bytes over 26 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIE2QIBAQKCAQEAn82EqwXasE2TFNSmZucB8LNza2mOWLHF3nxpxKXalPMDvezc
5Dq7Ytcv/k9jJL4j4jYfvR4yyZdU9iHLaD6hOINZ8E6hVpx/4c96ZUSOLzD2g+u+
jIuoNfG+zygSBGYCS6BLCAIsZ+2wUyxYpLJknHJld9/jy+aLmmyrilhH9dH5AUiV
```
dismissed LLM, confidence 0.97 Embedded PEM RSA key test vector in a test file.
Reasoning
Raw-pass base64 blob in a PEM RSA key test constant for RFC 8017 (PKCS#1). The large base64 is a standard RSA key encoding and the file is an RFC test.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8018.py:21:1

base64-like blob (116 bytes over 2 lines, compression ratio 1.01) (raw pass, confidence 0.60)
```
    rfc3211_ex1_pem_text = """\
o1MCAQCgGgYJKoZIhvcNAQUMMA0ECBI0Vnh4VjQSAgEFMCAGCyqGSIb3DQEJEAMJMBEGBSsO
AwIHBAjv5ZjvIbM9bQQQuBslZe43PKbe3KJqF4sMEA==
"""
```
dismissed LLM, confidence 0.95 Embedded PBKDF/PBES PEM test vector in a test file.
Reasoning
Short base64 PEM constant in an RFC 8018 (PKCS#5) test, following the rfc3211 example naming. The content is a small DER PBES fixture, which is expected in this test file.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8103.py:20:24

base64-like blob (40 bytes, compression ratio 1.27) (raw pass, confidence 0.60)
```
class CAEADChaCha20Poly1305TestCase(unittest.TestCase):
    alg_id_pem_text = "MBsGCyqGSIb3DQEJEAMSBAzK/rq++s7brd7K+Ig="

    def setUp(self):
```
dismissed LLM, confidence 0.95 Short base64 AlgorithmIdentifier test constant for ChaCha20-Poly1305 in a test file.
Reasoning
A single-line base64 string that decodes to a short ASN.1 AlgorithmIdentifier for ChaCha20-Poly1305, assigned to alg_id_pem_text in a test class. It is a test fixture and the raw-pass hit is a false positive.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8209.py:21:1

base64-like blob (528 bytes over 9 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
    cert_pem_text = """\
MIIBiDCCAS+gAwIBAgIEAk3WfDAKBggqhkjOPQQDAjAaMRgwFgYDVQQDDA9ST1VU
RVItMDAwMEZCRjAwHhcNMTcwMTAxMDUwMDAwWhcNMTgwNzAxMDUwMDAwWjAaMRgw
FgYDVQQDDA9ST1VURVItMDAwMEZCRjAwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNC
```
dismissed LLM, confidence 0.96 Embedded base64 PEM certificate used as test input in an RFC 8209 certificate test.
Reasoning
Raw-pass base64 hit on a PEM certificate literal inside a test file named for an RFC test vector. The blob is a standard X.509 structure, which is expected in certificate-parsing tests, and the raw pass has a high false-positive rate for this kind of data.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8226.py:55:1

base64-like blob (884 bytes over 14 lines, compression ratio 0.75) (raw pass, confidence 0.60)
```
    cert_pem_text = """\
MIICkTCCAhegAwIBAgIJAKWzVCgbsG4+MAoGCCqGSM49BAMDMD8xCzAJBgNVBAYT
AlVTMQswCQYDVQQIDAJWQTEQMA4GA1UEBwwHSGVybmRvbjERMA8GA1UECgwIQm9n
dXMgQ0EwHhcNMTkwNzE4MTUwNzQ5WhcNMjAwNzE3MTUwNzQ5WjBxMQswCQYDVQQG
```
dismissed LLM, confidence 0.96 Embedded base64 PEM certificate fixture in an RFC 8226 test.
Reasoning
Base64 PEM certificate text in a test module for RFC 8226. It has the normal ASN.1/X.509 header structure and is used as fixture data, not hidden or executed code.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8358.py:22:1

base64-like blob (3200 bytes over 45 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
"""\
MIIJWgYJKoZIhvcNAQcCoIIJSzCCCUcCAQMxDTALBglghkgBZQMEAgEwDQYLKoZIhvcNAQkQ
ARugggZ0MIIGcDCCBVigAwIBAgIRANa58hQvZ26svTWQaGtqo/YwDQYJKoZIhvcNAQELBQAw
gZcxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcT
```
dismissed LLM, confidence 0.96 Large base64-encoded CMS structure used as a test vector in an RFC 8358 test.
Reasoning
Large CMS/PKCS#7 base64 blob in a test for RFC 8358 test vectors. Its length and structure match real signed-data test fixtures, and nothing in the snippet decodes or executes it.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8358.py:69:1

base64-like blob (3200 bytes over 45 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
"""\
MIIJWgYJKoZIhvcNAQcCoIIJSzCCCUcCAQMxDTALBglghkgBZQMEAgEwDQYLKoZIhvcNAQkQ
ARygggZ0MIIGcDCCBVigAwIBAgIRANa58hQvZ26svTWQaGtqo/YwDQYJKoZIhvcNAQELBQAw
gZcxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcT
```
dismissed LLM, confidence 0.96 Variant base64 CMS test vector in the RFC 8358 test module.
Reasoning
Same kind of CMS base64 fixture as the other RFC 8358 hit, differing only in a few bytes. This is a variant test vector, so it is benign.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8358.py:116:1

