pyjwt 2.15.1

Source: https://github.com/jpadilla/pyjwt
Tag scanned: 2.15.1
Compared with: 2.15.0 (0 signals introduced since)
Files: 40 scanned, 39 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 48 info
Scan time: 24.7 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 44 of 44 warn and critical signals; 44 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-21 21:53

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review encoding-base64 CHANGELOG.rst:626:14

4 rows of base64-like lines, lines 626-626 (first: [embedded python] base64-like blob (120 bytes, compression ratio 0.98)) (raw pass, confidence 0.60)
```
    token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik5FRTFRVVJCT1RNNE16STVSa0ZETlRZeE9UVTFNRGcyT0Rnd1EwVXpNVGsxUWpZeVJrUkZRdyJ9.eyJpc3MiOiJodHRwczovL2Rldi04N2V2eDlydS5hdXRoMC5jb20vIiwic3ViIjoiYVc0Q2NhNzl4UmVMV1V6MGFFMkg2a0QwTzNjWEJWdENAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vZXhwZW5zZXMtYXBpIiwiaWF0IjoxNTcyMDA2OTU0LCJleH
```
dismissed LLM, confidence 0.93 A sample JSON Web Token quoted in the changelog.
Reasoning
Raw-pass base64 hit on a JWT example token (header and payload of an Auth0-style sample) inside a changelog entry. This is a documentation example of a token string, not an encoded payload or dropper, and the raw pass has a high false-positive rate on JWT-shaped strings.

info long-line docs/usage.rst:23:1

line length 1731 characters (raw pass, confidence 0.50)

    >>> private_key = b"-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEAwhvqCC+37A+UXgcvDl+7nbVjDI3QErdZBkI1VypVBMkKKWHM\nNLMdHk0bIKL+1aDYTRRsCKBy9ZmSSX1pwQlO/3+gRs/MWG27gdRNtf57uLk1+lQI\n6hBDozuyBR0YayQDIx6VsmpBn3Y8LS13p4pTBvirlsdX+jXrbOEaQphn0OdQo0WD\noOwwsPCNCKoIMbUOtUCowvjesFXlWkwG1zeMzlD1aDDS478PDZdckPjT96ICzqe4\

info ~~warn~~ → info by review encoding-base64 docs/usage.rst:23:57

31 rows of base64-like lines, lines 23-24 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
> private_key = b"-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEAwhvqCC+37A+UXgcvDl+7nbVjDI3QErdZBkI1VypVBMkKKWHM\nNLMdHk0bIKL+1aDYTRRsCKBy9ZmSSX1pwQlO/3+gRs/MWG27gdRNtf57uLk1+lQI\n6hBDozuyBR0YayQDIx6VsmpBn3Y8LS13p4pTBvirlsdX+jXrbOEaQphn0OdQo0WD\noOwwsPCNCKoIMbUOtUCowvjesFXlWkwG1zeMzlD1aDDS478PDZdckPjT96ICzqe4\nO1Ok6
```
dismissed LLM, confidence 0.94 An example RSA private key in a PEM string in the usage docs.
Reasoning
Raw-pass hit on an RSA private key PEM literal in the PyJWT usage documentation. The key is a placeholder example in a doctest-style snippet, and PEM bodies are base64 by design.
info ~~warn~~ → info by review encoding-base64 docs/usage.rst:36:131

25 rows of base64-like lines, lines 36-36 (first: [embedded python] base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
nfo: AES-128-CBC,C9C8F89EC68D15F26EB9B9695216C6DC\nE3lvX0dYjDxC0DIDitwNj+mEvU48Cqlp9esIeVmfcFmM6KpuQEA4asg/19kldbRq\ntOAYwmMuzz6GNYtX6sQXcStUE3pKMiMaTuP9WXzTc0boSYsGpGoQLtGv3h+0lkPu\nTGaktEhIfplAYlmsS/twr9Jh9QZjEs3dEMwpuF8A/iDZFeIE2thZL0bo38VWorgZ\nTCoOlC7qGtaeDvXXYrMvAUw3lN9A+DvxuPvbGqfqiHVBhxRcQEcR5p65lKP/V0WQ\nDe0Aq
```
dismissed LLM, confidence 0.94 An example encrypted PEM private key in the usage docs.
Reasoning
Raw-pass hit on the encrypted-PEM body (AES-128-CBC header with base64 lines) shown as an illustrative key in the documentation. This is ordinary PEM formatting in a library doc, not obfuscation.

info long-line docs/usage.rst:56:1

line length 1726 characters (raw pass, confidence 0.50)

