pycryptodomex 3.24.2

Source: https://github.com/Legrandin/pycryptodome
Artifact scanned: pycryptodomex-3.24.2.tar.gz (sdist · 4.7 MB · SHA-256 e4dbc29e2575…)
Compared with: pycryptodomex-3.24.1.tar.gz (0 signals introduced since)
Files: 533 scanned, 90 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 29 warn · 132 info
Scan time: 63.8 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): the 107 most severe of 136 warn and critical signals (107 with a verdict); 107 demoted to info. The rest are unreviewed.
Disclude version: 4.3.0
Scanned (UTC): 2026-11-05 20:28

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

warn encoding-escape-soup src/test/test_ec_ws.c:446:41

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)

    free(x1); free(y1); free(z1);
    mont_new_from_bytes(&x1, (uint8_t*)"\xf3\x91\x4a\x3a\xf2\x1b\x11\x44\x58\x3e\xf2\xf8\x54\x01\x4b\x72\xfa\x94\x05\x8d\xf9\x7c\x32\x4f\x1a\xef\x49\x37\x3c\xe8\x5b\xef", 32, ctx);

warn encoding-escape-soup src/test/test_ec_ws.c:447:41

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)

    mont_new_from_bytes(&y1, (uint8_t*)"\x23\xaa\x65\x85\x4c\xc5\xbc\x53\x0d\x4f\xe7\x3e\xd9\x58\x95\x67\xb2\xea\x79\x1a\x7c\x9b\xe5\xf6\x78\x8c\xd5\xbe\xd8\x55\x0d\xe7", 32, ctx);

warn encoding-escape-soup src/test/test_ec_ws.c:495:40

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)

    wp2 = new_workplace(ctx);
    mont_new_from_bytes(&b, (uint8_t*)"\x5a\xc6\x35\xd8\xaa\x3a\x93\xe7\xb3\xeb\xbd\x55\x76\x98\x86\xbc\x65\x1d\x06\xb0\xcc\x53\xb0\xf6\x3b\xce\x3c\x3e\x27\xd2\x60\x4b", 32, ctx);

    /* 1*G */

warn encoding-escape-soup src/test/test_ec_ws.c:501:41

32 consecutive `\xNN` escapes (entropy 4.7 bits/byte) (raw pass, confidence 0.80)

    mont_new_number(&z1, 1, ctx);
    mont_new_from_bytes(&x2, (uint8_t*)"\x2e\xee\x33\x80\xcb\xba\x96\xcb\xb7\x61\x04\xf5\xe4\x6a\x89\x78\xa6\x22\xe7\x07\xcb\x30\x04\x49\x8e\x4c\x3c\xba\x75\xf7\x99\xe0", 32, ctx);

warn encoding-escape-soup src/test/test_ec_ws.c:502:41

32 consecutive `\xNN` escapes (entropy 4.7 bits/byte) (raw pass, confidence 0.80)

    mont_new_from_bytes(&y2, (uint8_t*)"\x1e\xe0\x9c\xe0\xed\x08\xfc\x10\x95\x0f\x30\xe8\xd8\x9c\x2c\xdd\xb6\x0e\x01\x67\x2f\xed\xb4\x13\xf5\x1e\x84\x12\x2d\x79\x33\x95", 32, ctx);

warn encoding-escape-soup src/test/test_ec_ws.c:517:33

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)

    mont_to_bytes(buffer, 32, x1, ctx);
    assert(0 == memcmp(buffer, "\x6b\x17\xd1\xf2\xe1\x2c\x42\x47\xf8\xbc\xe6\xe5\x63\xa4\x40\xf2\x77\x03\x7d\x81\x2d\xeb\x33\xa0\xf4\xa1\x39\x45\xd8\x98\xc2\x96", 32));
    mont_to_bytes(buffer, 32, y1, ctx);

warn encoding-escape-soup src/test/test_ec_ws.c:519:33

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)

    mont_to_bytes(buffer, 32, y1, ctx);
    assert(0 == memcmp(buffer, "\x4f\xe3\x42\xe2\xfe\x1a\x7f\x9b\x8e\xe7\xeb\x4a\x7c\x0f\x9e\x16\x2b\xce\x33\x57\x6b\x31\x5e\xce\xcb\xb6\x40\x68\x37\xbf\x51\xf5", 32));

    /* 0*G */

warn encoding-escape-soup src/test/test_ec_ws.c:536:41

5 rows of escape runs, lines 536-544 (first: 32 consecutive `\xNN` escapes (entropy 5.0 bits/byte)) (raw pass, confidence 0.80)

    free(y2);
    mont_new_from_bytes(&x2, (uint8_t*)"\xde\x24\x44\xbe\xbc\x8d\x36\xe6\x82\xed\xd2\x7e\x0f\x27\x15\x08\x61\x75\x19\xb3\x22\x1a\x8f\xa0\xb7\x7c\xab\x39\x89\xda\x97\xc9", 32, ctx);

warn encoding-escape-soup src/test/test_ec_ws.c:587:40

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)

    wp2 = new_workplace(ctx);
    mont_new_from_bytes(&b, (uint8_t*)"\x5a\xc6\x35\xd8\xaa\x3a\x93\xe7\xb3\xeb\xbd\x55\x76\x98\x86\xbc\x65\x1d\x06\xb0\xcc\x53\xb0\xf6\x3b\xce\x3c\x3e\x27\xd2\x60\x4b", 32, ctx);
    prot_g = ec_scramble_g_p256(ctx, 0x1010);

warn encoding-escape-soup src/test/test_ec_ws.c:618:33

32 consecutive `\xNN` escapes (entropy 4.6 bits/byte) (raw pass, confidence 0.80)

    mont_to_bytes(buffer, 32, xw, ctx);
    assert(0 == memcmp(buffer, "\x30\x1d\x9e\x50\x2d\xc7\xe0\x5d\xa8\x5d\xa0\x26\xa7\xae\x9a\xa0\xfa\xc9\xdb\x7d\x52\xa9\x5b\x3e\x3e\x3f\x9a\xa0\xa1\xb4\x5b\x8b", 32));
    mont_to_bytes(buffer, 32, yw, ctx);

warn encoding-escape-soup src/test/test_ec_ws.c:620:33

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)

    mont_to_bytes(buffer, 32, yw, ctx);
    assert(0 == memcmp(buffer, "\x65\x51\xb6\xf6\xb3\x06\x12\x23\xe0\xd2\x3c\x02\x6b\x01\x7d\x72\x29\x8d\x9a\xe4\x68\x87\xca\x61\xd5\x8d\xb6\xae\xa1\x7e\xe2\x67", 32));

    /* 32*G */

warn encoding-escape-soup src/test/test_ec_ws.c:626:33

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)

    mont_to_bytes(buffer, 32, xw, ctx);
    assert(0 == memcmp(buffer, "\x23\x77\xc7\xd6\x90\xa2\x42\xca\x6c\x45\x07\x4e\x8e\xa5\xbe\xef\xaa\x55\x7f\xd5\xb6\x83\x71\xd9\xd1\x47\x5b\xd5\x2a\x7e\xd0\xe1", 32));
    mont_to_bytes(buffer, 32, yw, ctx);

warn encoding-escape-soup src/test/test_ec_ws.c:628:33

32 consecutive `\xNN` escapes (entropy 4.8 bits/byte) (raw pass, confidence 0.80)

    mont_to_bytes(buffer, 32, yw, ctx);
    assert(0 == memcmp(buffer, "\x47\xa1\x3f\xb9\x84\x13\xa4\x39\x3f\x8d\x90\xe9\xbf\x90\x1b\x7e\x66\x58\xa6\xcd\xec\xf4\x67\x16\xe7\xc0\x67\xb1\xdd\xb8\xd2\xb2", 32));

    /* (order+1)*G */

warn encoding-escape-soup src/test/test_ec_ws.c:634:33

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)

    mont_to_bytes(buffer, 32, x1, ctx);
    assert(0 == memcmp(buffer, "\x6b\x17\xd1\xf2\xe1\x2c\x42\x47\xf8\xbc\xe6\xe5\x63\xa4\x40\xf2\x77\x03\x7d\x81\x2d\xeb\x33\xa0\xf4\xa1\x39\x45\xd8\x98\xc2\x96", 32));
    mont_to_bytes(buffer, 32, y1, ctx);

warn encoding-escape-soup src/test/test_ec_ws.c:636:33

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)

    mont_to_bytes(buffer, 32, y1, ctx);
    assert(0 == memcmp(buffer, "\x4f\xe3\x42\xe2\xfe\x1a\x7f\x9b\x8e\xe7\xeb\x4a\x7c\x0f\x9e\x16\x2b\xce\x33\x57\x6b\x31\x5e\xce\xcb\xb6\x40\x68\x37\xbf\x51\xf5", 32));

    /* order*G */

warn encoding-escape-soup src/test/test_ec_ws.c:646:33

32 consecutive `\xNN` escapes (entropy 4.8 bits/byte) (raw pass, confidence 0.80)

    mont_to_bytes(buffer, 32, x1, ctx);
    assert(0 == memcmp(buffer, "\xfc\x85\x6a\x26\x35\x51\x2a\x83\x44\x35\x55\x97\xbd\xbf\xa9\x3d\x33\x70\x2a\x48\xb0\x9d\x02\xbd\x1d\xc4\xfd\x4b\x5a\x4c\x6c\x09", 32));
    mont_to_bytes(buffer, 32, y1, ctx);

warn encoding-escape-soup src/test/test_ec_ws.c:648:33

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)

    mont_to_bytes(buffer, 32, y1, ctx);
    assert(0 == memcmp(buffer, "\xcf\x0d\xc7\x68\x18\x61\xa0\xb7\x29\x22\xa9\xce\x17\xf1\x58\x22\x31\x1a\xab\x2a\x14\xc4\xbd\xb0\xc4\x32\xea\xfe\x93\x9a\x4a\x47", 32));

    /* exponent is too long */

warn encoding-escape-soup src/test/test_ec_ws.c:818:31

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)

    ec_ws_get_xy(bufx, bufy, 32, ecp);
    assert(0 == memcmp(bufx, "\x7c\xf2\x7b\x18\x8d\x03\x4f\x7e\x8a\x52\x38\x03\x04\xb5\x1a\xc3\xc0\x89\x69\xe2\x77\xf2\x1b\x35\xa6\x0b\x48\xfc\x47\x66\x99\x78", 32));

warn encoding-escape-soup src/test/test_ec_ws.c:819:31

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)

    assert(0 == memcmp(bufy, "\x07\x77\x55\x10\xdb\x8e\xd0\x40\x29\x3d\x9a\xc6\x9f\x74\x30\xdb\xba\x7d\xad\xe6\x3c\xe9\x82\x29\x9e\x04\xb7\x9d\x22\x78\x73\xd1", 32));

    ec_ws_free_point(ecp);

warn encoding-escape-soup src/test/test_ec_ws.c:886:31

66 consecutive `\xNN` escapes (entropy 5.7 bits/byte) (raw pass, confidence 0.80)

    assert(0 == memcmp(bufx, "\x01\x28\x79\x44\x2F\x24\x50\xC1\x19\xE7\x11\x9A\x5F\x73\x8B\xE1\xF1\xEB\xA9\xE9\xD7\xC6\xCF\x41\xB3\x25\xD9\xCE\x6D\x64\x31\x06\xE9\xD6\x11\x24\xA9\x1A\x96\xBC\xF2\x01\x30\x5A\x9D\xEE\x55\xFA\x79\x13\x6D\xC7\x00\x83\x1E\x54\xC3\xCA\x4F\xF2\x64\x6B\xD3\xC3\x6B\xC6", 66));

warn encoding-escape-soup src/test/test_ec_ws.c:887:31

66 consecutive `\xNN` escapes (entropy 5.9 bits/byte) (raw pass, confidence 0.80)

    assert(0 == memcmp(bufy, "\x01\x98\x64\xA8\xB8\x85\x5C\x24\x79\xCB\xEF\xE3\x75\xAE\x55\x3E\x23\x93\x27\x1E\xD3\x6F\xAD\xFC\x44\x94\xFC\x05\x83\xF6\xBD\x03\x59\x88\x96\xF3\x98\x54\xAB\xEA\xE5\xF9\xA6\x51\x5A\x02\x1E\x2C\x0E\xEF\x13\x9E\x71\xDE\x61\x01\x43\xF5\x33\x82\xF4\x10\x4D\xCC\xB5\x43", 66));

warn encoding-escape-soup src/test/test_ec_ws.c:933:31

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)

    ec_ws_get_xy(bufx, bufy, 32, ecp);
    assert(0 == memcmp(bufx, "\x5e\xcb\xe4\xd1\xa6\x33\x0a\x44\xc8\xf7\xef\x95\x1d\x4b\xf1\x65\xe6\xc6\xb7\x21\xef\xad\xa9\x85\xfb\x41\x66\x1b\xc6\xe7\xfd\x6c", 32));

warn encoding-escape-soup src/test/test_ec_ws.c:934:31

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)

    assert(0 == memcmp(bufy, "\x87\x34\x64\x0c\x49\x98\xff\x7e\x37\x4b\x06\xce\x1a\x64\xa2\xec\xd8\x2a\xb0\x36\x38\x4f\xb8\x3d\x9a\x79\xb1\x27\xa2\x7d\x50\x32", 32));

    ec_ws_free_point(ecp);

warn encoding-escape-soup src/test/test_ec_ws.c:979:31

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)

