pyjwt 2.15.1

Source: https://github.com/jpadilla/pyjwt
Tag scanned: 2.15.1
Compared with: 2.15.0 (0 signals introduced since)
Files: 40 scanned, 39 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 48 info
Scan time: 29.2 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 44 of 44 warn and critical signals; 44 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:15

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review encoding-base64 CHANGELOG.rst:626:14

4 rows of base64-like lines, lines 626-626 (first: [embedded python] base64-like blob (120 bytes, compression ratio 0.98)) (raw pass, confidence 0.60)
```
    token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik5FRTFRVVJCT1RNNE16STVSa0ZETlRZeE9UVTFNRGcyT0Rnd1EwVXpNVGsxUWpZeVJrUkZRdyJ9.eyJpc3MiOiJodHRwczovL2Rldi04N2V2eDlydS5hdXRoMC5jb20vIiwic3ViIjoiYVc0Q2NhNzl4UmVMV1V6MGFFMkg2a0QwTzNjWEJWdENAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vZXhwZW5zZXMtYXBpIiwiaWF0IjoxNTcyMDA2OTU0LCJleH
```
likely benign LLM, confidence 0.95 Example JWT token embedded in a CHANGELOG entry.
Reasoning
A JWT example token in a changelog, base64url header and payload with the standard eyJ prefix; a documentation example, not obfuscation. Raw pass base64 heuristic is a false positive.

info long-line docs/usage.rst:23:1

line length 1731 characters (raw pass, confidence 0.50)

    >>> private_key = b"-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEAwhvqCC+37A+UXgcvDl+7nbVjDI3QErdZBkI1VypVBMkKKWHM\nNLMdHk0bIKL+1aDYTRRsCKBy9ZmSSX1pwQlO/3+gRs/MWG27gdRNtf57uLk1+lQI\n6hBDozuyBR0YayQDIx6VsmpBn3Y8LS13p4pTBvirlsdX+jXrbOEaQphn0OdQo0WD\noOwwsPCNCKoIMbUOtUCowvjesFXlWkwG1zeMzlD1aDDS478PDZdckPjT96ICzqe4\

info ~~warn~~ → info by review encoding-base64 docs/usage.rst:23:57

31 rows of base64-like lines, lines 23-24 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
> private_key = b"-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEAwhvqCC+37A+UXgcvDl+7nbVjDI3QErdZBkI1VypVBMkKKWHM\nNLMdHk0bIKL+1aDYTRRsCKBy9ZmSSX1pwQlO/3+gRs/MWG27gdRNtf57uLk1+lQI\n6hBDozuyBR0YayQDIx6VsmpBn3Y8LS13p4pTBvirlsdX+jXrbOEaQphn0OdQo0WD\noOwwsPCNCKoIMbUOtUCowvjesFXlWkwG1zeMzlD1aDDS478PDZdckPjT96ICzqe4\nO1Ok6
```
likely benign LLM, confidence 0.96 Sample RSA private key in PyJWT usage docs.
Reasoning
PEM-formatted RSA private key in PyJWT documentation example. Standard illustrative key material in docs, not hidden payload; raw base64 match on PEM body is expected.
info ~~warn~~ → info by review encoding-base64 docs/usage.rst:36:131

25 rows of base64-like lines, lines 36-36 (first: [embedded python] base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
nfo: AES-128-CBC,C9C8F89EC68D15F26EB9B9695216C6DC\nE3lvX0dYjDxC0DIDitwNj+mEvU48Cqlp9esIeVmfcFmM6KpuQEA4asg/19kldbRq\ntOAYwmMuzz6GNYtX6sQXcStUE3pKMiMaTuP9WXzTc0boSYsGpGoQLtGv3h+0lkPu\nTGaktEhIfplAYlmsS/twr9Jh9QZjEs3dEMwpuF8A/iDZFeIE2thZL0bo38VWorgZ\nTCoOlC7qGtaeDvXXYrMvAUw3lN9A+DvxuPvbGqfqiHVBhxRcQEcR5p65lKP/V0WQ\nDe0Aq
```
likely benign LLM, confidence 0.96 Sample encrypted PEM key block in docs.
Reasoning
PEM body with AES-128-CBC proc-type header, a documentation example of an encrypted key format. Expected in docs; no execution or concealment.

info long-line docs/usage.rst:56:1

line length 1726 characters (raw pass, confidence 0.50)