    >>> private_key = "-----BEGIN RSA PRIVATE KEY-----\nMIIEogIBAAKCAQEAuNhCS6bodtd+PvKqNj+tYZYqTNMDkf0rcptgHhecSsMP9Vay\n+6NvJk1tC+IajPaE4yRJVY4jFqEt3A0MJ9sKe5mWDYFmzW/L6VzQvQ+0nrMc1YTE\nDpOf7BQhlW5W0mDj5SwSR50Lxg/acb+SMWq6zmhuAoLRapH17K2RWONA2vr2frox\nJ6N9TGtrQHygDb0p9D6jPnXEe4y+zBuj6o0bCkJgCVNM+CU19xBepj5caetYV28/\n

info ~~warn~~ → info by review encoding-base64 docs/usage.rst:56:56

29 rows of base64-like lines, lines 56-57 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
>> private_key = "-----BEGIN RSA PRIVATE KEY-----\nMIIEogIBAAKCAQEAuNhCS6bodtd+PvKqNj+tYZYqTNMDkf0rcptgHhecSsMP9Vay\n+6NvJk1tC+IajPaE4yRJVY4jFqEt3A0MJ9sKe5mWDYFmzW/L6VzQvQ+0nrMc1YTE\nDpOf7BQhlW5W0mDj5SwSR50Lxg/acb+SMWq6zmhuAoLRapH17K2RWONA2vr2frox\nJ6N9TGtrQHygDb0p9D6jPnXEe4y+zBuj6o0bCkJgCVNM+CU19xBepj5caetYV28/\n49yl5
```
dismissed LLM, confidence 0.94 An example RSA private key PEM string in the usage docs.
Reasoning
Raw-pass hit on an example RSA private key PEM string in the documentation, the same pattern as the other doc examples. Base64 encoding is inherent to PEM.
info ~~warn~~ → info by review encoding-base64 docs/usage.rst:70:52

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
    >>> import jwt
    >>> private_key = "-----BEGIN PRIVATE KEY-----\nMC4CAQAwBQYDK2VwBCIEIPtUxyxlhjOWetjIYmc98dmB2GxpeaMPP64qBhZmG13r\n-----END PRIVATE KEY-----\n"
    >>> public_key = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA7p4c1IU6aA65FWn6YZ+Bya5dRbfd4P6d4a6H0u9+gCg=\n-----END PUBLIC KEY-----\n"
```
dismissed LLM, confidence 0.93 Example Ed25519 PEM key pair in the usage docs.
Reasoning
Raw-pass hit on example EdDSA private and public PEM keys in a doctest-style snippet in the documentation. PEM bodies are base64 by design; the surrounding code is a normal jwt.encode example.
info ~~warn~~ → info by review encoding-base64 docs/usage.rst:71:50

base64-like blob (61 bytes, compression ratio 1.18) (raw pass, confidence 0.60)
```
    >>> public_key = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA7p4c1IU6aA65FWn6YZ+Bya5dRbfd4P6d4a6H0u9+gCg=\n-----END PUBLIC KEY-----\n"
    >>> encoded = jwt.encode({"some": "payload"}, private_key, algorithm="EdDSA")
    >>> jwt.decode(encoded, public_key, algorithms=["EdDSA"])
```
dismissed LLM, confidence 0.93 Example Ed25519 public key PEM in the usage docs.
Reasoning
Raw-pass hit on the example Ed25519 public key PEM in the same jwt doctest. It is documented key material used for illustration, not a hidden payload.
info ~~warn~~ → info by review encoding-base64 docs/usage.rst:84:56