    ec_ws_get_xy(bufx, bufy, 32, ecp);
    assert(0 == memcmp(bufx, "\xf2\x49\x10\x4d\x0e\x6f\x8f\x29\xe6\x01\x62\x77\x78\x0c\xda\x84\xdc\x84\xb8\x3b\xc3\xd8\x99\xdf\xb7\x36\xca\x08\x31\xfb\xe8\xcf", 32));

warn encoding-escape-soup src/test/test_ec_ws.c:980:31

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)

    assert(0 == memcmp(bufy, "\xb5\x7e\x12\xfc\xdb\x03\x1f\x59\xca\xb8\x1b\x1c\x6b\x1e\x1c\x07\xe4\x51\x2e\x52\xce\x83\x2f\x1a\x0c\xed\xef\xff\x8b\x43\x40\xe9", 32));

    ec_ws_free_point(ecp);

warn encoding-escape-soup src/test/test_ec_ws.c:1022:31

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)

    ec_ws_get_xy(bufx, bufy, 32, ecp);
    assert(0 == memcmp(bufx, "\x6b\x17\xd1\xf2\xe1\x2c\x42\x47\xf8\xbc\xe6\xe5\x63\xa4\x40\xf2\x77\x03\x7d\x81\x2d\xeb\x33\xa0\xf4\xa1\x39\x45\xd8\x98\xc2\x96", 32));

warn encoding-escape-soup src/test/test_ec_ws.c:1023:31

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)

    assert(0 == memcmp(bufy, "\xb0\x1c\xbd\x1c\x01\xe5\x80\x65\x71\x18\x14\xb5\x83\xf0\x61\xe9\xd4\x31\xcc\xa9\x94\xce\xa1\x31\x34\x49\xbf\x97\xc8\x40\xae\x0a", 32));

    ec_ws_free_point(ecp);

warn encoding-escape-soup src/test/test_mont.c:357:46

66 consecutive `\xNN` escapes (entropy 5.9 bits/byte) (raw pass, confidence 0.80)

    res = mont_new_from_bytes(&p, (uint8_t*)"\x01\xE9\xF3\x4F\x60\xAD\x5C\x4B\x98\x8A\xB4\x3A\x0C\x1C\x40\xFB\x5C\xB0\xFD\x1A\x1A\x6F\x4E\x81\xEB\x33\xDE\x7D\x95\x2E\xE2\x62\x0D\x76\x08\x3B\xA2\x28\xCC\x56\xA4\xFE\xD2\xF6\x08\xF3\x17\x1E\x59\x41\xB7\xE1\x6D\x20\x05\xEB\x9F\x55\x6B\x6B\xA1\x36\x0E\xC2\x35\x8C", 66, ctx)

warn encoding-escape-soup src/test/test_mont.c:365:45

66 consecutive `\xNN` escapes (entropy 5.8 bits/byte) (raw pass, confidence 0.80)

    assert(0 == memcmp(buf_p521, (uint8_t*)"\x01\xF5\xDD\xE7\xED\xB2\xAD\x9D\x06\x2F\x2C\xAE\x1B\x66\x95\xC0\x9B\xE6\x16\xDA\xEA\x07\x2A\xC8\x2A\xFB\x44\xF4\x21\x79\xE1\x38\x8B\x1C\xEF\x91\xBA\xD3\xEB\x1D\x81\xE5\x45\xEF\x54\x63\xD7\x0A\xED\x39\x70\xFC\xD5\x95\xFF\x1B\xA7\x52\x11\xD3\xC3\x3C\x2C\x14\x42\x51", 66));

info ~~critical~~ → info by review dynamic-execution Doc/conf.py:83:25

`eval` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
    if line.startswith("version_info"):
        version_tuple = eval(line.split("=")[1])

version = release = "%d.%d" % version_tuple[:-1]
```
likely benign LLM, confidence 0.80 Sphinx docs config that evals a version tuple parsed from a source file.
Reasoning
The eval runs on a version_info line read from a project-controlled file during the CPython docs build. It is a common but unsafe pattern, and the input is not attacker-controlled in normal use, so it reads as a legitimate build script rather than a dropper.
info identifier-low-length Doc/sphinx_rtd_theme/static/js/badge_only.js:1:1

91 of 163 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)

info long-line Doc/sphinx_rtd_theme/static/js/badge_only.js:1:1

line length 934 characters (raw pass, confidence 0.50)

!function(e){var t={};function r(n){if(t[n])return t[n].exports;var o=t[n]={i:n,l:!1,exports:{}};return e[n].call(o.exports,o,o.exports,r),o.l=!0,o.exports}r.m=e,r.c=t,r.d=function(e,t,n){r.o(e,t)||Object.defineProperty(e,t,{enumerable:!0,get:n})},r.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.d

info ~~warn~~ → info by review long-line Doc/sphinx_rtd_theme/static/js/theme.js:1:1

line length 5023 characters (raw pass, confidence 0.65)
```
!function(n){var e={};function t(i){if(e[i])return e[i].exports;var o=e[i]={i:i,l:!1,exports:{}};return n[i].call(o.exports,o,o.exports,t),o.l=!0,o.exports}t.m=n,t.c=e,t.d=function(n,e,i){t.o(n,e)||Object.defineProperty(n,e,{enumerable:!0,get:i})},t.r=function(n){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.d
```
likely benign LLM, confidence 0.90 Minified Sphinx RTD theme JavaScript bundle.
Reasoning
The long line is a minified JavaScript bundle (webpack/UMD style module loader), a routine artifact of minified front-end code with no suspicious behaviour shown.
info ~~warn~~ → info by review encoding-base64 INSTALL.rst:146:2

base64-like blob (2949 bytes over 47 lines, compression ratio 0.76) (raw pass, confidence 0.60)
```
 
 mQINBFTXjPgBEADc3j7vnma9MXRshBPPXXenVpthQD6lrF/3XaBT2RptSf/viOD+
 tz85du5XVp+r0SYYGeMNJCQ9NsztxblN/lnKgkfWRmSrB+V6QGS+e3bR5d9OIxzN
 7haPxBnyRj//hCT/kKis6fa7N9wtwKBBjbaSX+9vpt7Rrt203sKfcChA4iR3EG89
```
likely benign LLM, confidence 0.85 Embedded PGP public key block in install documentation.
Reasoning
The base64 block begins with a PGP public key header pattern (mQINBF...), typical of a published signing key in documentation. Raw-pass base64 hits have a high false-positive rate.
info whitespace-anomaly lib/Cryptodome/Cipher/_EKSBlowfish.pyi:10:1

file mixes tab and space indentation (2 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
```
def new(key: Buffer,
        mode: int,
	salt: Buffer,
	cost: int) -> EcbMode: ...
```
info whitespace-anomaly lib/Cryptodome/Hash/BLAKE2b.pyi:7:1

file mixes tab and space indentation (11 tab-indented and 12 space-indented lines) (raw pass, confidence 0.40)
```
class BLAKE2b_Hash(object):
    block_size: int
    digest_size: int
    oid: str
```
info whitespace-anomaly lib/Cryptodome/Hash/BLAKE2s.pyi:6:1

file mixes tab and space indentation (7 tab-indented and 11 space-indented lines) (raw pass, confidence 0.40)
```
class BLAKE2s_Hash(object):
    block_size: int
    digest_size: int
    oid: str
```
info whitespace-anomaly lib/Cryptodome/Hash/CMAC.pyi:9:1

file mixes tab and space indentation (6 tab-indented and 12 space-indented lines) (raw pass, confidence 0.40)
```
class CMAC(object):
    digest_size: int

    def __init__(self,
```
info whitespace-anomaly lib/Cryptodome/Hash/HMAC.pyi:9:1

file mixes tab and space indentation (3 tab-indented and 10 space-indented lines) (raw pass, confidence 0.40)
```
class HMAC(object):
    digest_size: int

    def __init__(self,
```
info whitespace-anomaly lib/Cryptodome/Hash/KMAC128.pyi:8:1

file mixes tab and space indentation (3 tab-indented and 18 space-indented lines) (raw pass, confidence 0.40)
```
    def __init__(self,
                 data: Buffer,
                 key: Buffer,
```
info whitespace-anomaly lib/Cryptodome/Hash/KMAC256.pyi:8:1

file mixes tab and space indentation (1 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
```
def new(key: Buffer,
        data: Buffer = ...,
	    mac_len: int = ...,
        custom: Buffer = ...) -> KMAC_Hash: ...
```
info whitespace-anomaly lib/Cryptodome/Hash/SHA512.pyi:6:1

file mixes tab and space indentation (1 tab-indented and 11 space-indented lines) (raw pass, confidence 0.40)
```
class SHA512Hash(object):
    digest_size: int
    block_size: int
    oid: str
```
info whitespace-anomaly lib/Cryptodome/Hash/TupleHash128.pyi:7:1

file mixes tab and space indentation (4 tab-indented and 10 space-indented lines) (raw pass, confidence 0.40)
```
class TupleHash(object):
    digest_size: int
    def __init__(self,
		         custom: bytes,
```
info whitespace-anomaly lib/Cryptodome/Hash/TupleHash256.pyi:4:1

file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
```
def new(digest_bytes: int = ...,
	    digest_bits: int = ...,
        custom: int = ...) -> TupleHash: ...
```

info whitespace-anomaly lib/Cryptodome/IO/PEM.pyi:4:1

file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)

def encode(data: bytes,
           marke: str,
	   passphrase: Optional[bytes] = ...,
	   randfunc: Optional[Callable[[int],bytes]] = ...) -> str: ...

info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/Cipher/test_pkcs1_15.py:72:1

base64-like blob (812 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                '''-----BEGIN RSA PRIVATE KEY-----
MIICXAIBAAKBgQDAiAnvIAOvqVwJTaYzsKnefZftgtXGE2hPJppGsWl78yz9jeXY
W/FxX/gTPURArNhdnhP6n3p2ZaDIBrO2zizbgIXs0IsljTTcr4vnI8fMXzyNUOjA
zP3nzMqZDZK6757XQAobOssMkBFqRWwilT/3DsBhRpl3iMUhF+wvpTSHewIDAQAB
```
likely benign LLM, confidence 0.92 RSA private key test vector in a cryptography self-test.
Reasoning
The snippet is an RSA private key in a self-test file, used as a fixed test vector for the PKCS#1 v1.5 cipher tests.
info ~~warn~~ → info by review dynamic-attribute lib/Cryptodome/SelfTest/Hash/test_HMAC.py:534:37