    >>> private_key = "-----BEGIN RSA PRIVATE KEY-----\nMIIEogIBAAKCAQEAuNhCS6bodtd+PvKqNj+tYZYqTNMDkf0rcptgHhecSsMP9Vay\n+6NvJk1tC+IajPaE4yRJVY4jFqEt3A0MJ9sKe5mWDYFmzW/L6VzQvQ+0nrMc1YTE\nDpOf7BQhlW5W0mDj5SwSR50Lxg/acb+SMWq6zmhuAoLRapH17K2RWONA2vr2frox\nJ6N9TGtrQHygDb0p9D6jPnXEe4y+zBuj6o0bCkJgCVNM+CU19xBepj5caetYV28/\n

info ~~warn~~ → info by review encoding-base64 docs/usage.rst:56:56

29 rows of base64-like lines, lines 56-57 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
>> private_key = "-----BEGIN RSA PRIVATE KEY-----\nMIIEogIBAAKCAQEAuNhCS6bodtd+PvKqNj+tYZYqTNMDkf0rcptgHhecSsMP9Vay\n+6NvJk1tC+IajPaE4yRJVY4jFqEt3A0MJ9sKe5mWDYFmzW/L6VzQvQ+0nrMc1YTE\nDpOf7BQhlW5W0mDj5SwSR50Lxg/acb+SMWq6zmhuAoLRapH17K2RWONA2vr2frox\nJ6N9TGtrQHygDb0p9D6jPnXEe4y+zBuj6o0bCkJgCVNM+CU19xBepj5caetYV28/\n49yl5
```
likely benign LLM, confidence 0.95 Sample RSA private key string in usage docs.
Reasoning
Sample RSA private key string in documentation for PyJWT. Standard PEM content, benign documentation.
info ~~warn~~ → info by review encoding-base64 docs/usage.rst:70:52

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
    >>> import jwt
    >>> private_key = "-----BEGIN PRIVATE KEY-----\nMC4CAQAwBQYDK2VwBCIEIPtUxyxlhjOWetjIYmc98dmB2GxpeaMPP64qBhZmG13r\n-----END PRIVATE KEY-----\n"
    >>> public_key = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA7p4c1IU6aA65FWn6YZ+Bya5dRbfd4P6d4a6H0u9+gCg=\n-----END PUBLIC KEY-----\n"
```
likely benign LLM, confidence 0.95 Sample EdDSA private and public PEM keys in docs.
Reasoning
Sample Ed25519 PEM key pair shown in doctest-style example for jwt.encode/decode. Benign documentation content.
info ~~warn~~ → info by review encoding-base64 docs/usage.rst:71:50

base64-like blob (61 bytes, compression ratio 1.18) (raw pass, confidence 0.60)
```
    >>> public_key = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA7p4c1IU6aA65FWn6YZ+Bya5dRbfd4P6d4a6H0u9+gCg=\n-----END PUBLIC KEY-----\n"
    >>> encoded = jwt.encode({"some": "payload"}, private_key, algorithm="EdDSA")
    >>> jwt.decode(encoded, public_key, algorithms=["EdDSA"])
```
likely benign LLM, confidence 0.95 Sample EdDSA public PEM key in docs.
Reasoning
Sample Ed25519 public PEM key in a doctest example. Benign documentation.
info ~~warn~~ → info by review encoding-base64 docs/usage.rst:84:56