4 rows of base64-like lines, lines 84-85 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
    >>> import jwt
    >>> private_key = b"-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIHAhM7P6HG3LgkDvgvfDeaMA6uELj+jEKWsSeOpS/SfYoAoGCCqGSM49\nAwEHoUQDQgAEXHVxB7s5SR7I9cWwry/JkECIRekaCwG3uOLCYbw5gVzn4dRmwMyY\nUJFcQWuFSfECRK+uQOOXD0YSEucBq0p5tA==\n-----END EC PRIVATE KEY-----\n"
```
dismissed LLM, confidence 0.92 Example EC private key PEM string in the usage docs.
Reasoning
Raw-pass hit on an example EC private key PEM in the documentation. Base64 bodies of PEM blocks are expected in a library usage guide.
info ~~warn~~ → info by review encoding-base64 docs/usage.rst:102:6

base64-like blob (91 bytes, compression ratio 1.01) (raw pass, confidence 0.60)
```
    ... )
    'eyJhbGciOiJIUzI1NiIsImtpZCI6IjIzMDQ5ODE1MWMyMTRiNzg4ZGQ5N2YyMmI4NTQxMGE1IiwidHlwIjoiSldUIn0.eyJzb21lIjoicGF5bG9hZCJ9.0n16c-shKKnw6gervyk1Dge35tvzbzQ_KCV3H3bgoJ0'
```
dismissed LLM, confidence 0.93 A sample HS256 JWT shown as output in the usage docs.
Reasoning
Raw-pass hit on an encoded HS256 JWT printed as a doctest output line. It is a standard three-part token from the sample payload, not an encoded dropper.

info high-complexity docs/usage.rst:102:6

compression ratio 0.906 is >2σ above file mean 0.808 (raw pass, confidence 0.50)

    ... )
    'eyJhbGciOiJIUzI1NiIsImtpZCI6IjIzMDQ5ODE1MWMyMTRiNzg4ZGQ5N2YyMmI4NTQxMGE1IiwidHlwIjoiSldUIn0.eyJzb21lIjoicGF5bG9hZCJ9.0n16c-shKKnw6gervyk1Dge35tvzbzQ_KCV3H3bgoJ0'

info long-line docs/usage.rst:499:1

line length 777 characters (raw pass, confidence 0.50)

    >>> token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik5FRTFRVVJCT1RNNE16STVSa0ZETlRZeE9UVTFNRGcyT0Rnd1EwVXpNVGsxUWpZeVJrUkZRdyJ9.eyJpc3MiOiJodHRwczovL2Rldi04N2V2eDlydS5hdXRoMC5jb20vIiwic3ViIjoiYVc0Q2NhNzl4UmVMV1V6MGFFMkg2a0QwTzNjWEJWdENAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vZXhwZW5zZXMtYXBpIiwiaWF0IjoxNTcyMDA2OTU0LC

info ~~warn~~ → info by review encoding-base64 docs/usage.rst:499:18

4 rows of base64-like lines, lines 499-499 (first: base64-like blob (120 bytes, compression ratio 0.98)) (raw pass, confidence 0.60)
```
    >>> token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik5FRTFRVVJCT1RNNE16STVSa0ZETlRZeE9UVTFNRGcyT0Rnd1EwVXpNVGsxUWpZeVJrUkZRdyJ9.eyJpc3MiOiJodHRwczovL2Rldi04N2V2eDlydS5hdXRoMC5jb20vIiwic3ViIjoiYVc0Q2NhNzl4UmVMV1V6MGFFMkg2a0QwTzNjWEJWdENAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vZXhwZW5zZXMtYXBpIiwiaWF0IjoxNTcyMDA2OTU0LC
```
dismissed LLM, confidence 0.93 A sample JSON Web Token in the usage docs.
Reasoning
Raw-pass hit on the same sample JWT header and payload as the changelog entry, here in the usage docs. Documentation example of a token string.
info ~~warn~~ → info by review encoding-base64 tests/test_advisory.py:10:1

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
priv_key_bytes = b"""-----BEGIN PRIVATE KEY-----
MC4CAQAwBQYDK2VwBCIEIIbBhdo2ah7X32i50GOzrCr4acZTe6BezUdRIixjTAdL
-----END PRIVATE KEY-----"""
```
dismissed LLM, confidence 0.93 A test fixture PEM private key in tests/test_advisory.py.
Reasoning
Raw-pass hit on a PEM private key literal in a test file for advisory/key handling. Test fixtures commonly embed throwaway keys; this is not obfuscation.
info ~~warn~~ → info by review encoding-base64 tests/test_advisory.py:14:19

base64-like blob (68 bytes, compression ratio 1.16) (raw pass, confidence 0.60)
```
pub_key_bytes = (
    b"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPL1I9oiq+B8crkmuV4YViiUnhdLjCp3hvy1bNGuGfNL"
)
```
dismissed LLM, confidence 0.93 A test fixture ssh-ed25519 public key in tests/test_advisory.py.
Reasoning
Raw-pass hit on an OpenSSH ed25519 public key literal used as test input. Public key strings are base64 by format and carry no malicious behavior.
info ~~warn~~ → info by review encoding-base64 tests/test_advisory.py:18:1

base64-like blob (164 bytes over 3 lines, compression ratio 0.95) (raw pass, confidence 0.60)
```
ssh_priv_key_bytes = b"""-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIOWc7RbaNswMtNtc+n6WZDlUblMr2FBPo79fcGXsJlGQoAoGCCqGSM49
AwEHoUQDQgAElcy2RSSSgn2RA/xCGko79N+7FwoLZr3Z0ij/ENjow2XpUDwwKEKk
Ak3TDXC9U8nipMlGcY7sDpXp2XyhHEM+Rw==
```
likely benign LLM, confidence 0.95 Embedded EC private key PEM used as test fixture for JWT signing tests.
Reasoning
Test fixture containing an EC private key in PEM format inside a test file for a JWT library; test key material, not malicious obfuscation.
info ~~warn~~ → info by review encoding-base64 tests/test_advisory.py:23:41

base64-like blob (140 bytes, compression ratio 0.94) (raw pass, confidence 0.60)
```
ssh_key_bytes = b"""ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJXMtkUkkoJ9kQP8QhpKO/TfuxcKC2a92dIo/xDY6MNl6VA8MChCpAJN0w1wvVPJ4qTJRnGO7A6V6dl8oRxDPkc="""
```
likely benign LLM, confidence 0.95 Embedded ECDSA SSH public key bytes in a test file.
Reasoning
Test fixture holding an ECDSA public key in SSH format for advisory/key-loading tests; ordinary test data.
info ~~warn~~ → info by review high-complexity tests/test_advisory.py:48:25