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            t[2] = row[2][modname]
            t.append(dict(digestmod=globals()[modname]))
            exp_test_data.append(t)
    tests = make_mac_tests(HMAC, "HMAC", exp_test_data)
```
likely benign LLM, confidence 0.85 Test helper resolving digest module classes by name via globals().
Reasoning
globals() lookup by modname selects a digest module for building HMAC test cases in a self-test. This is a normal reflective pattern in test generation with no external input or execution of untrusted data.
info whitespace-anomaly lib/Cryptodome/SelfTest/Math/test_Numbers.py:48:1

file mixes tab and space indentation (1 tab-indented and 642 space-indented lines) (raw pass, confidence 0.40)
```
    def setUp(self):
        raise NotImplementedError("To be implemented")
```
info ~~warn~~ → info by review payload-bytes-literal lib/Cryptodome/SelfTest/Math/test_Numbers.py:733:18

bytes literal contains 38 `\xNN` escapes (85% of content) — binary payload shape (ast pass, confidence 0.85)
```
        t2 = 17**100
        expect = b"\xfa\xb2\x11\x87\xc3(y\x07\xf8\xf1n\xdepq\x0b\xca\xf3\xd3B,\xef\xf2\xfbf\xcc)\x8dZ*\x95\x98r\x96\xa8\xd5\xc3}\xe2q:\xa2'z\xf48\xde%\xef\t\x07\xbc\xc4[C\x8bUE2\x90\xef\x81\xaa:\x08"
        self.assertEqual(expect, modmult(t1, t2, modulus))
```
likely benign LLM, confidence 0.90 Expected binary output constant in a modular arithmetic test.
Reasoning
The bytes literal is an expected modular-multiplication result in a math self-test. Binary test vectors written as escapes are normal in cryptographic test suites and are only compared, never executed.

info long-line lib/Cryptodome/SelfTest/Math/test_modexp.py:88:1

line length 526 characters (raw pass, confidence 0.50)

exponent1 = 0x2ce0af628901460a419a08ef950d498b9fd6f271a1a52ac293b86fe5c60efe8e8ba93fa1ebe1eb3d614d2e7b328cb60a2591440e163441a190ecf101ceec245f600fffdcf3f5b3a17a7baeacb96a424db1d7ec985e8ec998bb479fecfffed6a75f9a90fc97062fd973303bce855ad7b8d8272a94025e8532be9aabd54a183f303538d2a7e621b4131d59e823a4625f39bd7d518d7784f7c3a8

info long-line lib/Cryptodome/SelfTest/Math/test_modexp.py:89:1

line length 525 characters (raw pass, confidence 0.50)

modulus1 = 0xd66691b20071be4d66d4b71032b37fa007cfabf579fcb91e50bfc2753b3f0ce7be74e216aef7e26d4ae180bc20d7bd3ea88a6cbf6f87380e613c8979b5b043b200a8ff8856a3b12875e36e98a7569f3852d028e967551000b02c19e9fa52e83115b89309aabb1e1cf1e2cb6369d637d46775ce4523ea31f64ad2794cbc365dd8a35e007ed3b57695877fbf102dbeb8b3212491398e494314e93

info long-line lib/Cryptodome/SelfTest/Math/test_modmult.py:82:1

line length 525 characters (raw pass, confidence 0.50)

modulus1 = 0xd66691b20071be4d66d4b71032b37fa007cfabf579fcb91e50bfc2753b3f0ce7be74e216aef7e26d4ae180bc20d7bd3ea88a6cbf6f87380e613c8979b5b043b200a8ff8856a3b12875e36e98a7569f3852d028e967551000b02c19e9fa52e83115b89309aabb1e1cf1e2cb6369d637d46775ce4523ea31f64ad2794cbc365dd8a35e007ed3b57695877fbf102dbeb8b3212491398e494314e93

info long-line lib/Cryptodome/SelfTest/Math/test_modmult.py:106:1

line length 535 characters (raw pass, confidence 0.50)

        expect_int = 0x8edf4071f78e3d7ba622cdbbbef74612e301d69186776ae6bf87ff38c320d9aebaa64889c2f67de2324e6bccd2b10ad89e91fd21ba4bb523904d033eff5e70e62f01a84f41fa90a4f248ef249b82e1d2729253fdfc2a3b5b740198123df8bfbf7057d03e15244ad5f26eb9a099763b5c5972121ec076b0bf899f59bd95f7cc129abddccf24217bce52ca0f3a44c9ccc504765dbb8

info unicode-homoglyph lib/Cryptodome/SelfTest/Protocol/test_KDF.py:611:15

identifier `ΔημοσιεύθηκεστηνΕφημερίδατης` contains homoglyph candidates: η (03B7)→n, ο (03BF)→o, η (03B7)→n, κ (03BA)→k (in string/comment) (raw pass, confidence 0.35)
```
            ("ΔημοσιεύθηκεστηνΕφημερίδατης", 4, b"E5SQtS6P4568MDXW7cyUp.", b"$2a$04$E5SQtS6P4568MDXW7cyUp.18wfDisKZBxifnPZjAI1d/KTYMfHPYO"),
```
info unicode-mixed-script lib/Cryptodome/SelfTest/Protocol/test_KDF.py:611:15

identifier `ΔημοσιεύθηκεστηνΕφημερίδατης` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
```
            ("ΔημοσιεύθηκεστηνΕφημερίδατης", 4, b"E5SQtS6P4568MDXW7cyUp.", b"$2a$04$E5SQtS6P4568MDXW7cyUp.18wfDisKZBxifnPZjAI1d/KTYMfHPYO"),
```
info ~~critical~~ → info by review dynamic-import lib/Cryptodome/SelfTest/Protocol/test_KDF.py:713:12

`__import__` called on a non-literal expression (ast pass, confidence 0.90)
```
def load_hash_by_name(hash_name):
    return __import__("Cryptodome.Hash." + hash_name, globals(), locals(), ["new"])
```
likely benign LLM, confidence 0.80 Test helper dynamically importing a Cryptodome hash module by name.
Reasoning
__import__ is called with a prefix plus a hash name that comes from the test parameter list, loading a known Cryptodome.Hash submodule. Inside a test helper with fixed inputs this is low risk, though the pattern is generally discouraged.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/Protocol/test_ecdh.py:154:63

8 rows of base64-like lines, lines 154-159 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
    static_priv = ECC.import_key('-----BEGIN PRIVATE KEY-----\nMIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg9VHFVKh2a1aVFifH\n+BiyNaRa2kttEg3165Ye/dJxJ7KhRANCAARImIEXro5ZOcyWU2mq/+d79FEZXtTA\nbKkz1aICQXihQdCMzRNbeNtC9LFLzhu1slRKJ2xsDAlw9r6w6vwtkRzr\n-----END PRIVATE KEY-----')
```
likely benign LLM, confidence 0.92 EC private key PEM fixture in an ECDH self-test.
Reasoning
The multi-line string is a PEM-encoded EC private key used as a fixed fixture for ECDH tests in a cryptography library.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_DSA.py:85:1

base64-like blob (592 bytes over 10 lines, compression ratio 0.81) (raw pass, confidence 0.60)
```
-----BEGIN PUBLIC KEY-----
MIIBtzCCASsGByqGSM44BAEwggEeAoGBAOdW7hcX9LZ5THwhRyShl2N0LEVXK0s/
j/O0Tzvp9EzgOaJ1dpXskVaX2nTvkU/NGwVmDiQZx2HWOfRdLXm4AtvSPnq4uBtH
mjgOHzCTJYS6KguVUDI0LryDy1ypBuew181v5lbOy0yLWncSOoxnUKSB47BgV6/2
```
likely benign LLM, confidence 0.93 DSA public key PEM test vector.
Reasoning
The block is a PEM DSA public key used as a test vector for key import tests in a cryptography library.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_DSA.py:147:1

base64-like blob (596 bytes over 10 lines, compression ratio 0.81) (raw pass, confidence 0.60)
```
-----BEGIN DSA PRIVATE KEY-----
MIIBuwIBAAKBgQDnVu4XF/S2eUx8IUckoZdjdCxFVytLP4/ztE876fRM4DmidXaV
7JFWl9p075FPzRsFZg4kGcdh1jn0XS15uALb0j56uLgbR5o4Dh8wkyWEuioLlVAy
NC68g8tcqQbnsNfNb+ZWzstMi1p3EjqMZ1CkgeOwYFev9qpuumILgy1gwwIVAK0y
```
likely benign LLM, confidence 0.93 DSA private key PEM test vector.
Reasoning
The block is a PEM DSA private key used as a fixture for key import tests in a self-test file.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_DSA.py:209:1

base64-like blob (448 bytes over 7 lines, compression ratio 0.82) (raw pass, confidence 0.60)
```
-----BEGIN PRIVATE KEY-----
MIIBSgIBADCCASsGByqGSM44BAEwggEeAoGBAOdW7hcX9LZ5THwhRyShl2N0LEVX
K0s/j/O0Tzvp9EzgOaJ1dpXskVaX2nTvkU/NGwVmDiQZx2HWOfRdLXm4AtvSPnq4
uBtHmjgOHzCTJYS6KguVUDI0LryDy1ypBuew181v5lbOy0yLWncSOoxnUKSB47Bg
```
likely benign LLM, confidence 0.93 PKCS#8 DSA private key test fixture.
Reasoning
The block is a PKCS#8 DSA private key shown as a test fixture in the import tests, consistent with the rest of the test file.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_DSA.py:237:24

base64-like blob (580 bytes, compression ratio 0.82) (raw pass, confidence 0.60)
```
    ssh_pub="""ssh-dss AAAAB3NzaC1kc3MAAACBAOdW7hcX9LZ5THwhRyShl2N0LEVXK0s/j/O0Tzvp9EzgOaJ1dpXskVaX2nTvkU/NGwVmDiQZx2HWOfRdLXm4AtvSPnq4uBtHmjgOHzCTJYS6KguVUDI0LryDy1ypBuew181v5lbOy0yLWncSOoxnUKSB47BgV6/2qm66YguDLWDDAAAAFQCtMvSM064MRaGYph+kteIDIHY7IwAAAIB539w9YU/mNfzrfq6uNxjcLv77RSgpk6xnSdyDwiPYwYhyljFrOwtURmz0RPNLguNVT
```
likely benign LLM, confidence 0.93 OpenSSH DSA public key test vector.
Reasoning
The string is an OpenSSH-format DSA public key used as a test vector for SSH key import in the same self-test file.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_DSA.py:260:1

base64-like blob (600 bytes over 10 lines, compression ratio 0.81) (raw pass, confidence 0.60)
```
4V6GHRDpCrdZ8MBjbyp5AlGUrjvr2Pn2e2zVxy5RBt4FBj9/pa0ae0nnyUPMLSUU
kKyOR0topRYTVRLElm4qVrb5uNZ3hRwfbklr+pSrB7O9eHz9V5sfOQxyODS07JxK
k1OdOs70/ouMXLF9EWfAZOmWUccZKHNblUwg1p1UrZIz5jXw4dUE/zqhvXh6d+iC
```
likely benign LLM, confidence 0.97 Base64-encoded DSA key test vector in a PyCryptodome self-test.
Reasoning
Raw base64 flag on a block of encoded key material inside a self-test file for a cryptography library; test vectors are expected to be encoded keys. No execution or decoding of payloads is present.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_DSA.py:297:1

base64-like blob (500 bytes over 8 lines, compression ratio 0.82) (raw pass, confidence 0.60)
```
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIBcTAbBgkqhkiG9w0BBQMwDgQI0GC3BJ/jSw8CAggABIIBUHc1cXZpExIE9tC7
7ryiW+5ihtF2Ekurq3e408GYSAu5smJjN2bvQXmzRFBz8W38K8eMf1sbWroZ4+zn
kZSbb9nSm5kAa8lR2+oF2k+WRswMR/PTC3f/D9STO2X0QxdrzKgIHEcSGSHp5jTx
```
likely benign LLM, confidence 0.97 Encrypted private key PEM test fixture.
Reasoning
Encrypted PKCS#8 PEM test vector in a crypto library's import tests; the blob is an expected test fixture, not an obfuscated payload.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_DSA.py:390:1

base64-like blob (1140 bytes over 18 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIDUjCCArsCAQIwDQYJKoZIhvcNAQEFBQAwfjENMAsGA1UEChMEQWNtZTELMAkG
A1UECxMCUkQxHDAaBgkqhkiG9w0BCQEWDXNwYW1AYWNtZS5vcmcxEzARBgNVBAcT
Ck1ldHJvcG9saXMxETAPBgNVBAgTCE5ldyBZb3JrMQswCQYDVQQGEwJVUzENMAsG
```
likely benign LLM, confidence 0.97 X.509 certificate PEM test fixture.
Reasoning
Certificate PEM fixture used for import testing in a cryptography library's self-test suite.
info ~~warn~~ → info by review dynamic-attribute lib/Cryptodome/SelfTest/PublicKey/test_import_DSA.py:452:24

reach-by-name through `locals` (ast pass, confidence 0.60)
```
        for comp_name in ('y', 'p', 'q', 'g'):
            comp_str = locals()[comp_name + "_str"]
            comp = int(re.sub("[^0-9a-f]", "", comp_str), 16)
            self.assertEqual(getattr(key, comp_name), comp)
```
likely benign LLM, confidence 0.93 Test loop reading local variables by constructed name to compare DSA key components.
Reasoning
locals() lookup of names like y_str built from a fixed tuple is a common test-parametrization idiom; the keys are constant strings and no untrusted input reaches the lookup.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_DSA.py:462:1

base64-like blob (1892 bytes over 30 lines, compression ratio 0.75) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIFhjCCA26gAwIBAgIBAzANBgkqhkiG9w0BAQsFADBhMQswCQYDVQQGEwJVUzEL
MAkGA1UECAwCTUQxEjAQBgNVBAcMCUJhbHRpbW9yZTEQMA4GA1UEAwwHVGVzdCBD
QTEfMB0GCSqGSIb3DQEJARYQdGVzdEBleGFtcGxlLmNvbTAeFw0xNDA3MTMyMDUz
```
likely benign LLM, confidence 0.97 X.509 certificate PEM test fixture.
Reasoning
Certificate PEM fixture in a crypto library test file; expected test data.
info ~~warn~~ → info by review dynamic-attribute lib/Cryptodome/SelfTest/PublicKey/test_import_DSA.py:536:24

reach-by-name through `locals` (ast pass, confidence 0.60)
```
        for comp_name in ('y', 'p', 'q', 'g'):
            comp_str = locals()[comp_name + "_str"]
            comp = int(re.sub("[^0-9a-f]", "", comp_str), 16)
            self.assertEqual(getattr(key, comp_name), comp)
```
likely benign LLM, confidence 0.93 Test loop reading local variables by constructed name to compare DSA key components.
Reasoning
Same fixed-tuple locals() lookup idiom repeated in another test method; benign test code.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_ECC.py:1124:9

base64-like blob (132 bytes over 3 lines, compression ratio 1.01) (raw pass, confidence 0.60)
```
        pem1 = """-----BEGIN EC PRIVATE KEY-----
        MF8CAQEEGHvhXmIW95JxZYfd4AUPu9BwknjuvS36aqAKBggqhkjOPQMBAaE0AzIA
        BLJZCyTu35DQIlqvMlBynn3k1Ig+dWfg/brRhHecxptrbloqFSP8ITw0CwbGF+2X
        5g==
```
likely benign LLM, confidence 0.97 EC private key PEM test fixture.
Reasoning
Short EC private key PEM literal in a test module; expected fixture data for key import tests.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_ECC.py:1131:9

base64-like blob (132 bytes over 3 lines, compression ratio 1.00) (raw pass, confidence 0.60)
```
        pem2 = """-----BEGIN EC PRIVATE KEY-----
        MF8CAQEEGA3rAotUaWl7d47eX6tz9JmLzOMJwl13XaAKBggqhkjOPQMBAaE0AzIA
        BG4tHlTBBBGokcWmGm2xubVB0NvPC/Ou5AYwivs+3iCxmEjsymVAj6iiuX2Lxr6g
        /Q==
```
likely benign LLM, confidence 0.97 EC private key PEM test fixture.
Reasoning
Second EC private key PEM test fixture in the same ECC import self-test.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_ECC.py:1379:9