4 rows of base64-like lines, lines 84-85 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
    >>> import jwt
    >>> private_key = b"-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIHAhM7P6HG3LgkDvgvfDeaMA6uELj+jEKWsSeOpS/SfYoAoGCCqGSM49\nAwEHoUQDQgAEXHVxB7s5SR7I9cWwry/JkECIRekaCwG3uOLCYbw5gVzn4dRmwMyY\nUJFcQWuFSfECRK+uQOOXD0YSEucBq0p5tA==\n-----END EC PRIVATE KEY-----\n"
```
likely benign LLM, confidence 0.95 Sample EC private key in PyJWT docs.
Reasoning
Sample EC private PEM key in PyJWT ES256 example documentation. Benign.
info ~~warn~~ → info by review encoding-base64 docs/usage.rst:102:6

base64-like blob (91 bytes, compression ratio 1.01) (raw pass, confidence 0.60)
```
    ... )
    'eyJhbGciOiJIUzI1NiIsImtpZCI6IjIzMDQ5ODE1MWMyMTRiNzg4ZGQ5N2YyMmI4NTQxMGE1IiwidHlwIjoiSldUIn0.eyJzb21lIjoicGF5bG9hZCJ9.0n16c-shKKnw6gervyk1Dge35tvzbzQ_KCV3H3bgoJ0'
```
likely benign LLM, confidence 0.95 Example HS256 JWT string in docs output.
Reasoning
Standard HS256 JWT example output in documentation, with recognizable header and payload. Benign.

info high-complexity docs/usage.rst:102:6

compression ratio 0.906 is >2σ above file mean 0.808 (raw pass, confidence 0.50)

    ... )
    'eyJhbGciOiJIUzI1NiIsImtpZCI6IjIzMDQ5ODE1MWMyMTRiNzg4ZGQ5N2YyMmI4NTQxMGE1IiwidHlwIjoiSldUIn0.eyJzb21lIjoicGF5bG9hZCJ9.0n16c-shKKnw6gervyk1Dge35tvzbzQ_KCV3H3bgoJ0'

info long-line docs/usage.rst:499:1

line length 777 characters (raw pass, confidence 0.50)

    >>> token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik5FRTFRVVJCT1RNNE16STVSa0ZETlRZeE9UVTFNRGcyT0Rnd1EwVXpNVGsxUWpZeVJrUkZRdyJ9.eyJpc3MiOiJodHRwczovL2Rldi04N2V2eDlydS5hdXRoMC5jb20vIiwic3ViIjoiYVc0Q2NhNzl4UmVMV1V6MGFFMkg2a0QwTzNjWEJWdENAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vZXhwZW5zZXMtYXBpIiwiaWF0IjoxNTcyMDA2OTU0LC

info ~~warn~~ → info by review encoding-base64 docs/usage.rst:499:18

4 rows of base64-like lines, lines 499-499 (first: base64-like blob (120 bytes, compression ratio 0.98)) (raw pass, confidence 0.60)
```
    >>> token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik5FRTFRVVJCT1RNNE16STVSa0ZETlRZeE9UVTFNRGcyT0Rnd1EwVXpNVGsxUWpZeVJrUkZRdyJ9.eyJpc3MiOiJodHRwczovL2Rldi04N2V2eDlydS5hdXRoMC5jb20vIiwic3ViIjoiYVc0Q2NhNzl4UmVMV1V6MGFFMkg2a0QwTzNjWEJWdENAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vZXhwZW5zZXMtYXBpIiwiaWF0IjoxNTcyMDA2OTU0LC
```
likely benign LLM, confidence 0.94 Example JWT token in usage docs.
Reasoning
Same example JWT token as the changelog entry, a documentation sample of a decoded/encoded token. Benign.
info ~~warn~~ → info by review encoding-base64 tests/test_advisory.py:10:1

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
priv_key_bytes = b"""-----BEGIN PRIVATE KEY-----
MC4CAQAwBQYDK2VwBCIEIIbBhdo2ah7X32i50GOzrCr4acZTe6BezUdRIixjTAdL
-----END PRIVATE KEY-----"""
```
likely benign LLM, confidence 0.97 Test fixture containing a PEM-encoded Ed25519 private key used for JWT signing tests.
Reasoning
This is a PEM-formatted test fixture for PyJWT's EdDSA key tests, stored in a tests file. Base64 is the expected encoding for PEM, so this is a legitimate pattern with no obfuscation.
info ~~warn~~ → info by review encoding-base64 tests/test_advisory.py:14:19

base64-like blob (68 bytes, compression ratio 1.16) (raw pass, confidence 0.60)
```
pub_key_bytes = (
    b"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPL1I9oiq+B8crkmuV4YViiUnhdLjCp3hvy1bNGuGfNL"
)
```
likely benign LLM, confidence 0.97 Test fixture holding an OpenSSH Ed25519 public key.
Reasoning
An ssh-ed25519 public key in a test file is standard base64 key material for test fixtures. The raw pass flags base64 by pattern only, and this is a known format.
info ~~warn~~ → info by review encoding-base64 tests/test_advisory.py:18:1

base64-like blob (164 bytes over 3 lines, compression ratio 0.95) (raw pass, confidence 0.60)
```
ssh_priv_key_bytes = b"""-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIOWc7RbaNswMtNtc+n6WZDlUblMr2FBPo79fcGXsJlGQoAoGCCqGSM49
AwEHoUQDQgAElcy2RSSSgn2RA/xCGko79N+7FwoLZr3Z0ij/ENjow2XpUDwwKEKk
Ak3TDXC9U8nipMlGcY7sDpXp2XyhHEM+Rw==
```
likely benign LLM, confidence 0.97 Test fixture containing a PEM-encoded EC private key.
Reasoning
An EC private key PEM block in a test module for cryptographic algorithm tests. Base64 encoding of keys is the normal representation, not obfuscation.
info ~~warn~~ → info by review encoding-base64 tests/test_advisory.py:23:41

base64-like blob (140 bytes, compression ratio 0.94) (raw pass, confidence 0.60)
```
ssh_key_bytes = b"""ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJXMtkUkkoJ9kQP8QhpKO/TfuxcKC2a92dIo/xDY6MNl6VA8MChCpAJN0w1wvVPJ4qTJRnGO7A6V6dl8oRxDPkc="""
```
likely benign LLM, confidence 0.97 Test fixture holding an OpenSSH ECDSA P-256 public key.
Reasoning
An ecdsa-sha2-nistp256 OpenSSH public key in a test file. This is expected key-format data with no execution or hiding behavior.
info ~~warn~~ → info by review high-complexity tests/test_advisory.py:48:25