string literal compression ratio 0.951 (142 bytes) (raw pass, confidence 0.60)
```
        # encoded_good = jwt.encode({"test": 1234}, priv_key_bytes, algorithm="EdDSA")
        encoded_good = "eyJ0eXAiOiJKV1QiLCJhbGciOiJFZERTQSJ9.eyJ0ZXN0IjoxMjM0fQ.M5y1EEavZkHSlj9i8yi9nXKKyPBSAUhDRTOYZi3zZY11tZItDaR3qwAye8pc74_lZY3Ogt9KPNFbVOSGnUBHDg"
```
likely benign LLM, confidence 0.93 Hardcoded JWT test vector string in a test module.
Reasoning
A precomputed JWT string in a test, with the generating call commented above it; standard test vector.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:405:15

base64-like blob (49 bytes, compression ratio 1.22) (raw pass, confidence 0.60)
```
            b"fHJnNUzAEUOXS0WahHVb57D30pcgIji9z923q90p5c7E2cU8V+E1qe8NdCA"
            b"APCDzZZ9zQ/dgcMVaBrGrgimrcLbPjueOKFgSO+SSjIElKA=="
        )
```
likely benign LLM, confidence 0.95 Base64 test vector fragments in a JWT algorithm test.
Reasoning
Base64 fragments of RSA/HMAC key or signature test data split across bytes literals in a PyJWT-style test suite; the high-complexity-free raw blob pattern is typical of test vectors.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:447:23

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
                "x": "IDC-5s6FERlbC4Nc_4JhKW8sd51AhixtMdNUtPxhRFP323QY6cwWeIA3leyZhz-J",
                "y": "eovmN9ocANS8IJxDAGSuC1FehTq5ZFLJU7XSPg36zHpv4H2byKGEcCBiwT4sFJsy",
            },
            "P-521": {
```
likely benign LLM, confidence 0.95 EC JWK x/y coordinate values in algorithm test vectors.
Reasoning
JWK EC public coordinates for P-521 in a test dictionary for algorithm tests; expected public key data.

info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:451:23

base64-like blob (81 bytes, compression ratio 1.06) (raw pass, confidence 0.60)

                "x": "AHKZLLOsCOzz5cY97ewNUajB957y-C-U88c3v13nmGZx6sYl_oJXu9A5RkTKqjqvjyekWF-7ytDyRXYgCF5cj0Kt",
                "y": "AdymlHvOiLxXkEhayXQnNCvDX4h9htZaCJN34kfmC6pV5OhQHiraVySsUdaQkAgDPrwQrJmbnX9cwlGfP-HqHZR1",
            },
            "secp256k1": {

likely benign LLM, confidence 0.95 EC JWK x/y coordinate values for secp256k1 test case.

Reasoning

JWK EC coordinates for secp256k1 in a test dictionary; standard test data.

info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:931:15

base64-like blob (49 bytes, compression ratio 1.22) (raw pass, confidence 0.60)
```
            b"daOCWqbpZDuLb1imKpmm8Nsm56kAxijMLZnpCcnPgyb7CqG+B93W9GHglA5"
            b"drUeR1gRtO7vqbZMsCAQ4bpjXxwbYyjQlEVuMl73UL6sOWg=="
        )
```
likely benign LLM, confidence 0.95 Base64 test vector fragments in a JWT algorithm test.
Reasoning
Base64 fragments of key/signature test data split across literals in a JWT test file; legitimate test vector.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:957:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
        signing_input = (
            b"eyJhbGciOiJIUzI1NiIsImtpZCI6IjAxOGMwYWU1LTRkOWItNDcxYi1iZmQ2LWVlZ"
            b"jMxNGJjNzAzNyJ9.SXTigJlzIGEgZGFuZ2Vyb3VzIGJ1c2luZXNzLCBGcm9kbywgZ"
            b"29pbmcgb3V0IHlvdXIgZG9vci4gWW91IHN0ZXAgb250byB0aGUgcm9hZCwgYW5kIG"
```
likely benign LLM, confidence 0.96 Base64-encoded JWT signing input test vector.
Reasoning
Split base64 JWT signing input for the RFC-style Frodo quote used in JWT test vectors; the blob decodes to ordinary JWT header and payload text.

info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:959:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

            b"jMxNGJjNzAzNyJ9.SXTigJlzIGEgZGFuZ2Vyb3VzIGJ1c2luZXNzLCBGcm9kbywgZ"
            b"29pbmcgb3V0IHlvdXIgZG9vci4gWW91IHN0ZXAgb250byB0aGUgcm9hZCwgYW5kIG"
            b"lmIHlvdSBkb24ndCBrZWVwIHlvdXIgZmVldCwgdGhlcmXigJlzIG5vIGtub3dpbmc"
            b"gd2hlcmUgeW91IG1pZ2h0IGJlIHN3ZXB0IG9mZiB0by4"

likely benign LLM, confidence 0.96 Base64-encoded JWT payload fragment in test vector.