base64-like blob (144 bytes over 3 lines, compression ratio 0.98) (raw pass, confidence 0.60)
```
        pem1 = """-----BEGIN EC PRIVATE KEY-----
        MGgCAQEEHPYicBNI9nd6wDKAX2l+f3A0Q+KWUQeMqSt5GoOgBwYFK4EEACGhPAM6
        AATCL6rUIDT14zXKoS5GQUMDP/tpc+1iI/FyEZikt2roKDkhU5q08srmqaysbfJN
        eUr7Xf1lnCVGag==
```
likely benign LLM, confidence 0.97 EC private key PEM test fixture.
Reasoning
EC key PEM test vector with standard structure, used in import tests of a crypto library.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_ECC.py:1386:9

base64-like blob (144 bytes over 3 lines, compression ratio 0.97) (raw pass, confidence 0.60)
```
        pem2 = """-----BEGIN EC PRIVATE KEY-----
        MGgCAQEEHEFjbaVPLJ3ngZyCibCvT0RLUqSlHjC5Z3e0FtugBwYFK4EEACGhPAM6
        AAT5IvL2V6m48y1JLMGr6ZbnOqNKP9hMf9mxyVkk6/SaRoBoJVkXrNIpYL0P7DS7
        QF8E/OGeZRwvow==
```
likely benign LLM, confidence 0.97 EC private key PEM test fixture.
Reasoning
Second EC key PEM test vector in the same self-test; expected fixture.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_ECC.py:1669:9

base64-like blob (120 bytes over 2 lines, compression ratio 1.02) (raw pass, confidence 0.60)
```
        pem1 = """-----BEGIN EC PRIVATE KEY-----
        MFcCAQEEIHTuc09jC51xXomV6MVCDN+DpAAvSmaJWZPTEHM6D5H1oAoGCCqGSM49
        AwEHoSQDIgACWFuGbHe8yJ43rir7PMTE9w8vHz0BSpXHq90Xi7/s+a0=
        -----END EC PRIVATE KEY-----"""
```
likely benign LLM, confidence 0.97 EC private key PEM test fixture.
Reasoning
Short EC private key PEM literal with END marker, a standard test fixture for ECC import tests.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_ECC.py:1675:9

base64-like blob (120 bytes over 2 lines, compression ratio 1.02) (raw pass, confidence 0.60)
```
        pem2 = """-----BEGIN EC PRIVATE KEY-----
        MFcCAQEEIFggiPN9SQP+FAPTCPp08fRUz7rHp2qNBRcBJ1DXhb3ZoAoGCCqGSM49
        AwEHoSQDIgADLpph1trTIlVfa8NJvlMUPyWvL+wP+pW3BJITUL/wj9A=
        -----END EC PRIVATE KEY-----"""
```
likely benign LLM, confidence 0.97 EC private key PEM test fixture.
Reasoning
Second short EC key PEM fixture in the same test; benign test data.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_ECC.py:1958:1

base64-like blob (224 bytes over 4 lines, compression ratio 0.92) (raw pass, confidence 0.60)
```
        pem1 = """-----BEGIN EC PRIVATE KEY-----
MIGkAgEBBDAM0lEIhvXuekK2SWtdbgOcZtBaxa9TxfpO/GcDFZLCJ3JVXaTgwken
QT+C+XLtD6WgBwYFK4EEACKhZANiAATs0kZMhFDu8DoBC21jrSDPyAUn4aXZ/DM4
ylhDfWmb4LEbeszXceIzfhIUaaGs5y1xXaqf5KXTiAAYx2pKUzAAM9lcGUHCGKJG
```
likely benign LLM, confidence 0.97 Base64 body of a PEM EC private key used as a test fixture in PyCryptodome's import tests.
Reasoning
The blob is a PEM-encoded EC test private key inside a unit test for key import, which is the expected content of a cryptographic library's self-test suite. Base64 is the standard PEM encoding, not obfuscation.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_ECC.py:1966:1

base64-like blob (224 bytes over 4 lines, compression ratio 0.90) (raw pass, confidence 0.60)
```
        pem2 = """-----BEGIN EC PRIVATE KEY-----
MIGkAgEBBDDHPFTslYLltE16fHdSDTtE/2HTmd3M8mqy5MttAm4wZ833KXiGS9oe
kFdx9sNV0KygBwYFK4EEACKhZANiAASLIE5RqVMtNhtBH/u/p/ifqOAlKnK/+RrQ
YC46ZRsnKNayw3wATdPjgja7L/DSII3nZK0G6KOOVwJBznT/e+zudUJYhZKaBLRx
```
likely benign LLM, confidence 0.97 Base64 body of a second PEM EC private key test fixture.
Reasoning
Same pattern: a PEM EC private key fixture in a self-test module; expected for testing key parsing.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_ECC.py:2257:1

base64-like blob (300 bytes over 5 lines, compression ratio 0.86) (raw pass, confidence 0.60)
```
        pem1 = """-----BEGIN EC PRIVATE KEY-----
MIHcAgEBBEIAnm1CEjVjvNfXEN730p+D6su5l+mOztdc5XmTEoti+s2R4GQ4mAv3
0zYLvyklvOHw0+yy8d0cyGEJGb8T3ZVKmg2gBwYFK4EEACOhgYkDgYYABAHzjTI1
ckxQ3Togi0LAxiG0PucdBBBs5oIy3df95xv6SInp70z+4qQ2EltEmdNMssH8eOrl
```
likely benign LLM, confidence 0.97 Base64 PEM EC private key fixture for import tests.
Reasoning
PEM-armored EC private key inside a test string literal; the ASN.1 structure visible in the base64 (MIHc...) is consistent with a genuine key encoding, not a payload.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_ECC.py:2266:1

base64-like blob (300 bytes over 5 lines, compression ratio 0.86) (raw pass, confidence 0.60)
```
        pem2 = """-----BEGIN EC PRIVATE KEY-----
MIHcAgEBBEIB84OfhJluLBRLn3+cC/RQ37C2SfQVP/t0gQK2tCsTf5avRcWYRrOJ
PmX9lNnkC0Hobd75QFRmdxrB0Wd1/M4jZOWgBwYFK4EEACOhgYkDgYYABAAMZcdJ
1YLCGHt3bHCEzdidVy6+brlJIbv1aQ9fPQLF7WKNv4c8w3H8d5a2+SDZilBOsk5c
```
likely benign LLM, confidence 0.97 Base64 PEM EC private key fixture for import tests.
Reasoning
Another PEM EC key test fixture in the same self-test file; no execution or decoding logic is involved.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_RSA.py:82:1

base64-like blob (428 bytes over 7 lines, compression ratio 0.84) (raw pass, confidence 0.60)
```
    rsaKeyPEM = u'''-----BEGIN RSA PRIVATE KEY-----
MIIBOwIBAAJBAL8eJ5AKoIsjURpcEoGubZMxLD7+kT+TLr7UkvEtFrRhDDKMtuII
q19FrL4pUIMymPMSLBn3hJLe30Dw48GQM4UCAwEAAQJACUSDEp8RTe32ftq8IwG8
Wojl5mAd1wFiIOrZ/Uv8b963WJOJiuQcVN29vxU5+My9GPZ7RA3hrDBEAoHUDPrI
```
likely benign LLM, confidence 0.97 Base64 PEM RSA private key fixture for import tests.
Reasoning
PEM RSA private key literal in a PyCryptodome self-test; the RSA test keys are well-known public test vectors and the block is a legitimate fixture.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_RSA.py:93:1

base64-like blob (460 bytes over 8 lines, compression ratio 0.82) (raw pass, confidence 0.60)
```
    rsaKeyPEM8 = u'''-----BEGIN PRIVATE KEY-----
MIIBVQIBADANBgkqhkiG9w0BAQEFAASCAT8wggE7AgEAAkEAvx4nkAqgiyNRGlwS
ga5tkzEsPv6RP5MuvtSS8S0WtGEMMoy24girX0WsvilQgzKY8xIsGfeEkt7fQPDj
wZAzhQIDAQABAkAJRIMSnxFN7fZ+2rwjAbxaiOXmYB3XAWIg6tn9S/xv3rdYk4mK
```
likely benign LLM, confidence 0.97 Base64 PKCS#8 PEM RSA key fixture for tests.
Reasoning
PKCS#8 PEM private key fixture in the RSA import self-tests; matches the expected test data for format conversions.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_RSA.py:112:1

base64-like blob (428 bytes over 7 lines, compression ratio 0.83) (raw pass, confidence 0.60)
```
Ckl9ex1kaVEWhYC2QBmfaF+YPiR4NFkRXA7nj3dcnuFEzBnY5XULupqQpQI3qbfA
u8GYS7+b3toWWiHZivHbAAUBPDIZG9hKDyB9Sq2VMARGsX1yW1zhNvZLIiVJzUHs
C6NxQ1IJWOXzTew/xM2I26kPwHIvadq+/VaT8gLQdjdH0jOiVNaevjWnLgrn1mLP
```
likely benign LLM, confidence 0.97 Base64 key body continuation in RSA import test data.
Reasoning
Continuation of a PEM key literal in a test file; the blob is a key body, not hidden code.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_RSA.py:123:1

base64-like blob (568 bytes over 9 lines, compression ratio 0.80) (raw pass, confidence 0.60)
```
        ('winter', u'''-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIBpjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIeZIsbW3O+JcCAggA
MBQGCCqGSIb3DQMHBAgSM2p0D8FilgSCAWBhFyP2tiGKVpGj3mO8qIBzinU60ApR
3unvP+N6j7LVgnV2lFGaXbJ6a1PbQXe+2D6DUyBLo8EMXrKKVLqOMGkFMHc0UaV6
```
likely benign LLM, confidence 0.96 Base64 encrypted PKCS#8 PEM key fixture for passphrase import tests.
Reasoning
Encrypted PKCS#8 PEM key with a passphrase label in a test tuple, a standard test case for password-protected key import.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_RSA.py:137:1

base64-like blob (128 bytes over 2 lines, compression ratio 0.98) (raw pass, confidence 0.60)
```
    rsaPublicKeyPEM = u'''-----BEGIN PUBLIC KEY-----
MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAL8eJ5AKoIsjURpcEoGubZMxLD7+kT+T
Lr7UkvEtFrRhDDKMtuIIq19FrL4pUIMymPMSLBn3hJLe30Dw48GQM4UCAwEAAQ==
-----END PUBLIC KEY-----'''
```
likely benign LLM, confidence 0.97 Base64 RSA public key PEM fixture for tests.
Reasoning
Public key PEM block in a test literal; public key data is inert and expected in this test module.
info ~~warn~~ → info by review high-complexity lib/Cryptodome/SelfTest/PublicKey/test_import_RSA.py:142:32

string literal compression ratio 0.970 (134 bytes) (raw pass, confidence 0.60)
```
    # Obtained using 'ssh-keygen -i -m PKCS8 -f rsaPublicKeyPEM'
    rsaPublicKeyOpenSSH = b('''ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAQQC/HieQCqCLI1EaXBKBrm2TMSw+/pE/ky6+1JLxLRa0YQwyjLbiCKtfRay+KVCDMpjzEiwZ94SS3t9A8OPBkDOF comment\n''')

    # The private key, in PKCS#1 format encoded with DER
```
likely benign LLM, confidence 0.95 OpenSSH ssh-rsa public key string literal used in a test.
Reasoning
The high compression ratio is a string of an OpenSSH public key with a comment, passed through b(); this is a standard test vector for ssh-rsa import and the raw-pass heuristic is noisy on base64 text.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_RSA.py:142:40

base64-like blob (116 bytes, compression ratio 1.03) (raw pass, confidence 0.60)
```
    # Obtained using 'ssh-keygen -i -m PKCS8 -f rsaPublicKeyPEM'
    rsaPublicKeyOpenSSH = b('''ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAQQC/HieQCqCLI1EaXBKBrm2TMSw+/pE/ky6+1JLxLRa0YQwyjLbiCKtfRay+KVCDMpjzEiwZ94SS3t9A8OPBkDOF comment\n''')

    # The private key, in PKCS#1 format encoded with DER
```
likely benign LLM, confidence 0.96 OpenSSH ssh-rsa public key base64 body in a test literal.
Reasoning
Same OpenSSH public key literal flagged again as a base64 blob; it is the encoded public key text from a test comment-documented conversion.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_RSA.py:476:1

base64-like blob (768 bytes over 12 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIICOjCCAaMCAQEwDQYJKoZIhvcNAQEEBQAwfjENMAsGA1UEChMEQWNtZTELMAkG
A1UECxMCUkQxHDAaBgkqhkiG9w0BCQEWDXNwYW1AYWNtZS5vcmcxEzARBgNVBAcT
Ck1ldHJvcG9saXMxETAPBgNVBAgTCE5ldyBZb3JrMQswCQYDVQQGEwJVUzENMAsG
```
likely benign LLM, confidence 0.97 Embedded PEM certificate test vector in PyCryptodome self-tests.
Reasoning
Base64 body of a PEM certificate embedded as a test vector in a crypto library's self-test suite; expected for test data.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/PublicKey/test_import_RSA.py:516:1

base64-like blob (1524 bytes over 24 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIEcjCCAlqgAwIBAgIBATANBgkqhkiG9w0BAQsFADBhMQswCQYDVQQGEwJVUzEL
MAkGA1UECAwCTUQxEjAQBgNVBAcMCUJhbHRpbW9yZTEQMA4GA1UEAwwHVGVzdCBD
QTEfMB0GCSqGSIb3DQEJARYQdGVzdEBleGFtcGxlLmNvbTAeFw0xNDA3MTIwOTM1
```
likely benign LLM, confidence 0.97 Embedded PEM certificate fixture in import tests.
Reasoning
Base64 PEM certificate fixture inside a unit test for key import; legitimate test data.
info ~~critical~~ → info by review dynamic-import lib/Cryptodome/SelfTest/Signature/test_dss.py:60:12