string literal compression ratio 0.951 (142 bytes) (raw pass, confidence 0.60)
```
        # encoded_good = jwt.encode({"test": 1234}, priv_key_bytes, algorithm="EdDSA")
        encoded_good = "eyJ0eXAiOiJKV1QiLCJhbGciOiJFZERTQSJ9.eyJ0ZXN0IjoxMjM0fQ.M5y1EEavZkHSlj9i8yi9nXKKyPBSAUhDRTOYZi3zZY11tZItDaR3qwAye8pc74_lZY3Ogt9KPNFbVOSGnUBHDg"
```
likely benign LLM, confidence 0.95 Hardcoded JWT string used as an expected test value.
Reasoning
The literal is a JWT (three base64url segments) used as an expected encoded value in a test, with a commented-out encode call beside it. High compression ratio is typical for random signature bytes. Not malicious.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:405:15

base64-like blob (49 bytes, compression ratio 1.22) (raw pass, confidence 0.60)
```
            b"fHJnNUzAEUOXS0WahHVb57D30pcgIji9z923q90p5c7E2cU8V+E1qe8NdCA"
            b"APCDzZZ9zQ/dgcMVaBrGrgimrcLbPjueOKFgSO+SSjIElKA=="
        )
```
likely benign LLM, confidence 0.96 Split base64 bytes literal in an algorithm test, likely key material.
Reasoning
Concatenated base64 bytes in a PyJWT-style algorithm test, likely key or signature material for test vectors. Raw pass has high false-positive rates on such data, and the context is a test suite.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:447:23