Reasoning

Continuation of the same JWT test vector signing input; legitimate test data.

info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:960:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
            b"29pbmcgb3V0IHlvdXIgZG9vci4gWW91IHN0ZXAgb250byB0aGUgcm9hZCwgYW5kIG"
            b"lmIHlvdSBkb24ndCBrZWVwIHlvdXIgZmVldCwgdGhlcmXigJlzIG5vIGtub3dpbmc"
            b"gd2hlcmUgeW91IG1pZ2h0IGJlIHN3ZXB0IG9mZiB0by4"
        )
```
likely benign LLM, confidence 0.96 Base64-encoded JWT payload fragment in test vector.
Reasoning
Continuation of the same JWT test vector; legitimate test data.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:981:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
        signing_input = (
            b"eyJhbGciOiJSUzI1NiIsImtpZCI6ImJpbGJvLmJhZ2dpbnNAaG9iYml0b24uZXhhb"
            b"XBsZSJ9.SXTigJlzIGEgZGFuZ2Vyb3VzIGJ1c2luZXNzLCBGcm9kbywgZ29pbmcgb"
            b"3V0IHlvdXIgZG9vci4gWW91IHN0ZXAgb250byB0aGUgcm9hZCwgYW5kIGlmIHlvdS"
```
likely benign LLM, confidence 0.96 Base64-encoded JWT signing input with RS256 header in test.
Reasoning
Same JWT signing-input test vector with an RS256 header in a test file; legitimate.

info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:983:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

            b"XBsZSJ9.SXTigJlzIGEgZGFuZ2Vyb3VzIGJ1c2luZXNzLCBGcm9kbywgZ29pbmcgb"
            b"3V0IHlvdXIgZG9vci4gWW91IHN0ZXAgb250byB0aGUgcm9hZCwgYW5kIGlmIHlvdS"
            b"Bkb24ndCBrZWVwIHlvdXIgZmVldCwgdGhlcmXigJlzIG5vIGtub3dpbmcgd2hlcmU"
            b"geW91IG1pZ2h0IGJlIHN3ZXB0IG9mZiB0by4"

likely benign LLM, confidence 0.96 Base64 JWT payload fragment in RS256 test vector.

Reasoning

Continuation of the RS256 JWT test vector; legitimate test data.