`__import__` called on a non-literal expression (ast pass, confidence 0.90)
```
def load_hash_by_name(hash_name):
    return __import__("Cryptodome.Hash." + hash_name, globals(), locals(), ["new"])
```
likely benign LLM, confidence 0.90 Helper that dynamically imports a hash module by name in DSS tests.
Reasoning
__import__ with a prefix plus hash name to load Cryptodome.Hash modules is a standard dynamic hash lookup in a test helper; the hash name comes from test vectors, not untrusted input.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/Signature/test_dss.py:246:1

base64-like blob (124 bytes over 2 lines, compression ratio 1.01) (raw pass, confidence 0.60)
```
        key = ECC.import_key("""-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAECtmVACiNRmlAAx1yqfVEWk1DeEZA
hVvwpph00t5f4QPFAR5u8sQtzVDV09Kfma5uuiyAySRPTFQi8Jef8MO6Xg==
-----END PUBLIC KEY-----""")
```
likely benign LLM, confidence 0.95 Test vector EC public key in PEM form.
Reasoning
PEM-encoded ECC public key literal used as a test vector for key import.

info encoding-base64 lib/Cryptodome/SelfTest/Signature/test_dss.py:683:50

base64-like blob (68 bytes, compression ratio 0.96) (outside string/comment) (raw pass, confidence 0.30)


    key_priv_p256 = ECC.construct(curve="P-256", d=0xC9AFA9D845BA75166B5C215767B1D6934E50C3DB36E89B127B8A622B120F6721)
    key_pub_p256 = key_priv_p256.public_key()

info high-complexity lib/Cryptodome/SelfTest/Signature/test_dss.py:1005:14

compression ratio 0.682 is >2σ above file mean 0.655 (raw pass, confidence 0.50)

            "01511BB4D675114FE266FC4372B87682BAECC01D3CC62CF2303C92B3526012659D16876E25C7C1E57648F23B73564D67F61C6F14D527D54972810421E7D87589E1A7",
            "004A171143A83163D6DF460AAF61522695F207A58B95C0644D87E52AA1A347916E4F7A72930B1BC06DBE22CE3F58264AFD23704CBB63B29B931F7DE6C9D949A7ECFC",
            SHA256

info ~~critical~~ → info by review dynamic-import lib/Cryptodome/SelfTest/Signature/test_pkcs1_15.py:52:12

`__import__` called on a non-literal expression (ast pass, confidence 0.90)
```
def load_hash_by_name(hash_name):
    return __import__("Cryptodome.Hash." + hash_name, globals(), locals(), ["new"])
```
likely benign LLM, confidence 0.90 Test helper dynamically importing Cryptodome.Hash modules by name.
Reasoning
Same dynamic hash-module loader pattern in a PKCS1 test helper with trusted test-vector inputs.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/Signature/test_pkcs1_15.py:153:13

base64-like blob (428 bytes over 7 lines, compression ratio 0.84) (raw pass, confidence 0.60)
```
    rsakey = """-----BEGIN RSA PRIVATE KEY-----
            MIIBOwIBAAJBAL8eJ5AKoIsjURpcEoGubZMxLD7+kT+TLr7UkvEtFrRhDDKMtuII
            q19FrL4pUIMymPMSLBn3hJLe30Dw48GQM4UCAwEAAQJACUSDEp8RTe32ftq8IwG8
            Wojl5mAd1wFiIOrZ/Uv8b963WJOJiuQcVN29vxU5+My9GPZ7RA3hrDBEAoHUDPrI
```
likely benign LLM, confidence 0.95 Hardcoded RSA private key test vector.
Reasoning
Embedded RSA private key test vector in a signature self-test; expected test data.
info ~~critical~~ → info by review dynamic-import lib/Cryptodome/SelfTest/Signature/test_pss.py:48:12

`__import__` called on a non-literal expression (ast pass, confidence 0.90)
```
def load_hash_by_name(hash_name):
    return __import__("Cryptodome.Hash." + hash_name, globals(), locals(), ["new"])
```
likely benign LLM, confidence 0.90 Test helper that loads a hash module by name.
Reasoning
Dynamic hash-module import helper in PSS self-tests with fixed test inputs; standard library-testing idiom.
info ~~warn~~ → info by review encoding-base64 lib/Cryptodome/SelfTest/Signature/test_pss.py:65:49

24 rows of base64-like lines, lines 65-65 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
    rsa_key = b'-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEAsvI34FgiTK8+txBvmooNGpNwk23YTU51dwNZi5yha3W4lA/Q\nvcZrDalkmD7ekWQwnduxVKa6pRSI13KBgeUOIqJoGXSWhntEtY3FEwvWOHW5AE7Q\njUzTzCiYT6TVaCcpa/7YLai+p6ai2g5f5Zfh4jSawa9uYeuggFygQq4IVW796MgV\nyqxYMM/arEj+/sKz3Viua9Rp9fFosertCYCX4DUTgW0mX9bwEnEOgjSI3pLOPXz1\n8vx+DRZ
```
likely benign LLM, confidence 0.93 Embedded RSA private key test vector.
Reasoning
Base64 RSA private key literal in a test file; a known test vector pattern.
info ~~warn~~ → info by review payload-bytes-literal lib/Cryptodome/SelfTest/Signature/test_pss.py:67:11

bytes literal contains 162 `\xNN` escapes (87% of content) — binary payload shape (ast pass, confidence 0.85)
```
    tag = b'\x00[c5\xd8\xb0\x8b!D\x81\x83\x07\xc0\xdd\xb9\xb4\xb2`\x92\xe7\x02\xf1\xe1P\xea\xc3\xf0\xe3>\xddX5\xdd\x8e\xc5\x89\xef\xf3\xc2\xdc\xfeP\x02\x7f\x12+\xc9\xaf\xbb\xec\xfe\xb0\xa5\xb9\x08\x11P\x8fL\xee5\x9b\xb0k{=_\xd2\x14\xfb\x01R\xb7\xfe\x14}b\x03\x8d5Y\x89~}\xfc\xf2l\xd01-\xbd\xeb\x11\xcdV\x11\xe9l\x19k/o5\
```
likely benign LLM, confidence 0.92 Binary expected-signature tag bytes literal in PSS test.
Reasoning
Bytes literal with escaped binary is an expected expected-tag constant for signature test vectors in a crypto library.
info whitespace-anomaly lib/Cryptodome/Util/number.py:38:1

file mixes tab and space indentation (2 tab-indented and 1321 space-indented lines) (raw pass, confidence 0.40)
```
def ceil_div(n, d):
    """Return ceil(n/d), that is, the smallest integer r such that r*d >= n"""

    if d == 0:
```
info ~~critical~~ → info by review dynamic-import setup.py:188:29

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
                # Import sub-package or module
                moduleObj = __import__(full_module, globals(), locals(), module_name)

            print(package_root + ".Math implementation:",
```
likely benign LLM, confidence 0.85 setup.py dynamically imports a package submodule to report the math implementation.
Reasoning
Setup script imports a module named from its own package layout (full_module built from package/module names) to check the implementation; this is a build-time introspection pattern, though the dynamic name warrants a note.
info ~~critical~~ → info by review dynamic-execution setup.py:503:29

`eval` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
        if line.startswith("version_info"):
            version_tuple = eval(line.split("=")[1])

version_string = ".".join([str(x) for x in version_tuple])
```
likely benign LLM, confidence 0.85 setup.py evals a version_info line from a source file to build the version string.
Reasoning
eval of the version_info line read from a source file to compute the version tuple is a known setup.py idiom, but it runs on package-owned source at import time; reading the project's own version file, not attacker-controlled input in practice.
info identifier-low-length src/MD4.c:1:1

229 of 476 non-conventional identifiers are single-character (48%) (token pass, confidence 0.50)
info ~~warn~~ → info by review macro-keyword-override src/common.h:89:1

`#define inline` rebinds the reserved C keyword `inline` (token pass, confidence 0.85)
```
#define inline _inline
#define RESTRICT __restrict
```
likely benign LLM, confidence 0.85 Header macro remapping inline for compiler compatibility.
Reasoning
Defining inline to _inline in a C header is a portability shim for compilers; it is a compatibility pattern, though rebinding keywords is unusual.
info ~~warn~~ → info by review macro-keyword-override src/common.h:101:1

`#define inline` rebinds the reserved C keyword `inline` (token pass, confidence 0.85)
```
#define RESTRICT __restrict
#define inline __inline
#else
#define RESTRICT
```
likely benign LLM, confidence 0.85 Conditional header macro mapping inline to __inline for MSVC.
Reasoning
Same conditional compiler-portability shim mapping inline to __inline in an alternate branch of a preprocessor conditional.
info ~~warn~~ → info by review encoding-escape-soup src/ec_ws_p256.c:48:29

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    const uint8_t  b[32] = "\x5a\xc6\x35\xd8\xaa\x3a\x93\xe7\xb3\xeb\xbd\x55\x76\x98\x86\xbc\x65\x1d\x06\xb0\xcc\x53\xb0\xf6\x3b\xce\x3c\x3e\x27\xd2\x60\x4b";
    const uint8_t order[32] = "\xff\xff\xff\xff\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xbc\xe6\xfa\xad\xa7\x17\x9e\x84\xf3\xb9\xca\xc2\xfc\x63\x25\x51";
```
likely benign LLM, confidence 0.97 P-256 curve constant b embedded as a byte array.
Reasoning
The bytes are the P-256 curve coefficient b, a published standard constant. Byte-array literals for curve parameters are the normal way to embed them in crypto C code, so the escape run is a formatting choice, not concealment.
info ~~warn~~ → info by review encoding-escape-soup src/ec_ws_p256.c:50:34

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    const uint8_t p256_Gx[32] = "\x6b\x17\xd1\xf2\xe1\x2c\x42\x47\xf8\xbc\xe6\xe5\x63\xa4\x40\xf2\x77\x03\x7d\x81\x2d\xeb\x33\xa0\xf4\xa1\x39\x45\xd8\x98\xc2\x96";
```
likely benign LLM, confidence 0.97 P-256 group order n embedded as a byte array.
Reasoning
The bytes are the P-256 group order n, which begins with the well-known 0xFFFFFFFF00000000FFFF... pattern. It is a standard public parameter in a crypto library source file.
info ~~warn~~ → info by review encoding-escape-soup src/ec_ws_p256.c:51:34

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    const uint8_t p256_Gy[32] = "\x4f\xe3\x42\xe2\xfe\x1a\x7f\x9b\x8e\xe7\xeb\x4a\x7c\x0f\x9e\x16\x2b\xce\x33\x57\x6b\x31\x5e\xce\xcb\xb6\x40\x68\x37\xbf\x51\xf5";
    uint8_t x[32], y[32];
    uint8_t exp[32];
```
likely benign LLM, confidence 0.97 P-256 generator coordinate Gx as a byte array.
Reasoning
The bytes are the P-256 base point x-coordinate Gx, a public standard value. Escaped byte literals for curve constants are ordinary in this kind of test or implementation code.
info ~~warn~~ → info by review encoding-escape-soup src/ec_ws_p384.c:50:32

48 consecutive `\xNN` escapes (entropy 5.5 bits/byte) (raw pass, confidence 0.80)
```
    const uint8_t  b[BYTES] = "\xb3\x31\x2f\xa7\xe2\x3e\xe7\xe4\x98\x8e\x05\x6b\xe3\xf8\x2d\x19\x18\x1d\x9c\x6e\xfe\x81\x41\x12\x03\x14\x08\x8f\x50\x13\x87\x5a\xc6\x56\x39\x8d\x8a\x2e\xd1\x9d\x2a\x85\xc8\xed\xd3\xec\x2a\xef";
```
likely benign LLM, confidence 0.97 P-384 curve constant b embedded as a byte array.
Reasoning
The 48 bytes match the P-384 curve coefficient b, a published standard constant. The raw pass flags escape runs with a high false-positive rate, and this is a legitimate parameter table.
info ~~warn~~ → info by review encoding-escape-soup src/ec_ws_p384.c:52:37

48 consecutive `\xNN` escapes (entropy 5.4 bits/byte) (raw pass, confidence 0.80)
```
    const uint8_t p384_Gx[BYTES] = "\xaa\x87\xca\x22\xbe\x8b\x05\x37\x8e\xb1\xc7\x1e\xf3\x20\xad\x74\x6e\x1d\x3b\x62\x8b\xa7\x9b\x98\x59\xf7\x41\xe0\x82\x54\x2a\x38\x55\x02\xf2\x5d\xbf\x55\x29\x6c\x3a\x54\x5e\x38\x72\x76\x0a\xb7";
```
likely benign LLM, confidence 0.97 P-384 generator coordinate Gx as a byte array.
Reasoning
The bytes are the P-384 base point x-coordinate, a public standard value. It sits next to the other curve constants in the same file, which fits a crypto library's parameter section.
info ~~warn~~ → info by review encoding-escape-soup src/ec_ws_p384.c:53:37