base64-like blob (3200 bytes over 45 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
"""\
MIIJWgYJKoZIhvcNAQcCoIIJSzCCCUcCAQMxDTALBglghkgBZQMEAgEwDQYLKoZIhvcNAQkQ
AR2gggZ0MIIGcDCCBVigAwIBAgIRANa58hQvZ26svTWQaGtqo/YwDQYJKoZIhvcNAQELBQAw
gZcxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcT
```
dismissed LLM, confidence 0.96 Base64 CMS test vector in the RFC 8358 test module.
Reasoning
Another base64 CMS fixture in the RFC 8358 test file, consistent with a set of test vectors. No decoding or execution appears in the snippet.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8398.py:19:17

base64-like blob (48 bytes, compression ratio 1.23) (raw pass, confidence 0.60)
```
class EAITestCase(unittest.TestCase):
    pem_text = "oCAGCCsGAQUFBwgJoBQMEuiAgeW4q0BleGFtcGxlLmNvbQ=="

    def setUp(self):
```
dismissed LLM, confidence 0.94 Short base64 ASN.1 value used as test input for RFC 8398 internationalized email addresses.
Reasoning
Short base64 DER fragment assigned to a pem_text class attribute in an RFC 8398 test case. It encodes an identifier and an email-like name typical of internationalized certificate tests. It is test data with no execution path.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8418.py:20:34

base64-like blob (40 bytes, compression ratio 1.27) (raw pass, confidence 0.60)
```
class KeyAgreeAlgTestCase(unittest.TestCase):
    key_agree_alg_id_pem_text = "MBoGCyqGSIb3DQEJEAMUMAsGCWCGSAFlAwQBLQ=="

    def setUp(self):
```
dismissed LLM, confidence 0.95 Short base64 algorithm identifier used as test data for RFC 8418 key agreement.
Reasoning
Short base64 ASN.1 algorithm identifier assigned to a test attribute in an RFC 8418 test case. It is a fixture value, not an obfuscated payload.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8479.py:23:1

base64-like blob (1712 bytes over 27 lines, compression ratio 0.78) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIE/gIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCpPwXwfhDsWA3q
jN2BWg1xfDjvZDVNfgTV/b95g304Aty3z13xPXAhHZ3ROW3pgPxTj9fiq7ZMy4Ua
gMpPK81v3pHX1uokC2KcGXbgbAq2Q8ClxSXgEJllRwDENufjEdV10gArt8NlIP0N
```
dismissed LLM, confidence 0.96 Embedded base64 PEM private key fixture in an RFC 8479 test.
Reasoning
Base64 PKCS#8 private key PEM in a test for RFC 8479. Test suites for ASN.1 libraries commonly include sample keys like this. It is a known-format fixture with no dropper or decode-and-run behavior.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8494.py:19:1

base64-like blob (420 bytes over 7 lines, compression ratio 0.83) (raw pass, confidence 0.60)
```
    pem_text = """\
MIIBNqADAgEAMIIBLaADAgEZoIIBJASCASB4nG2P0U7CQBBF3/cr5l2K3YpSF5YA
bYmbWArtQsJjKVuogd1mO0T8e0ti1IjJZB4md07OHZbWnMbqkp/qo+oW5jSCWDqL
VCSpkBveg2kSbrg/FTIWcQRpJPlLmGYQzdci5MvlA+3Rx2cyREO/KVrhCOaJFLMN
```
dismissed LLM, confidence 0.95 Base64 PEM test vector in an RFC 8494 test.
Reasoning
Base64 PEM structure in a test module for RFC 8494. The encoded data is a standard ASN.1 test vector and the snippet has no decoding or execution around it.
info ~~warn~~ → info by review encoding-base64 tests/test_rfc8520.py:21:1

base64-like blob (1788 bytes over 28 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
    mud_cert_pem_text = """\
MIIFODCCAyCgAwIBAgICEEAwDQYJKoZIhvcNAQELBQAwZTELMAkGA1UEBhMCQ0gx
DzANBgNVBAgMBlp1cmljaDERMA8GA1UEBwwIV2V0emlrb24xEDAOBgNVBAoMB0lt
UmlnaHQxIDAeBgNVBAMMF0ltUmlnaHQgVGVzdCA4MDIuMUFSIENBMB4XDTE5MDUw
```
dismissed LLM, confidence 0.96 Embedded base64 PEM certificate fixture in an RFC 8520 test.
Reasoning
Base64 PEM certificate fixture in an RFC 8520 MUD test. The content is a plausible X.509 certificate used as test input, and the file is a unit test with no hidden behavior.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/pyasn1/pyasn1-modules pyasn1-modules && cd pyasn1-modules
git checkout v0.4.2
disclude scan --severity info --diff v0.4.1 .