info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:984:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
            b"3V0IHlvdXIgZG9vci4gWW91IHN0ZXAgb250byB0aGUgcm9hZCwgYW5kIGlmIHlvdS"
            b"Bkb24ndCBrZWVwIHlvdXIgZmVldCwgdGhlcmXigJlzIG5vIGtub3dpbmcgd2hlcmU"
            b"geW91IG1pZ2h0IGJlIHN3ZXB0IG9mZiB0by4"
        )
```
likely benign LLM, confidence 0.96 Base64 JWT payload fragment in RS256 test vector.
Reasoning
Continuation of the RS256 JWT test vector; legitimate test data.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:1012:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
        signing_input = (
            b"eyJhbGciOiJQUzM4NCIsImtpZCI6ImJpbGJvLmJhZ2dpbnNAaG9iYml0b24uZXhhb"
            b"XBsZSJ9.SXTigJlzIGEgZGFuZ2Vyb3VzIGJ1c2luZXNzLCBGcm9kbywgZ29pbmcgb"
            b"3V0IHlvdXIgZG9vci4gWW91IHN0ZXAgb250byB0aGUgcm9hZCwgYW5kIGlmIHlvdS"
```
likely benign LLM, confidence 0.97 Base64url-encoded JWT signing input used as a test vector.
Reasoning
This is a JWT test vector in a PyJWT-style test file: a base64url header and the classic Frodo quote payload used as signing input for RS/PS algorithm tests. Test fixtures like this are expected and not obfuscation.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:1014:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
            b"XBsZSJ9.SXTigJlzIGEgZGFuZ2Vyb3VzIGJ1c2luZXNzLCBGcm9kbywgZ29pbmcgb"
            b"3V0IHlvdXIgZG9vci4gWW91IHN0ZXAgb250byB0aGUgcm9hZCwgYW5kIGlmIHlvdS"
            b"Bkb24ndCBrZWVwIHlvdXIgZmVldCwgdGhlcmXigJlzIG5vIGtub3dpbmcgd2hlcmU"
            b"geW91IG1pZ2h0IGJlIHN3ZXB0IG9mZiB0by4"
```
likely benign LLM, confidence 0.97 Continuation of a JWT test vector payload in a test.
Reasoning
Continuation of the same JWT test vector string literal in a test file; the blob is a known public payload.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:1015:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
            b"3V0IHlvdXIgZG9vci4gWW91IHN0ZXAgb250byB0aGUgcm9hZCwgYW5kIGlmIHlvdS"
            b"Bkb24ndCBrZWVwIHlvdXIgZmVldCwgdGhlcmXigJlzIG5vIGtub3dpbmcgd2hlcmU"
            b"geW91IG1pZ2h0IGJlIHN3ZXB0IG9mZiB0by4"
        )
```
likely benign LLM, confidence 0.97 Continuation of a JWT test vector payload in a test.
Reasoning
Same JWT test vector continuation; plain test fixture data.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:1020:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
        signature = base64url_decode(
            b"cu22eBqkYDKgIlTpzDXGvaFfz6WGoz7fUDcfT0kkOy42miAh2qyBzk1xEsnk2IpN6"
            b"-tPid6VrklHkqsGqDqHCdP6O8TTB5dDDItllVo6_1OLPpcbUrhiUSMxbbXUvdvWXz"
            b"g-UD8biiReQFlfz28zGWVsdiNAUf8ZnyPEgVFn442ZdNqiVJRmBqrYRXe8P_ijQ7p"
```
likely benign LLM, confidence 0.96 Precomputed base64url signature bytes used as a test vector.
Reasoning
Base64url-encoded RSA/ECDSA signature bytes embedded as a fixed test vector for verifying signatures in a JWT library test suite.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:1023:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
            b"g-UD8biiReQFlfz28zGWVsdiNAUf8ZnyPEgVFn442ZdNqiVJRmBqrYRXe8P_ijQ7p"
            b"8Vdz0TTrxUeT3lm8d9shnr2lfJT8ImUjvAA2Xez2Mlp8cBE5awDzT0qI0n6uiP1aC"
            b"N_2_jLAeQTlqRHtfa64QQSUmFAAjVKPbByi7xho0uTOcbH510a6GYmJUAfmWjwZ6o"
            b"D4ifKo8DYM-X72Eaw"
```
likely benign LLM, confidence 0.97 Continuation of a precomputed signature test vector.
Reasoning
Continuation of the signature test vector in a JWT library test file; expected fixture content.

info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:1043:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        signing_input = (
            b"eyJhbGciOiJFUzUxMiIsImtpZCI6ImJpbGJvLmJhZ2dpbnNAaG9iYml0b24uZXhhb"
            b"XBsZSJ9.SXTigJlzIGEgZGFuZ2Vyb3VzIGJ1c2luZXNzLCBGcm9kbywgZ29pbmcgb"
            b"3V0IHlvdXIgZG9vci4gWW91IHN0ZXAgb250byB0aGUgcm9hZCwgYW5kIGlmIHlvdS"

likely benign LLM, confidence 0.97 ES512 JWT signing input test vector.

Reasoning

Same JWT test vector pattern with an ES512 header in a test file; legitimate fixture.

info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:1045:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

            b"XBsZSJ9.SXTigJlzIGEgZGFuZ2Vyb3VzIGJ1c2luZXNzLCBGcm9kbywgZ29pbmcgb"
            b"3V0IHlvdXIgZG9vci4gWW91IHN0ZXAgb250byB0aGUgcm9hZCwgYW5kIGlmIHlvdS"
            b"Bkb24ndCBrZWVwIHlvdXIgZmVldCwgdGhlcmXigJlzIG5vIGtub3dpbmcgd2hlcmU"
            b"geW91IG1pZ2h0IGJlIHN3ZXB0IG9mZiB0by4"

likely benign LLM, confidence 0.97 Continuation of a JWT test vector payload.

Reasoning

Continuation of the JWT test vector payload in a test; benign.