48 consecutive `\xNN` escapes (entropy 5.4 bits/byte) (raw pass, confidence 0.80)
```
    const uint8_t p384_Gy[BYTES] = "\x36\x17\xde\x4a\x96\x26\x2c\x6f\x5d\x9e\x98\xbf\x92\x92\xdc\x29\xf8\xf4\x1d\xbd\x28\x9a\x14\x7c\xe9\xda\x31\x13\xb5\xf0\xb8\xc0\x0a\x60\xb1\xce\x1d\x7e\x81\x9d\x7a\x43\x1d\x7c\x90\xea\x0e\x5f";
    uint8_t x[BYTES], y[BYTES];
    uint8_t exp[BYTES];
```
likely benign LLM, confidence 0.97 P-384 generator coordinate Gy as a byte array.
Reasoning
The bytes are the P-384 base point y-coordinate, a public standard value. It is a legitimate curve parameter, not a payload.
info ~~warn~~ → info by review encoding-escape-soup src/ec_ws_p521.c:50:31

4 rows of escape runs, lines 50-53 (first: 66 consecutive `\xNN` escapes (entropy 5.9 bits/byte)) (raw pass, confidence 0.80)
```
    const uint8_t b[BYTES] = "\x00\x51\x95\x3e\xb9\x61\x8e\x1c\x9a\x1f\x92\x9a\x21\xa0\xb6\x85\x40\xee\xa2\xda\x72\x5b\x99\xb3\x15\xf3\xb8\xb4\x89\x91\x8e\xf1\x09\xe1\x56\x19\x39\x51\xec\x7e\x93\x7b\x16\x52\xc0\xbd\x3b\xb1\xbf\x07\x35\x73\xdf\x88\x3d\x2c\x34\xf1\xef\x45\x1f\xd4\x6b\x50\x3f\x00";
```
likely benign LLM, confidence 0.97 P-521 curve constant b embedded as a multi-row byte array.
Reasoning
The run is the P-521 curve constant b, which has a leading 0x00 byte to fit the 66-byte field. Multi-row escape literals for published curve parameters are standard practice in crypto code.
info ~~warn~~ → info by review encoding-escape-soup src/ed25519_perf.c:53:29

32 consecutive `\xNN` escapes (entropy 4.8 bits/byte) (raw pass, confidence 0.80)
```
    const uint8_t Gx[32] = "\x21\x69\x36\xd3\xcd\x6e\x53\xfe\xc0\xa4\xe2\x31\xfd\xd6\xdc\x5c\x69\x2c\xc7\x60\x95\x25\xa7\xb2\xc9\x56\x2d\x60\x8f\x25\xd5\x1a";
    const uint8_t Gy[32] = "\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x58";
```
likely benign LLM, confidence 0.96 Ed25519 base point x-coordinate as a byte array in a benchmark.
Reasoning
The bytes are the Ed25519 base point x-coordinate Gx, a public standard value. The file is a performance benchmark, and benchmarks commonly embed test vectors like this.
info ~~warn~~ → info by review encoding-escape-soup src/ed448_perf.c:56:36

56 consecutive `\xNN` escapes (entropy 5.6 bits/byte) (raw pass, confidence 0.80)
```
    double duration_ms, rate;
    const uint8_t Gx[COORD_LEN] = "\x4f\x19\x70\xc6\x6b\xed\x0d\xed\x22\x1d\x15\xa6\x22\xbf\x36\xda\x9e\x14\x65\x70\x47\x0f\x17\x67\xea\x6d\xe3\x24\xa3\xd3\xa4\x64\x12\xae\x1a\xf7\x2a\xb6\x65\x11\x43\x3b\x80\xe1\x8b\x00\x93\x8e\x26\x26\xa8\x2b\xc7\x0c\xc0\x5e";
```
likely benign LLM, confidence 0.97 Ed448 base point x-coordinate as a byte array in a benchmark.
Reasoning
The 56 bytes are the Ed448 base point x-coordinate, a public standard value. The benchmark file uses it as an ordinary test input.
info ~~warn~~ → info by review encoding-escape-soup src/ed448_perf.c:57:36

56 consecutive `\xNN` escapes (entropy 5.7 bits/byte) (raw pass, confidence 0.80)
```
    const uint8_t Gy[COORD_LEN] = "\x69\x3f\x46\x71\x6e\xb6\xbc\x24\x88\x76\x20\x37\x56\xc9\xc7\x62\x4b\xea\x73\x73\x6c\xa3\x98\x40\x87\x78\x9c\x1e\x05\xa0\xc2\xd7\x3a\xd3\xff\x1c\xe6\x7c\x39\xc4\xfd\xbd\x13\x2c\x4e\xd7\xc8\xad\x98\x08\x79\x5b\xf2\x30\xfa\x14";

#define ITERATIONS 5000U
```
likely benign LLM, confidence 0.97 Ed448 base point y-coordinate as a byte array in a benchmark.
Reasoning
The 56 bytes are the Ed448 base point y-coordinate, a public standard value, placed in a benchmark file alongside Gx.
info identifier-low-length src/hash_SHA2_template.c:1:1

692 of 1297 non-conventional identifiers are single-character (53%) (token pass, confidence 0.50)
info ~~warn~~ → info by review encoding-escape-soup src/make_p256_table.c:27:29

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    const uint8_t  b[32] = "\x5a\xc6\x35\xd8\xaa\x3a\x93\xe7\xb3\xeb\xbd\x55\x76\x98\x86\xbc\x65\x1d\x06\xb0\xcc\x53\xb0\xf6\x3b\xce\x3c\x3e\x27\xd2\x60\x4b";
    const uint8_t order[32] = "\xff\xff\xff\xff\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xbc\xe6\xfa\xad\xa7\x17\x9e\x84\xf3\xb9\xca\xc2\xfc\x63\x25\x51";
```
likely benign LLM, confidence 0.97 P-256 curve constant b in a precomputation table generator.
Reasoning
This is the same P-256 curve constant b as in the library file. The generator script being a table builder for these constants makes the literal expected, and the raw pass over-flags escape runs.
info ~~warn~~ → info by review encoding-escape-soup src/make_p256_table.c:29:34

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    const uint8_t p256_Gx[32] = "\x6b\x17\xd1\xf2\xe1\x2c\x42\x47\xf8\xbc\xe6\xe5\x63\xa4\x40\xf2\x77\x03\x7d\x81\x2d\xeb\x33\xa0\xf4\xa1\x39\x45\xd8\x98\xc2\x96";
```
likely benign LLM, confidence 0.97 P-256 generator coordinate Gx in a precomputation table generator.
Reasoning
This is the P-256 base point Gx, matching the constants in the library, used here by a generator that precomputes the P-256 table. It is public curve data.
info ~~warn~~ → info by review encoding-escape-soup src/make_p256_table.c:30:34

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    const uint8_t p256_Gy[32] = "\x4f\xe3\x42\xe2\xfe\x1a\x7f\x9b\x8e\xe7\xeb\x4a\x7c\x0f\x9e\x16\x2b\xce\x33\x57\x6b\x31\x5e\xce\xcb\xb6\x40\x68\x37\xbf\x51\xf5";
    uint8_t xz[32] = { 0 }, yz[32] = { 0 };
    EcContext *ec_ctx;
```
likely benign LLM, confidence 0.97 Hard-coded P-256 generator Y-coordinate bytes in a table generator.
Reasoning
The escape run is the P-256 generator coordinate Gy written as a byte string literal in a cryptographic table generator. Raw pass escape-run heuristics fire on any hex-constant table; this is standard curve constant data.
info ~~warn~~ → info by review encoding-escape-soup src/make_p384_table.c:27:32

48 consecutive `\xNN` escapes (entropy 5.5 bits/byte) (raw pass, confidence 0.80)
```
    const uint8_t  b[BYTES] = "\xb3\x31\x2f\xa7\xe2\x3e\xe7\xe4\x98\x8e\x05\x6b\xe3\xf8\x2d\x19\x18\x1d\x9c\x6e\xfe\x81\x41\x12\x03\x14\x08\x8f\x50\x13\x87\x5a\xc6\x56\x39\x8d\x8a\x2e\xd1\x9d\x2a\x85\xc8\xed\xd3\xec\x2a\xef";
```
likely benign LLM, confidence 0.97 P-384 curve constant bytes in a table generator.
Reasoning
Byte string of a P-384 curve constant (b parameter) used to build precomputed tables; a legitimate cryptographic constant encoded as escapes.
info ~~warn~~ → info by review encoding-escape-soup src/make_p384_table.c:29:37

48 consecutive `\xNN` escapes (entropy 5.4 bits/byte) (raw pass, confidence 0.80)
```
    const uint8_t p384_Gx[BYTES] = "\xaa\x87\xca\x22\xbe\x8b\x05\x37\x8e\xb1\xc7\x1e\xf3\x20\xad\x74\x6e\x1d\x3b\x62\x8b\xa7\x9b\x98\x59\xf7\x41\xe0\x82\x54\x2a\x38\x55\x02\xf2\x5d\xbf\x55\x29\x6c\x3a\x54\x5e\x38\x72\x76\x0a\xb7";
```
likely benign LLM, confidence 0.97 P-384 generator X-coordinate constant.
Reasoning
Standard P-384 generator X-coordinate bytes; raw escape-run heuristic over legitimate crypto constant data.

info ~~warn~~ → info by review encoding-escape-soup src/make_p384_table.c:30:37

48 consecutive `\xNN` escapes (entropy 5.4 bits/byte) (raw pass, confidence 0.80)

    const uint8_t p384_Gy[BYTES] = "\x36\x17\xde\x4a\x96\x26\x2c\x6f\x5d\x9e\x98\xbf\x92\x92\xdc\x29\xf8\xf4\x1d\xbd\x28\x9a\x14\x7c\xe9\xda\x31\x13\xb5\xf0\xb8\xc0\x0a\x60\xb1\xce\x1d\x7e\x81\x9d\x7a\x43\x1d\x7c\x90\xea\x0e\x5f";
    uint8_t xz[BYTES] = { 0 }, yz[BYTES] = { 0 };
    EcContext *ec_ctx;

likely benign LLM, confidence 0.97 P-384 generator Y-coordinate constant.

Reasoning

Standard P-384 generator Y-coordinate bytes used in a table generator; benign crypto constant.

info ~~warn~~ → info by review encoding-escape-soup src/make_p521_table.c:27:31

4 rows of escape runs, lines 27-30 (first: 66 consecutive `\xNN` escapes (entropy 5.9 bits/byte)) (raw pass, confidence 0.80)
```
    const uint8_t b[BYTES] = "\x00\x51\x95\x3e\xb9\x61\x8e\x1c\x9a\x1f\x92\x9a\x21\xa0\xb6\x85\x40\xee\xa2\xda\x72\x5b\x99\xb3\x15\xf3\xb8\xb4\x89\x91\x8e\xf1\x09\xe1\x56\x19\x39\x51\xec\x7e\x93\x7b\x16\x52\xc0\xbd\x3b\xb1\xbf\x07\x35\x73\xdf\x88\x3d\x2c\x34\xf1\xef\x45\x1f\xd4\x6b\x50\x3f\x00";
```
likely benign LLM, confidence 0.96 P-521 curve constant bytes in a table generator.
Reasoning
P-521 curve constant encoded as escape runs in a table generator, matching the legitimate pattern of elliptic-curve parameter tables.
info ~~warn~~ → info by review identifier-confusable-collision src/multiply.h:39:14

two identifiers collapse to visual skeleton `b|` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
    uint32_t ah = (uint32_t)(a >> 32);
    uint32_t bl = (uint32_t) b;
    uint32_t bh = (uint32_t)(b >> 32);
```
likely benign LLM, confidence 0.90 Short identifier names bl/bh flagged as confusable with b-prefixed names in multiply.h.
Reasoning
Identifiers bl and bh are ordinary low/high halves of a 64-bit value; the skeleton collision with b| is a naming artifact of the confusable check on short identifiers, with no evidence of deliberate homoglyph use in this snippet.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:95:40

32 consecutive `\xNN` escapes (entropy 4.8 bits/byte) (raw pass, confidence 0.80)
```
    /** Arbitrary point on the curve with Z=10 **/
    mont_new_from_bytes(&x, (uint8_t*)"\xc6\x4c\x90\xad\x8d\x5c\x1d\x96\xd6\x4b\x63\x46\x4a\x8b\x57\x91\xbf\x48\xa6\xb4\xb9\xbc\xd6\xad\x79\xc6\x3a\x13\xbf\xb7\x78\x5b", 32, ctx);
```
likely benign LLM, confidence 0.95 Test vector point coordinate in EC unit test.
Reasoning
Test vector point coordinate bytes passed to mont_new_from_bytes; expected test data in a crypto unit test.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:96:40

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    mont_new_from_bytes(&y, (uint8_t*)"\xe4\x98\x64\xd0\x22\x85\x75\x8a\x11\x79\x68\x2e\x06\x92\x3d\xf7\x62\xa8\x85\xea\xda\xe6\xd9\xb0\x5a\x4f\x0c\x43\x1d\x51\x77\xe4", 32, ctx);
```
likely benign LLM, confidence 0.95 Test vector coordinate in EC unit test.
Reasoning
Test vector Y-coordinate bytes for an EC point in a unit test; benign.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:100:43

32 consecutive `\xNN` escapes (entropy 4.8 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, x, ctx);
    assert(0 == memcmp(buffer, (uint8_t*)"\xfa\x3a\xdb\x43\xa7\xbc\x69\x5c\xc8\xa1\x23\x87\x07\x74\x55\x8e\x93\x20\xdd\x79\x5f\x5f\xaf\x11\x58\xfa\x39\x01\xf9\x92\x58\xd5", 32));
    mont_to_bytes(buffer, 32, y, ctx);
```
likely benign LLM, confidence 0.95 Expected test output bytes for EC point comparison.
Reasoning
Expected output bytes compared with memcmp in an EC unit test; benign test data.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:102:43