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
                "x": "IDC-5s6FERlbC4Nc_4JhKW8sd51AhixtMdNUtPxhRFP323QY6cwWeIA3leyZhz-J",
                "y": "eovmN9ocANS8IJxDAGSuC1FehTq5ZFLJU7XSPg36zHpv4H2byKGEcCBiwT4sFJsy",
            },
            "P-521": {
```
likely benign LLM, confidence 0.97 JWK elliptic curve coordinates in a test vector.
Reasoning
These are JWK x/y coordinate values for the P-521 EC key in a test dictionary. Base64url coordinates are the standard JWK format.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:451:23

base64-like blob (81 bytes, compression ratio 1.06) (raw pass, confidence 0.60)
```
                "x": "AHKZLLOsCOzz5cY97ewNUajB957y-C-U88c3v13nmGZx6sYl_oJXu9A5RkTKqjqvjyekWF-7ytDyRXYgCF5cj0Kt",
                "y": "AdymlHvOiLxXkEhayXQnNCvDX4h9htZaCJN34kfmC6pV5OhQHiraVySsUdaQkAgDPrwQrJmbnX9cwlGfP-HqHZR1",
            },
            "secp256k1": {
```
likely benign LLM, confidence 0.97 JWK elliptic curve coordinates for secp256k1 in a test vector.
Reasoning
JWK x/y coordinates for secp256k1 in a test dictionary, the standard representation for EC public keys.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:931:15

base64-like blob (49 bytes, compression ratio 1.22) (raw pass, confidence 0.60)
```
            b"daOCWqbpZDuLb1imKpmm8Nsm56kAxijMLZnpCcnPgyb7CqG+B93W9GHglA5"
            b"drUeR1gRtO7vqbZMsCAQ4bpjXxwbYyjQlEVuMl73UL6sOWg=="
        )
```
likely benign LLM, confidence 0.96 Split base64 bytes literal in a test, likely key material.
Reasoning
Same pattern as line 405: split base64 key or signature bytes in a test module. Raw-pass base64 detection without context is a known false-positive source here.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:957:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
        signing_input = (
            b"eyJhbGciOiJIUzI1NiIsImtpZCI6IjAxOGMwYWU1LTRkOWItNDcxYi1iZmQ2LWVlZ"
            b"jMxNGJjNzAzNyJ9.SXTigJlzIGEgZGFuZ2Vyb3VzIGJ1c2luZXNzLCBGcm9kbywgZ"
            b"29pbmcgb3V0IHlvdXIgZG9vci4gWW91IHN0ZXAgb250byB0aGUgcm9hZCwgYW5kIG"
```
likely benign LLM, confidence 0.97 Split JWT signing-input bytes from a test vector.
Reasoning
A JWT signing input split across lines: the header decodes to a JWT header and the payload is the known Tolkien quote used in JWT test vectors. Standard test data.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:959:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
            b"jMxNGJjNzAzNyJ9.SXTigJlzIGEgZGFuZ2Vyb3VzIGJ1c2luZXNzLCBGcm9kbywgZ"
            b"29pbmcgb3V0IHlvdXIgZG9vci4gWW91IHN0ZXAgb250byB0aGUgcm9hZCwgYW5kIG"
            b"lmIHlvdSBkb24ndCBrZWVwIHlvdXIgZmVldCwgdGhlcmXigJlzIG5vIGtub3dpbmc"
            b"gd2hlcmUgeW91IG1pZ2h0IGJlIHN3ZXB0IG9mZiB0by4"
```
likely benign LLM, confidence 0.97 Continuation of a split JWT signing-input test vector.
Reasoning
Continuation of the same JWT signing-input test vector, a standard base64 payload with no execution or hiding behavior.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:960:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
            b"29pbmcgb3V0IHlvdXIgZG9vci4gWW91IHN0ZXAgb250byB0aGUgcm9hZCwgYW5kIG"
            b"lmIHlvdSBkb24ndCBrZWVwIHlvdXIgZmVldCwgdGhlcmXigJlzIG5vIGtub3dpbmc"
            b"gd2hlcmUgeW91IG1pZ2h0IGJlIHN3ZXB0IG9mZiB0by4"
        )
```
likely benign LLM, confidence 0.93 A base64-encoded test payload of a quoted sentence inside a JWT algorithm test.
Reasoning
Raw-pass base64 hit in a test file. The blob decodes to readable English (a Tolkien quote) and sits inside a JWT-style test vector, so it is test data rather than an encoded payload.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:981:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
        signing_input = (
            b"eyJhbGciOiJSUzI1NiIsImtpZCI6ImJpbGJvLmJhZ2dpbnNAaG9iYml0b24uZXhhb"
            b"XBsZSJ9.SXTigJlzIGEgZGFuZ2Vyb3VzIGJ1c2luZXNzLCBGcm9kbywgZ29pbmcgb"
            b"3V0IHlvdXIgZG9vci4gWW91IHN0ZXAgb250byB0aGUgcm9hZCwgYW5kIGlmIHlvdS"
```
likely benign LLM, confidence 0.93 A JWT header and payload fixture used as signing input in a test.
Reasoning
The snippet begins with a base64url JWT header (eyJhbGciOi...) followed by a base64 payload of readable English. This is a signing-input test vector in an algorithm test suite, not a dropper or concealed code.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:983:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
            b"XBsZSJ9.SXTigJlzIGEgZGFuZ2Vyb3VzIGJ1c2luZXNzLCBGcm9kbywgZ29pbmcgb"
            b"3V0IHlvdXIgZG9vci4gWW91IHN0ZXAgb250byB0aGUgcm9hZCwgYW5kIGlmIHlvdS"
            b"Bkb24ndCBrZWVwIHlvdXIgZmVldCwgdGhlcmXigJlzIG5vIGtub3dpbmcgd2hlcmU"
            b"geW91IG1pZ2h0IGJlIHN3ZXB0IG9mZiB0by4"
```
likely benign LLM, confidence 0.93 Another segment of the JWT test fixture payload.
Reasoning
A continuation of the same JWT signing-input fixture, with a base64 payload that decodes to plain English text. Test data with no execution path.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:984:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
            b"3V0IHlvdXIgZG9vci4gWW91IHN0ZXAgb250byB0aGUgcm9hZCwgYW5kIGlmIHlvdS"
            b"Bkb24ndCBrZWVwIHlvdXIgZmVldCwgdGhlcmXigJlzIG5vIGtub3dpbmcgd2hlcmU"
            b"geW91IG1pZ2h0IGJlIHN3ZXB0IG9mZiB0by4"
        )
```
likely benign LLM, confidence 0.93 Continuation of a base64 JWT test payload.
Reasoning
Same JWT test vector continuation, base64 of readable English. Consistent with a crypto library's test fixtures.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:1012:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
        signing_input = (
            b"eyJhbGciOiJQUzM4NCIsImtpZCI6ImJpbGJvLmJhZ2dpbnNAaG9iYml0b24uZXhhb"
            b"XBsZSJ9.SXTigJlzIGEgZGFuZ2Vyb3VzIGJ1c2luZXNzLCBGcm9kbywgZ29pbmcgb"
            b"3V0IHlvdXIgZG9vci4gWW91IHN0ZXAgb250byB0aGUgcm9hZCwgYW5kIGlmIHlvdS"
```
likely benign LLM, confidence 0.93 A JWT header and payload fixture for a PS384 signing test.
Reasoning
A JWT header for a different algorithm (PS384) followed by the same readable payload. This is a parametrized algorithm test fixture.

info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:1014:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

            b"XBsZSJ9.SXTigJlzIGEgZGFuZ2Vyb3VzIGJ1c2luZXNzLCBGcm9kbywgZ29pbmcgb"
            b"3V0IHlvdXIgZG9vci4gWW91IHN0ZXAgb250byB0aGUgcm9hZCwgYW5kIGlmIHlvdS"
            b"Bkb24ndCBrZWVwIHlvdXIgZmVldCwgdGhlcmXigJlzIG5vIGtub3dpbmcgd2hlcmU"
            b"geW91IG1pZ2h0IGJlIHN3ZXB0IG9mZiB0by4"

likely benign LLM, confidence 0.93 Continuation of the PS384 JWT test fixture.

Reasoning

Same PS384 test vector continuation, base64 of plain English. No decoding or execution context.

info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:1015:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
            b"3V0IHlvdXIgZG9vci4gWW91IHN0ZXAgb250byB0aGUgcm9hZCwgYW5kIGlmIHlvdS"
            b"Bkb24ndCBrZWVwIHlvdXIgZmVldCwgdGhlcmXigJlzIG5vIGtub3dpbmcgd2hlcmU"
            b"geW91IG1pZ2h0IGJlIHN3ZXB0IG9mZiB0by4"
        )
```
likely benign LLM, confidence 0.93 Final segment of a base64 JWT test payload.
Reasoning
Final segment of the same PS384 test fixture, base64 of readable text. Benign test data.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:1020:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
        signature = base64url_decode(
            b"cu22eBqkYDKgIlTpzDXGvaFfz6WGoz7fUDcfT0kkOy42miAh2qyBzk1xEsnk2IpN6"
            b"-tPid6VrklHkqsGqDqHCdP6O8TTB5dDDItllVo6_1OLPpcbUrhiUSMxbbXUvdvWXz"
            b"g-UD8biiReQFlfz28zGWVsdiNAUf8ZnyPEgVFn442ZdNqiVJRmBqrYRXe8P_ijQ7p"
```
likely benign LLM, confidence 0.92 A base64url-encoded JWT signature constant passed to a decoder in a test.
Reasoning
A base64url signature value passed to base64url_decode in a test, with a fixed-length signature-like string. This is cryptographic test vector data, not obfuscated code.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:1023:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
            b"g-UD8biiReQFlfz28zGWVsdiNAUf8ZnyPEgVFn442ZdNqiVJRmBqrYRXe8P_ijQ7p"
            b"8Vdz0TTrxUeT3lm8d9shnr2lfJT8ImUjvAA2Xez2Mlp8cBE5awDzT0qI0n6uiP1aC"
            b"N_2_jLAeQTlqRHtfa64QQSUmFAAjVKPbByi7xho0uTOcbH510a6GYmJUAfmWjwZ6o"
            b"D4ifKo8DYM-X72Eaw"
```
likely benign LLM, confidence 0.92 Continuation of a base64url signature test constant.
Reasoning
Continuation of a base64url JWT signature constant in a test file, consumed by a decode helper. Typical known-answer test data.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:1043:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
        signing_input = (
            b"eyJhbGciOiJFUzUxMiIsImtpZCI6ImJpbGJvLmJhZ2dpbnNAaG9iYml0b24uZXhhb"
            b"XBsZSJ9.SXTigJlzIGEgZGFuZ2Vyb3VzIGJ1c2luZXNzLCBGcm9kbywgZ29pbmcgb"
            b"3V0IHlvdXIgZG9vci4gWW91IHN0ZXAgb250byB0aGUgcm9hZCwgYW5kIGlmIHlvdS"
```
likely benign LLM, confidence 0.93 A JWT header and payload fixture for an ES512 signing test.
Reasoning
A JWT header for ES512 followed by the same readable payload. This is a signing-input fixture for an algorithm test.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:1045:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
            b"XBsZSJ9.SXTigJlzIGEgZGFuZ2Vyb3VzIGJ1c2luZXNzLCBGcm9kbywgZ29pbmcgb"
            b"3V0IHlvdXIgZG9vci4gWW91IHN0ZXAgb250byB0aGUgcm9hZCwgYW5kIGlmIHlvdS"
            b"Bkb24ndCBrZWVwIHlvdXIgZmVldCwgdGhlcmXigJlzIG5vIGtub3dpbmcgd2hlcmU"
            b"geW91IG1pZ2h0IGJlIHN3ZXB0IG9mZiB0by4"
```
likely benign LLM, confidence 0.93 Test fixture: base64 literal containing a line of English text used as signing input.
Reasoning
Raw-pass base64 hit on a multi-line byte literal that decodes to readable prose (a Lord of the Rings quote). This is a test fixture for JWT/HMAC algorithm tests, not an obfuscated payload.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:1046:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
            b"3V0IHlvdXIgZG9vci4gWW91IHN0ZXAgb250byB0aGUgcm9hZCwgYW5kIGlmIHlvdS"
            b"Bkb24ndCBrZWVwIHlvdXIgZmVldCwgdGhlcmXigJlzIG5vIGtub3dpbmcgd2hlcmU"
            b"geW91IG1pZ2h0IGJlIHN3ZXB0IG9mZiB0by4"
        )
```
likely benign LLM, confidence 0.93 Continuation of a base64 test fixture of English prose.
Reasoning
Continuation of the same multi-line base64 test fixture of prose. Benign test data with no execution path.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:1101:25

base64-like blob (88 bytes, compression ratio 1.06) (raw pass, confidence 0.60)
```
    hello_world_sig = b"Qxa47mk/azzUgmY2StAOguAd4P7YBLpyCfU3JdbaiWnXM4o4WibXwmIHvNYgN3frtE2fcyd8OYEaOiD/KiwkCg=="
    hello_world_sig_pem = b"9ueQE7PT8uudHIQb2zZZ7tB7k1X3jeTnIfOVvGCINZejrqQbru1EXPeuMlGcQEZrGkLVcfMmr99W/+byxfppAg=="
    hello_world = b"Hello World!"
```
likely benign LLM, confidence 0.95 Known-answer signature test vector for an algorithm test.
Reasoning
Signature test vectors (base64 of RSA/HMAC signatures over 'Hello World!') in a crypto library's test file. Expected output data, not obfuscation.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:1102:29

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
    hello_world_sig = b"Qxa47mk/azzUgmY2StAOguAd4P7YBLpyCfU3JdbaiWnXM4o4WibXwmIHvNYgN3frtE2fcyd8OYEaOiD/KiwkCg=="
    hello_world_sig_pem = b"9ueQE7PT8uudHIQb2zZZ7tB7k1X3jeTnIfOVvGCINZejrqQbru1EXPeuMlGcQEZrGkLVcfMmr99W/+byxfppAg=="
    hello_world = b"Hello World!"
```
likely benign LLM, confidence 0.95 Known-answer PEM signature vector in an algorithm test.
Reasoning
Same signature test-vector block; the PEM-style signature is expected test data.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:1438:39

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
        # this is the well-known sha256 hash of "foo"
        foo_hash = base64.b64decode(b"LCa0a2j/xo/5m0U8HTBBNBNCLXBkg7+g+YpeiGJm564=")

        algo = RSAAlgorithm(RSAAlgorithm.SHA256)
```
likely benign LLM, confidence 0.95 Documented SHA-256 hash of 'foo' used as an expected test value.
Reasoning
The comment explicitly says this is the well-known SHA-256 hash of 'foo', decoded and used as an expected value in a hashing test.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:1446:39

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
        # this is the well-known sha256 hash of "foo"
        foo_hash = base64.b64decode(b"LCa0a2j/xo/5m0U8HTBBNBNCLXBkg7+g+YpeiGJm564=")

        algo = HMACAlgorithm(HMACAlgorithm.SHA256)
```
likely benign LLM, confidence 0.95 Documented SHA-256 hash of 'foo' reused in an HMAC test.
Reasoning
Same documented SHA-256 hash of 'foo' reused for the HMAC test. Expected-value fixture.
info ~~warn~~ → info by review encoding-base64 tests/test_api_jws.py:623:14

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
        example_jws = (
            "eyJhbGciOiAiSFMyNTbpIiwgInR5cCI6ICJKV1QifQ=="
            ".eyJoZWxsbyI6ICJ3b3JsZCJ9"
            ".tvagLDLoaiJKxOKqpBXSEGy7SYSifZhjntgm9ctpyj8"
```
likely benign LLM, confidence 0.94 Example JWS token used in a JWT API test.
Reasoning
Example JWS token string (header.payload.signature) in a JWT library test file. Standard test vector.
info ~~warn~~ → info by review decoder-decompress-payload tests/test_compressed_jwt.py:11:13