info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:1046:15

base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
            b"3V0IHlvdXIgZG9vci4gWW91IHN0ZXAgb250byB0aGUgcm9hZCwgYW5kIGlmIHlvdS"
            b"Bkb24ndCBrZWVwIHlvdXIgZmVldCwgdGhlcmXigJlzIG5vIGtub3dpbmcgd2hlcmU"
            b"geW91IG1pZ2h0IGJlIHN3ZXB0IG9mZiB0by4"
        )
```
likely benign LLM, confidence 0.97 Continuation of a JWT test vector payload.
Reasoning
Continuation of the JWT test vector payload in a test; benign.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:1101:25

base64-like blob (88 bytes, compression ratio 1.06) (raw pass, confidence 0.60)
```
    hello_world_sig = b"Qxa47mk/azzUgmY2StAOguAd4P7YBLpyCfU3JdbaiWnXM4o4WibXwmIHvNYgN3frtE2fcyd8OYEaOiD/KiwkCg=="
    hello_world_sig_pem = b"9ueQE7PT8uudHIQb2zZZ7tB7k1X3jeTnIfOVvGCINZejrqQbru1EXPeuMlGcQEZrGkLVcfMmr99W/+byxfppAg=="
    hello_world = b"Hello World!"
```
likely benign LLM, confidence 0.95 Base64-encoded signature fixtures for a sign/verify test.
Reasoning
Precomputed signature byte strings for a 'Hello World!' sign/verify test in a crypto library's test suite. Base64 of cryptographic test data is expected.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:1102:29

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
    hello_world_sig = b"Qxa47mk/azzUgmY2StAOguAd4P7YBLpyCfU3JdbaiWnXM4o4WibXwmIHvNYgN3frtE2fcyd8OYEaOiD/KiwkCg=="
    hello_world_sig_pem = b"9ueQE7PT8uudHIQb2zZZ7tB7k1X3jeTnIfOVvGCINZejrqQbru1EXPeuMlGcQEZrGkLVcfMmr99W/+byxfppAg=="
    hello_world = b"Hello World!"
```
likely benign LLM, confidence 0.95 Base64-encoded PEM-signature fixture for a sign/verify test.
Reasoning
Companion PEM signature fixture in the same test block; legitimate test data.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:1438:39

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
        # this is the well-known sha256 hash of "foo"
        foo_hash = base64.b64decode(b"LCa0a2j/xo/5m0U8HTBBNBNCLXBkg7+g+YpeiGJm564=")

        algo = RSAAlgorithm(RSAAlgorithm.SHA256)
```
likely benign LLM, confidence 0.97 Base64-decoded SHA-256 digest of 'foo' used as a test expectation.
Reasoning
Decodes a well-known SHA-256 hash of 'foo' explicitly commented in the test, used as expected value for hashing algorithm tests. Legitimate.
info ~~warn~~ → info by review encoding-base64 tests/test_algorithms.py:1446:39

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
        # this is the well-known sha256 hash of "foo"
        foo_hash = base64.b64decode(b"LCa0a2j/xo/5m0U8HTBBNBNCLXBkg7+g+YpeiGJm564=")

        algo = HMACAlgorithm(HMACAlgorithm.SHA256)
```
likely benign LLM, confidence 0.97 Base64-decoded SHA-256 digest of 'foo' used in an HMAC test.
Reasoning
Same known SHA-256 hash of 'foo' used in HMAC test; legitimate fixture.
info ~~warn~~ → info by review encoding-base64 tests/test_api_jws.py:623:14

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
        example_jws = (
            "eyJhbGciOiAiSFMyNTbpIiwgInR5cCI6ICJKV1QifQ=="
            ".eyJoZWxsbyI6ICJ3b3JsZCJ9"
            ".tvagLDLoaiJKxOKqpBXSEGy7SYSifZhjntgm9ctpyj8"
```
likely benign LLM, confidence 0.97 Example JWS token literal used in a unit test.
Reasoning
Test fixture containing a sample JWS token string; base64 blob is expected for JWT test data in a PyJWT test suite. Not obfuscation.
info ~~warn~~ → info by review decoder-decompress-payload tests/test_compressed_jwt.py:11:13

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
            # wbits=-15 has zlib not worry about headers of crc's
            zlib.decompress(decoded["payload"], wbits=-15).decode("utf-8")
        )
        assert isinstance(payload, dict)
```
likely benign LLM, confidence 0.95 Test calling zlib.decompress to verify compressed JWT payload handling.
Reasoning
The test file exercises compressed JWT payloads (zip claim), so zlib decompression is the feature under test, operating on a test fixture. Legitimate library code, not a dropper.
info ~~warn~~ → info by review encoding-base64 tests/test_jwks_client.py:38:42

base64-like blob (141 bytes, compression ratio 0.94) (raw pass, confidence 0.60)
```
            "n": "0wtlJRY9-ru61LmOgieeI7_rD1oIna9QpBMAOWw8wTuoIhFQFwcIi7MFB7IEfelCPj08vkfLsuFtR8cG07EE4uvJ78bAqRjMsCvprWp4e2p7hqPnWcpRpDEyHjzirEJle1LPpjLLVaSWgkbrVaOD0lkWkP1T1TkrOset_Obh8BwtO-Ww-UfrEwxTyz1646AGkbT2nL8PX0trXrmira8GnrCkFUgTUS61GoTdb9bCJ19PLX9Gnxw7J0BtR0GubopXq8KlI0ThVql6ZtVGN2dvmrCPAVAZleM5TVB61m0VSXvGWa
```
likely benign LLM, confidence 0.96 RSA public key modulus and certificate data in a JWKS test fixture.
Reasoning
JWK modulus value and certificate material in a JWKS client test fixture. Base64url key material is expected in such tests.
info ~~warn~~ → info by review encoding-base64 tests/test_jwks_client.py:38:196

base64-like blob (127 bytes, compression ratio 0.98) (raw pass, confidence 0.60)
```
le1LPpjLLVaSWgkbrVaOD0lkWkP1T1TkrOset_Obh8BwtO-Ww-UfrEwxTyz1646AGkbT2nL8PX0trXrmira8GnrCkFUgTUS61GoTdb9bCJ19PLX9Gnxw7J0BtR0GubopXq8KlI0ThVql6ZtVGN2dvmrCPAVAZleM5TVB61m0VSXvGWaF6_GeOhbFoyWcyUmFvzWhBm8Q38vWgsSI7oHTkEw",
```
likely benign LLM, confidence 0.96 Base64url RSA key material within a JWKS test fixture.
Reasoning
Continuation of the same RSA key modulus in a test fixture; base64url key material is normal here.
info ~~warn~~ → info by review encoding-base64 tests/test_jwks_client.py:43:18

base64-like blob (1040 bytes, compression ratio 0.78) (raw pass, confidence 0.60)
```
                "MIIDBzCCAe+gAwIBAgIJNtD9Ozi6j2jJMA0GCSqGSIb3DQEBCwUAMCExHzAdBgNVBAMTFmRldi04N2V2eDlydS5hdXRoMC5jb20wHhcNMTkwNjIwMTU0NDU4WhcNMzMwMjI2MTU0NDU4WjAhMR8wHQYDVQQDExZkZXYtODdldng5cnUuYXV0aDAuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0wtlJRY9+ru61LmOgieeI7/rD1oIna9QpBMAOWw8wTuoIhFQFwcIi7MFB7IEfelCPj08vkf
```
likely benign LLM, confidence 0.96 Base64-encoded X.509 certificate in a test fixture.
Reasoning
Embedded X.509 certificate DER in base64 within a JWKS test fixture for a mocked Auth0 endpoint. Expected test data.
info ~~warn~~ → info by review encoding-base64 tests/test_jwks_client.py:55:227

base64-like blob (89 bytes, compression ratio 1.03) (raw pass, confidence 0.60)
```
xuCOWWjiBNcTmGfnj5_NvRHNUh2iTLuiJpHbGcPzWc5-lc4r-_ehw9EFfp2XsxE9xvtbMZ4SouJCiv9xnrnhe2bdpWuu34hXZCrQwE8DjRY3UR8LjyMxHHPLzX2LWNMHjfN3nAZMteS-Ok11VYDFI-4qCCVGo_WesBCAeqCjPLRyZoV27x1YGsUQ",
```
likely benign LLM, confidence 0.95 Base64url key or signature fragment in JWKS test data.
Reasoning
Signature/key base64 fragment in a JWKS test file; consistent with test vectors for token verification.
info ~~warn~~ → info by review encoding-base64 tests/test_jwks_client.py:304:18

4 rows of base64-like lines, lines 304-304 (first: base64-like blob (120 bytes, compression ratio 0.98)) (raw pass, confidence 0.60)
```
        token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik5FRTFRVVJCT1RNNE16STVSa0ZETlRZeE9UVTFNRGcyT0Rnd1EwVXpNVGsxUWpZeVJrUkZRdyJ9.eyJpc3MiOiJodHRwczovL2Rldi04N2V2eDlydS5hdXRoMC5jb20vIiwic3ViIjoiYVc0Q2NhNzl4UmVMV1V6MGFFMkg2a0QwTzNjWEJWdENAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vZXhwZW5zZXMtYXBpIiwiaWF0IjoxNTcyMDA2OTU0LC
```
likely benign LLM, confidence 0.95 Sample JWT token string in a JWKS client test.
Reasoning
A JWT literal used as a token in a test; multi-line base64 is simply a long token string, typical for auth client tests.
info ~~warn~~ → info by review encoding-base64 tests/test_jwks_client.py:540:18

4 rows of base64-like lines, lines 540-540 (first: base64-like blob (120 bytes, compression ratio 0.98)) (raw pass, confidence 0.60)
```
        token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik5FRTFRVVJCT1RNNE16STVSa0ZETlRZeE9UVTFNRGcyT0Rnd1EwVXpNVGsxUWpZeVJrUkZRdyJ9.eyJpc3MiOiJodHRwczovL2Rldi04N2V2eDlydS5hdXRoMC5jb20vIiwic3ViIjoiYVc0Q2NhNzl4UmVMV1V6MGFFMkg2a0QwTzNjWEJWdENAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vZXhwZW5zZXMtYXBpIiwiaWF0IjoxNTcyMDA2OTU0LC
```
likely benign LLM, confidence 0.95 Sample JWT token string in a JWKS client test.
Reasoning
Same sample JWT token literal repeated in another test; ordinary test data.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/jpadilla/pyjwt pyjwt && cd pyjwt
git checkout 2.15.1
disclude scan --severity info --diff 2.15.0 .