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, y, ctx);
    assert(0 == memcmp(buffer, (uint8_t*)"\xe3\xa8\xd6\xe0\xd0\x40\x8b\xc1\xce\x8c\x24\x04\x9a\x41\xd2\xff\x23\x77\x40\x98\x49\x17\x15\xc4\xd5\xd4\xb4\x6d\x1c\x88\x25\x96", 32));

    /** Point-at-infinity **/
```
likely benign LLM, confidence 0.95 Expected test output bytes for EC point Y-coordinate.
Reasoning
Expected Y-coordinate bytes compared in an EC unit test; benign.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:135:40

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    wp = new_workplace(ctx);
    mont_new_from_bytes(&b, (uint8_t*)"\x5a\xc6\x35\xd8\xaa\x3a\x93\xe7\xb3\xeb\xbd\x55\x76\x98\x86\xbc\x65\x1d\x06\xb0\xcc\x53\xb0\xf6\x3b\xce\x3c\x3e\x27\xd2\x60\x4b", 32, ctx);

    /** Arbitrary point on the curve with Z=10 **/
```
likely benign LLM, confidence 0.95 Test vector for an EC point in unit tests.
Reasoning
Test vector bytes for a point in an EC unit test; benign crypto test data.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:138:40

32 consecutive `\xNN` escapes (entropy 4.8 bits/byte) (raw pass, confidence 0.80)
```
    /** Arbitrary point on the curve with Z=10 **/
    mont_new_from_bytes(&x, (uint8_t*)"\xc6\x4c\x90\xad\x8d\x5c\x1d\x96\xd6\x4b\x63\x46\x4a\x8b\x57\x91\xbf\x48\xa6\xb4\xb9\xbc\xd6\xad\x79\xc6\x3a\x13\xbf\xb7\x78\x5b", 32, ctx);
```
likely benign LLM, confidence 0.95 Test vector coordinate in EC unit test.
Reasoning
Repeated test vector coordinate for an EC point in a unit test; benign.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:139:40

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    mont_new_from_bytes(&y, (uint8_t*)"\xe4\x98\x64\xd0\x22\x85\x75\x8a\x11\x79\x68\x2e\x06\x92\x3d\xf7\x62\xa8\x85\xea\xda\xe6\xd9\xb0\x5a\x4f\x0c\x43\x1d\x51\x77\xe4", 32, ctx);
```
likely benign LLM, confidence 0.97 Test input vector of 32 bytes for EC field arithmetic.
Reasoning
Byte-array test vectors for elliptic-curve Montgomery arithmetic in a crypto library test file; the escape run is a literal constant of 32 bytes, typical of known-answer tests.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:144:33

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, x, ctx);
    assert(0 == memcmp(buffer, "\x9e\x0e\xcb\x70\xd6\x15\x88\x5e\x6a\xce\x5a\x03\x41\x89\xd5\xe5\xf8\xb1\x6f\x38\xe5\xc0\x1e\x59\xf5\xcc\xe6\xdf\xb4\xf9\xdd\x02", 32));
    mont_to_bytes(buffer, 32, y, ctx);
```
likely benign LLM, confidence 0.97 Expected 32-byte result constant in an assertion.
Reasoning
Expected output bytes compared with memcmp in a unit test; standard known-answer test data, not obfuscation.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:146:33

32 consecutive `\xNN` escapes (entropy 5.0 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, y, ctx);
    assert(0 == memcmp(buffer, "\xda\x30\xad\x21\x7a\x5d\xe2\x3a\xd6\x86\x12\xd2\x61\xa0\x7b\x51\xff\x05\x3c\x73\xa6\x63\x88\x4b\xa4\xe6\xb6\x84\x71\x9a\xe0\xb4", 32));
    mont_to_bytes(buffer, 32, z, ctx);
```
likely benign LLM, confidence 0.97 Expected 32-byte result constant in an assertion.
Reasoning
Expected-value constant for a crypto unit test assertion; high entropy is expected for cryptographic vectors.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:148:33

32 consecutive `\xNN` escapes (entropy 4.8 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, z, ctx);
    assert(0 == memcmp(buffer, "\x62\x60\x97\xCF\xE5\x64\xFC\xD1\x02\x41\xD7\xD1\x63\xBE\xF2\x41\x3D\xA9\xA8\xD6\x60\x5B\x7B\xB5\x7C\x4E\x4A\x21\x69\xA5\xFA\xC2", 32));

    /** Point-at-infinity **/
```
likely benign LLM, confidence 0.97 Expected 32-byte result constant in an assertion.
Reasoning
Known-answer test constant compared against computed output; legitimate test data.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:163:40

32 consecutive `\xNN` escapes (entropy 5.0 bits/byte) (raw pass, confidence 0.80)
```
    free(z);
    mont_new_from_bytes(&x, (uint8_t*)"\x2b\xad\x3f\x80\xd3\x9a\xc9\x7b\x28\xfd\x2c\xeb\x93\x2d\x82\xe1\xb7\x5b\x3b\xd1\xbc\xe2\xbe\x11\x27\xe5\xa8\x7f\x1c\xc0\xd4\x77", 32, ctx);
    mont_set(y, 0, ctx);
```
likely benign LLM, confidence 0.97 Test input vector of 32 bytes for EC point operations.
Reasoning
Input vector for point-at-infinity test case in an EC library test file; legitimate.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:193:40

5 rows of escape runs, lines 193-200 (first: 32 consecutive `\xNN` escapes (entropy 4.9 bits/byte)) (raw pass, confidence 0.80)
```
    wp = new_workplace(ctx);
    mont_new_from_bytes(&b, (uint8_t*)"\x5a\xc6\x35\xd8\xaa\x3a\x93\xe7\xb3\xeb\xbd\x55\x76\x98\x86\xbc\x65\x1d\x06\xb0\xcc\x53\xb0\xf6\x3b\xce\x3c\x3e\x27\xd2\x60\x4b", 32, ctx);

    /* Arbitrary points */
```
likely benign LLM, confidence 0.97 Multiple test input vectors for EC point arithmetic.
Reasoning
Repeated byte-array test vectors for arbitrary-point EC tests in a test file; legitimate known-answer data.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:204:33

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, x1, ctx);
    assert(0 == memcmp(buffer, "\x13\x6c\x0e\x59\xbe\x5f\xb3\x6f\x98\xce\x1e\xa8\xc3\x14\xf2\xef\x9f\x9e\x53\x99\x8f\xd7\x14\x3a\x98\x86\xeb\x74\xc8\x5a\xf1\xaf", 32));
    mont_to_bytes(buffer, 32, y1, ctx);
```
likely benign LLM, confidence 0.97 Expected 32-byte result constants in assertions.
Reasoning
Expected-value constants for assertions in EC unit tests; legitimate.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:206:33

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, y1, ctx);
    assert(0 == memcmp(buffer, "\xcd\x8f\xd0\xf2\xb2\x1f\xcc\x70\xae\x5a\x7f\xa8\x89\xac\xb8\xa2\x01\xc7\x70\xf9\xa3\xaf\x47\x4a\xc1\xb9\xf1\xc5\x62\xf7\x73\x9a", 32));
    mont_to_bytes(buffer, 32, z1, ctx);
```
likely benign LLM, confidence 0.97 Expected 32-byte result constant in an assertion.
Reasoning
Expected-value constant compared against computed output in a unit test; legitimate.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:208:33

32 consecutive `\xNN` escapes (entropy 4.8 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, z1, ctx);
    assert(0 == memcmp(buffer, "\x7f\x3f\xac\x7e\x49\x3e\x61\x4b\x52\xd8\x49\x31\x8b\x57\xa7\xec\x89\x50\x27\xdb\x75\xbe\xa6\x61\x3c\x54\x42\x89\xb3\x9f\x31\x46", 32));

    /* Affine input point is point-at-infinity */
```
likely benign LLM, confidence 0.97 Expected 32-byte result constant in an assertion.
Reasoning
Expected-value constant in a crypto test assertion; legitimate.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:216:33

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, x1, ctx);
    assert(0 == memcmp(buffer, "\x13\x6c\x0e\x59\xbe\x5f\xb3\x6f\x98\xce\x1e\xa8\xc3\x14\xf2\xef\x9f\x9e\x53\x99\x8f\xd7\x14\x3a\x98\x86\xeb\x74\xc8\x5a\xf1\xaf", 32));
    mont_to_bytes(buffer, 32, y1, ctx);
```
likely benign LLM, confidence 0.97 Expected 32-byte result constant in an assertion.
Reasoning
Expected-value constant for affine point-at-infinity test; legitimate test data.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:218:33

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, y1, ctx);
    assert(0 == memcmp(buffer, "\xcd\x8f\xd0\xf2\xb2\x1f\xcc\x70\xae\x5a\x7f\xa8\x89\xac\xb8\xa2\x01\xc7\x70\xf9\xa3\xaf\x47\x4a\xc1\xb9\xf1\xc5\x62\xf7\x73\x9a", 32));
    mont_to_bytes(buffer, 32, z1, ctx);
```
likely benign LLM, confidence 0.97 Expected 32-byte result constant in an assertion.
Reasoning
Expected-value constant in a unit test assertion; legitimate.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:220:33

32 consecutive `\xNN` escapes (entropy 4.8 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, z1, ctx);
    assert(0 == memcmp(buffer, "\x7f\x3f\xac\x7e\x49\x3e\x61\x4b\x52\xd8\x49\x31\x8b\x57\xa7\xec\x89\x50\x27\xdb\x75\xbe\xa6\x61\x3c\x54\x42\x89\xb3\x9f\x31\x46", 32));

    free(x1);
```
likely benign LLM, confidence 0.97 Expected 32-byte result constant in an assertion.
Reasoning
Expected-value constant in a unit test assertion; legitimate.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:248:40

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    wp = new_workplace(ctx);
    mont_new_from_bytes(&b, (uint8_t*)"\x5a\xc6\x35\xd8\xaa\x3a\x93\xe7\xb3\xeb\xbd\x55\x76\x98\x86\xbc\x65\x1d\x06\xb0\xcc\x53\xb0\xf6\x3b\xce\x3c\x3e\x27\xd2\x60\x4b", 32, ctx);

    /* Projective input point is point-at-infinity */
```
likely benign LLM, confidence 0.97 Known-answer test vector bytes for an elliptic curve point operation test.
Reasoning
These are literal 32-byte test vectors for elliptic curve Montgomery arithmetic in a C unit test file, used as inputs to mont_new_from_bytes and memcmp assertions. Hex escapes for cryptographic test vectors are normal.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:258:41

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    mont_new_from_bytes(&x2, (uint8_t*)"\xf2\x49\x10\x4d\x0e\x6f\x8f\x29\xe6\x01\x62\x77\x78\x0c\xda\x84\xdc\x84\xb8\x3b\xc3\xd8\x99\xdf\xb7\x36\xca\x08\x31\xfb\xe8\xcf", 32, ctx);
```
likely benign LLM, confidence 0.97 Test vector coordinate x2 for elliptic curve addition test.
Reasoning
Byte literal used as a test input point coordinate in an EC unit test. Expected pattern for cryptographic test data.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:259:41

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    mont_new_from_bytes(&y2, (uint8_t*)"\xb5\x7e\x12\xfc\xdb\x03\x1f\x59\xca\xb8\x1b\x1c\x6b\x1e\x1c\x07\xe4\x51\x2e\x52\xce\x83\x2f\x1a\x0c\xed\xef\xff\x8b\x43\x40\xe9", 32, ctx);

    ec_mix_add(x1, y1, z1, x1, y1, z1, x2, y2, b, wp, ctx);
```
likely benign LLM, confidence 0.97 Test vector coordinate y2 for elliptic curve addition test.
Reasoning
Byte literal for test input coordinate y2 in an EC unit test, consistent with surrounding known-answer test structure.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:265:43

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, x1, ctx);
    assert(0 == memcmp(buffer, (uint8_t*)"\xf2\x49\x10\x4d\x0e\x6f\x8f\x29\xe6\x01\x62\x77\x78\x0c\xda\x84\xdc\x84\xb8\x3b\xc3\xd8\x99\xdf\xb7\x36\xca\x08\x31\xfb\xe8\xcf", 32));
    mont_to_bytes(buffer, 32, y1, ctx);
```
likely benign LLM, confidence 0.97 Expected result coordinate compared against computed point in test.
Reasoning
Expected output bytes compared with memcmp after a Montgomery conversion; standard assertion in a test file.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:267:43