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
            # wbits=-15 has zlib not worry about headers of crc's
            zlib.decompress(decoded["payload"], wbits=-15).decode("utf-8")
        )
        assert isinstance(payload, dict)
```
likely benign LLM, confidence 0.85 Test exercising zlib-compressed JWT payload decoding.
Reasoning
zlib.decompress with wbits=-15 on a decoded payload is the documented compressed-JWT feature being tested, and the file is a test. Runtime decompression here is the functionality under test, not a dropper, though the AST signal is correct that payload decompression occurs.
info ~~warn~~ → info by review encoding-base64 tests/test_jwks_client.py:38:42

base64-like blob (141 bytes, compression ratio 0.94) (raw pass, confidence 0.60)
```
            "n": "0wtlJRY9-ru61LmOgieeI7_rD1oIna9QpBMAOWw8wTuoIhFQFwcIi7MFB7IEfelCPj08vkfLsuFtR8cG07EE4uvJ78bAqRjMsCvprWp4e2p7hqPnWcpRpDEyHjzirEJle1LPpjLLVaSWgkbrVaOD0lkWkP1T1TkrOset_Obh8BwtO-Ww-UfrEwxTyz1646AGkbT2nL8PX0trXrmira8GnrCkFUgTUS61GoTdb9bCJ19PLX9Gnxw7J0BtR0GubopXq8KlI0ThVql6ZtVGN2dvmrCPAVAZleM5TVB61m0VSXvGWa
```
likely benign LLM, confidence 0.95 RSA public modulus inside a JWKS test fixture.
Reasoning
Base64url RSA modulus 'n' inside a JWKS JSON fixture used by the JWKS client tests. Public key data, not obfuscation.
info ~~warn~~ → info by review encoding-base64 tests/test_jwks_client.py:38:196

base64-like blob (127 bytes, compression ratio 0.98) (raw pass, confidence 0.60)
```
le1LPpjLLVaSWgkbrVaOD0lkWkP1T1TkrOset_Obh8BwtO-Ww-UfrEwxTyz1646AGkbT2nL8PX0trXrmira8GnrCkFUgTUS61GoTdb9bCJ19PLX9Gnxw7J0BtR0GubopXq8KlI0ThVql6ZtVGN2dvmrCPAVAZleM5TVB61m0VSXvGWaF6_GeOhbFoyWcyUmFvzWhBm8Q38vWgsSI7oHTkEw",
```
likely benign LLM, confidence 0.95 Continuation of an RSA public modulus in a JWKS test fixture.
Reasoning
Continuation of the same RSA modulus in the JWKS test fixture. Benign public key data.
info ~~warn~~ → info by review encoding-base64 tests/test_jwks_client.py:43:18

base64-like blob (1040 bytes, compression ratio 0.78) (raw pass, confidence 0.60)
```
                "MIIDBzCCAe+gAwIBAgIJNtD9Ozi6j2jJMA0GCSqGSIb3DQEBCwUAMCExHzAdBgNVBAMTFmRldi04N2V2eDlydS5hdXRoMC5jb20wHhcNMTkwNjIwMTU0NDU4WhcNMzMwMjI2MTU0NDU4WjAhMR8wHQYDVQQDExZkZXYtODdldng5cnUuYXV0aDAuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0wtlJRY9+ru61LmOgieeI7/rD1oIna9QpBMAOWw8wTuoIhFQFwcIi7MFB7IEfelCPj08vkf
```
likely benign LLM, confidence 0.95 Base64-encoded X.509 certificate used as test fixture data in a JWKS client test.
Reasoning
The blob is a base64-encoded X.509 certificate (DER structure starting MIIDBz..., with issuer string for an Auth0 dev tenant) embedded in a JWKS test fixture. This is standard test data for verifying JWT/JWKS handling, not obfuscation or malicious payload.
info ~~warn~~ → info by review encoding-base64 tests/test_jwks_client.py:55:227

base64-like blob (89 bytes, compression ratio 1.03) (raw pass, confidence 0.60)
```
xuCOWWjiBNcTmGfnj5_NvRHNUh2iTLuiJpHbGcPzWc5-lc4r-_ehw9EFfp2XsxE9xvtbMZ4SouJCiv9xnrnhe2bdpWuu34hXZCrQwE8DjRY3UR8LjyMxHHPLzX2LWNMHjfN3nAZMteS-Ok11VYDFI-4qCCVGo_WesBCAeqCjPLRyZoV27x1YGsUQ",
```
likely benign LLM, confidence 0.95 Base64url string, likely an RSA signature or key component, in a JWT test vector.
Reasoning
The value is a base64url-encoded RSA signature or key component inside a test file for a JWKS client. Such encoded fields are expected in JWT test vectors and carry no executable or hidden payload.
info ~~warn~~ → info by review encoding-base64 tests/test_jwks_client.py:304:18

4 rows of base64-like lines, lines 304-304 (first: base64-like blob (120 bytes, compression ratio 0.98)) (raw pass, confidence 0.60)
```
        token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik5FRTFRVVJCT1RNNE16STVSa0ZETlRZeE9UVTFNRGcyT0Rnd1EwVXpNVGsxUWpZeVJrUkZRdyJ9.eyJpc3MiOiJodHRwczovL2Rldi04N2V2eDlydS5hdXRoMC5jb20vIiwic3ViIjoiYVc0Q2NhNzl4UmVMV1V6MGFFMkg2a0QwTzNjWEJWdENAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vZXhwZW5zZXMtYXBpIiwiaWF0IjoxNTcyMDA2OTU0LC
```
likely benign LLM, confidence 0.96 Hardcoded sample JWT token assigned in a test function.
Reasoning
The snippet is a JWT (three dot-separated base64url segments starting with eyJ, header specifying RS256 and kid) assigned to a test variable. Encoded JWTs in test files are normal and this is a raw-pass finding with a high false-positive rate.
info ~~warn~~ → info by review encoding-base64 tests/test_jwks_client.py:540:18

4 rows of base64-like lines, lines 540-540 (first: base64-like blob (120 bytes, compression ratio 0.98)) (raw pass, confidence 0.60)
```
        token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik5FRTFRVVJCT1RNNE16STVSa0ZETlRZeE9UVTFNRGcyT0Rnd1EwVXpNVGsxUWpZeVJrUkZRdyJ9.eyJpc3MiOiJodHRwczovL2Rldi04N2V2eDlydS5hdXRoMC5jb20vIiwic3ViIjoiYVc0Q2NhNzl4UmVMV1V6MGFFMkg2a0QwTzNjWEJWdENAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vZXhwZW5zZXMtYXBpIiwiaWF0IjoxNTcyMDA2OTU0LC
```
likely benign LLM, confidence 0.96 Hardcoded sample JWT token assigned in another test function.
Reasoning
Same pattern as the previous finding: a sample JWT string literal in a test file, with the same header and claims structure. It is test fixture data, not obfuscation.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/jpadilla/pyjwt pyjwt && cd pyjwt
git checkout 2.15.1
disclude scan --severity info --diff 2.15.0 .