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, y1, ctx);
    assert(0 == memcmp(buffer, (uint8_t*)"\xb5\x7e\x12\xfc\xdb\x03\x1f\x59\xca\xb8\x1b\x1c\x6b\x1e\x1c\x07\xe4\x51\x2e\x52\xce\x83\x2f\x1a\x0c\xed\xef\xff\x8b\x43\x40\xe9", 32));

    free(x1);
```
likely benign LLM, confidence 0.97 Expected y-coordinate test vector used in memcmp assertion.
Reasoning
Expected y-coordinate bytes for an assertion in an EC test; no execution or obfuscation concern.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:295:40

5 rows of escape runs, lines 295-303 (first: 32 consecutive `\xNN` escapes (entropy 4.9 bits/byte)) (raw pass, confidence 0.80)
```
    wp = new_workplace(ctx);
    mont_new_from_bytes(&b, (uint8_t*)"\x5a\xc6\x35\xd8\xaa\x3a\x93\xe7\xb3\xeb\xbd\x55\x76\x98\x86\xbc\x65\x1d\x06\xb0\xcc\x53\xb0\xf6\x3b\xce\x3c\x3e\x27\xd2\x60\x4b", 32, ctx);

    /* Affine and projective are actually the same point (doubling) */
```
likely benign LLM, confidence 0.97 Test vector input rows for elliptic curve doubling test.
Reasoning
Same test-vector pattern for scalar/point inputs in a doubling test, with multiple rows of hex literals being standard for cryptographic known-answer tests.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:308:33

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, x1, ctx);
    assert(0 == memcmp(buffer, "\x96\x0f\x82\x08\x3a\x75\xf9\xaf\x9a\xab\x06\x05\x27\x0e\x2d\xa8\xb3\x20\x7e\x8d\xf2\xf0\x00\x4d\xb3\x19\x16\xc9\xea\xc5\x0f\x02", 32));
    mont_to_bytes(buffer, 32, y1, ctx);
```
likely benign LLM, confidence 0.97 Expected x-coordinate result for elliptic curve test assertion.
Reasoning
Expected output coordinate bytes compared via memcmp in an EC unit test; benign test data.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:310:33

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, y1, ctx);
    assert(0 == memcmp(buffer, "\x20\xe6\xe3\x02\xc6\x57\xfa\x95\x30\x39\xa9\x25\xf1\x9d\xc3\xcb\x0f\x59\xa7\x01\x46\xc8\xac\xe2\x09\x54\x3a\x25\x2a\x18\x96\xba", 32));
    mont_to_bytes(buffer, 32, z1, ctx);
```
likely benign LLM, confidence 0.97 Expected y-coordinate result for elliptic curve test assertion.
Reasoning
Expected y-coordinate bytes for test assertion in EC arithmetic test file.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:312:33

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, z1, ctx);
    assert(0 == memcmp(buffer, "\xb4\x2f\x0b\xc1\x61\x03\x91\xe4\x11\xf1\x4c\x65\xef\x13\xd4\x57\xb1\x41\xb2\x54\xc3\x86\x08\xea\xc6\x5c\xf1\x61\x9d\x37\x6b\x77", 32));

    free(x1);
```
likely benign LLM, confidence 0.97 Expected z-coordinate result for elliptic curve test assertion.
Reasoning
Expected z-coordinate bytes used in memcmp assertion within a cryptographic unit test.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:340:40

5 rows of escape runs, lines 340-348 (first: 32 consecutive `\xNN` escapes (entropy 4.9 bits/byte)) (raw pass, confidence 0.80)
```
    wp = new_workplace(ctx);
    mont_new_from_bytes(&b, (uint8_t*)"\x5a\xc6\x35\xd8\xaa\x3a\x93\xe7\xb3\xeb\xbd\x55\x76\x98\x86\xbc\x65\x1d\x06\xb0\xcc\x53\xb0\xf6\x3b\xce\x3c\x3e\x27\xd2\x60\x4b", 32, ctx);

    /* Affine and projective are actually the same point (doubling) */
```
likely benign LLM, confidence 0.97 Test vector input rows for elliptic curve affine/projective test.
Reasoning
Repeated known-answer test input rows in an EC test; hex escapes encode fixed field element values as expected.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:353:33

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, x1, ctx);
    assert(0 == memcmp(buffer, "\x96\x0f\x82\x08\x3a\x75\xf9\xaf\x9a\xab\x06\x05\x27\x0e\x2d\xa8\xb3\x20\x7e\x8d\xf2\xf0\x00\x4d\xb3\x19\x16\xc9\xea\xc5\x0f\x02", 32));
    mont_to_bytes(buffer, 32, y1, ctx);
```
likely benign LLM, confidence 0.97 Expected x-coordinate result for elliptic curve test assertion.
Reasoning
Expected x-coordinate bytes compared with memcmp in an EC unit test; benign.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:355:33

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, y1, ctx);
    assert(0 == memcmp(buffer, "\x20\xe6\xe3\x02\xc6\x57\xfa\x95\x30\x39\xa9\x25\xf1\x9d\xc3\xcb\x0f\x59\xa7\x01\x46\xc8\xac\xe2\x09\x54\x3a\x25\x2a\x18\x96\xba", 32));
    mont_to_bytes(buffer, 32, z1, ctx);
```
likely benign LLM, confidence 0.97 Expected y-coordinate result for elliptic curve test assertion.
Reasoning
Expected y-coordinate bytes compared in a test assertion; standard known-answer data.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:357:33

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, z1, ctx);
    assert(0 == memcmp(buffer, "\xb4\x2f\x0b\xc1\x61\x03\x91\xe4\x11\xf1\x4c\x65\xef\x13\xd4\x57\xb1\x41\xb2\x54\xc3\x86\x08\xea\xc6\x5c\xf1\x61\x9d\x37\x6b\x77", 32));

    free(x1);
```
likely benign LLM, confidence 0.96 Byte-array test vector used in an assert against elliptic curve computation output.
Reasoning
The escape run is a 32-byte literal passed to memcmp against the output of mont_to_bytes, a fixed expected-value test vector for elliptic curve field arithmetic. Random-looking bytes are expected in cryptographic test data, and the file is a test.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:386:40

5 rows of escape runs, lines 386-393 (first: 32 consecutive `\xNN` escapes (entropy 4.9 bits/byte)) (raw pass, confidence 0.80)
```
    wp = new_workplace(ctx);
    mont_new_from_bytes(&b, (uint8_t*)"\x5a\xc6\x35\xd8\xaa\x3a\x93\xe7\xb3\xeb\xbd\x55\x76\x98\x86\xbc\x65\x1d\x06\xb0\xcc\x53\xb0\xf6\x3b\xce\x3c\x3e\x27\xd2\x60\x4b", 32, ctx);

    /* Arbitrary points */
```
likely benign LLM, confidence 0.96 Test input bytes for constructing elliptic curve points in a unit test.
Reasoning
These are 32-byte input vectors fed to mont_new_from_bytes in an EC test that exercises arbitrary points. The escapes are cryptographic test inputs, not hidden or executed payloads.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:398:33

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, x1, ctx);
    assert(0 == memcmp(buffer, "\x0a\x49\xc8\x32\x3a\x4f\x13\x47\x40\x5a\x25\x43\xd4\xc1\xc6\xc8\xf7\x74\x51\xc5\x83\x5c\x82\x20\x9b\x39\x9c\x23\xee\xf6\x29\x2a", 32));
    mont_to_bytes(buffer, 32, y1, ctx);
```
likely benign LLM, confidence 0.96 Expected x-coordinate bytes for an EC point comparison in a test.
Reasoning
This is an expected-output byte vector compared with memcmp after a Montgomery conversion, standard in crypto unit tests verifying point coordinates.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:400:33

32 consecutive `\xNN` escapes (entropy 4.8 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, y1, ctx);
    assert(0 == memcmp(buffer, "\xaa\xb2\xaa\x93\x13\x26\xc2\xfe\x0f\x44\xd3\x2d\xfe\x19\x57\x6e\x6b\xa9\x9a\xc9\x50\xff\x6f\x73\xb5\x8d\xa4\x39\x4c\xf9\x29\xc2", 32));
    mont_to_bytes(buffer, 32, z1, ctx);
```
likely benign LLM, confidence 0.96 Expected y-coordinate bytes for an EC point comparison in a test.
Reasoning
Expected y-coordinate test vector compared against computed output in the same EC test block. High entropy is characteristic of field-element test data.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:402:33

32 consecutive `\xNN` escapes (entropy 4.8 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, z1, ctx);
    assert(0 == memcmp(buffer, "\x7e\x70\xd6\x49\x38\x7c\xde\xe8\x7d\xbc\xe8\x58\x88\xce\xe4\xd9\x33\x50\x9b\xff\x02\xc6\x4f\x0f\x83\x30\xde\x9c\xf6\x38\x4e\xd4", 32));

    /* Same point (doubling) */
```
likely benign LLM, confidence 0.96 Expected z-coordinate bytes for an EC doubling test assertion.
Reasoning
Expected z-coordinate test vector checked with memcmp after conversion, consistent with a doubling-case unit test for elliptic curve operations.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:406:41

4 rows of escape runs, lines 406-410 (first: 32 consecutive `\xNN` escapes (entropy 4.8 bits/byte)) (raw pass, confidence 0.80)
```
    free(x1); free(y1); free(z1); free(x2); free(y2); free(z2);
    mont_new_from_bytes(&x1, (uint8_t*)"\xc6\x4c\x90\xad\x8d\x5c\x1d\x96\xd6\x4b\x63\x46\x4a\x8b\x57\x91\xbf\x48\xa6\xb4\xb9\xbc\xd6\xad\x79\xc6\x3a\x13\xbf\xb7\x78\x5b", 32, ctx);
```
likely benign LLM, confidence 0.96 Test input bytes for constructing elliptic curve points in a doubling test.
Reasoning
Input coordinate byte arrays for constructing points in the doubling test. These are literal test vectors with no execution or decoding of a payload.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:416:33

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, x1, ctx);
    assert(0 == memcmp(buffer, "\x96\x0f\x82\x08\x3a\x75\xf9\xaf\x9a\xab\x06\x05\x27\x0e\x2d\xa8\xb3\x20\x7e\x8d\xf2\xf0\x00\x4d\xb3\x19\x16\xc9\xea\xc5\x0f\x02", 32));
    mont_to_bytes(buffer, 32, y1, ctx);
```
likely benign LLM, confidence 0.96 Expected x-coordinate bytes for an EC opposite-point test assertion.
Reasoning
Expected x-coordinate vector for the opposite-points test, compared against computed output. Standard cryptographic test data.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:418:33

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, y1, ctx);
    assert(0 == memcmp(buffer, "\x20\xe6\xe3\x02\xc6\x57\xfa\x95\x30\x39\xa9\x25\xf1\x9d\xc3\xcb\x0f\x59\xa7\x01\x46\xc8\xac\xe2\x09\x54\x3a\x25\x2a\x18\x96\xba", 32));
    mont_to_bytes(buffer, 32, z1, ctx);
```
likely benign LLM, confidence 0.96 Expected y-coordinate bytes for an EC opposite-point test assertion.
Reasoning
Expected y-coordinate vector for the opposite-points test, checked with memcmp. Consistent with legitimate EC test code.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:420:33

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    mont_to_bytes(buffer, 32, z1, ctx);
    assert(0 == memcmp(buffer, "\xb4\x2f\x0b\xc1\x61\x03\x91\xe4\x11\xf1\x4c\x65\xef\x13\xd4\x57\xb1\x41\xb2\x54\xc3\x86\x08\xea\xc6\x5c\xf1\x61\x9d\x37\x6b\x77", 32));

    /* Opposite points */
```
likely benign LLM, confidence 0.96 Expected z-coordinate bytes for an EC opposite-point test assertion.
Reasoning
Expected z-coordinate vector for the opposite-points test. The same bytes appear as an expected value earlier in the file, consistent with a test suite.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:430:41

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    free(x1); free(y1); free(z1);
    mont_new_from_bytes(&x1, (uint8_t*)"\xf3\x91\x4a\x3a\xf2\x1b\x11\x44\x58\x3e\xf2\xf8\x54\x01\x4b\x72\xfa\x94\x05\x8d\xf9\x7c\x32\x4f\x1a\xef\x49\x37\x3c\xe8\x5b\xef", 32, ctx);
```
likely benign LLM, confidence 0.96 Test input x-coordinate bytes for an elliptic curve point in a unit test.
Reasoning
Input x-coordinate byte array for constructing points in the opposite-points test. Literal cryptographic test data.
info ~~warn~~ → info by review encoding-escape-soup src/test/test_ec_ws.c:431:41

32 consecutive `\xNN` escapes (entropy 4.9 bits/byte) (raw pass, confidence 0.80)
```
    mont_new_from_bytes(&y1, (uint8_t*)"\x23\xaa\x65\x85\x4c\xc5\xbc\x53\x0d\x4f\xe7\x3e\xd9\x58\x95\x67\xb2\xea\x79\x1a\x7c\x9b\xe5\xf6\x78\x8c\xd5\xbe\xd8\x55\x0d\xe7", 32, ctx);
```
likely benign LLM, confidence 0.96 Test input y-coordinate bytes for an elliptic curve point in a unit test.
Reasoning
Input y-coordinate byte array for constructing points in the opposite-points test. Literal cryptographic test data with no execution path.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o pycryptodomex-3.24.2.tar.gz https://files.pythonhosted.org/packages/f3/c2/f5855412372e47d635599a97c00cfcf9fc40accac9436a11bf9ded19f859/pycryptodomex-3.24.2.tar.gz
printf '%s  %s\n' e4dbc29e2575365d15e272f769329106277649aea081e2119cf43d66950f8f8f pycryptodomex-3.24.2.tar.gz | shasum -a 256 -c -
mkdir pkg && tar -xzf pycryptodomex-3.24.2.tar.gz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg