Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
base64-like blob (2360 bytes over 37 lines, compression ratio 0.77) (raw pass, confidence 0.60)
root_key_pem = b"""-----BEGIN RSA PRIVATE KEY-----
MIIG5AIBAAKCAYEAuljmNv5LsBRvH2DM3TrCSpR5v540tOMI4qh+IxOfxjROoIDZ
nJjdcxw0ExohLuF0VOCaaq18We1ihvEsCX+3B9vP0CdFpUOHYfJS8e8wHEqfUdIM
sAsu2p0XSlxciM/ThLs0o9BSaCS/YfQrBxSliWCNMW1dGI/7vANKJB4/VhVKuISg
likely benign
LLM, confidence 0.93
Embedded RSA private key PEM used as a test fixture.
Reasoning
Raw-pass base64 flag on a PEM RSA private key literal inside a crypto test module. Test fixtures like this are expected, and the byte-level pattern matches any PEM block, so it carries no malicious signal.
-
base64-like blob (2360 bytes over 37 lines, compression ratio 0.77) (raw pass, confidence 0.60)
likely benign
LLM, confidence 0.93
Continuation of an RSA private key PEM test fixture.
Reasoning
Continuation of the same PEM test fixture; the base64 flag is the expected result for a key literal in a crypto test file.
-
base64-like blob (1496 bytes over 24 lines, compression ratio 0.74) (raw pass, confidence 0.60)
intermediate_cert_pem = b"""-----BEGIN CERTIFICATE-----
MIIEXDCCAsSgAwIBAgIRAMPzhm6//0Y/g2pmnHR2C4cwDQYJKoZIhvcNAQELBQAw
WDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAklMMRAwDgYDVQQHEwdDaGljYWdvMRAw
DgYDVQQKEwdUZXN0aW5nMRgwFgYDVQQDEw9UZXN0aW5nIFJvb3QgQ0EwHhcNMjAw
likely benign
LLM, confidence 0.93
Embedded intermediate certificate PEM used as a test fixture.
Reasoning
X.509 certificate PEM used in a test of certificate chain handling. The base64 content is ordinary certificate encoding and the file context is a test suite.
-
base64-like blob (2356 bytes over 37 lines, compression ratio 0.77) (raw pass, confidence 0.60)
intermediate_key_pem = b"""-----BEGIN RSA PRIVATE KEY-----
MIIG4gIBAAKCAYEAo3rOxOVrdLdRsR1o0+JG7MRpCtMoafA63TM/DczLQ4jURv5M
zyTE7FFdXq4xNJRYgD16vUavZluQGj30+5Lkt07CuO/BK3itl8UW+dsHp95gzBvg
nj5AVZGkNOQ0Y4CbXO087Ywep7tpBfZ5fzURLeH+OHQGseEFZ5e0w8AzAarWu+Ez
likely benign
LLM, confidence 0.93
Embedded intermediate RSA private key PEM test fixture.
Reasoning
Another RSA private key PEM in the test file's fixtures. Key material in tests is routine and the raw pass is known to over-flag base64.
-
base64-like blob (1428 bytes over 23 lines, compression ratio 0.76) (raw pass, confidence 0.60)
server_cert_pem = b"""-----BEGIN CERTIFICATE-----
MIIEKTCCApGgAwIBAgIJAJn/HpR21r/8MA0GCSqGSIb3DQEBCwUAMFgxCzAJBgNV
BAYTAlVTMQswCQYDVQQIDAJJTDEQMA4GA1UEBwwHQ2hpY2FnbzEQMA4GA1UECgwH
VGVzdGluZzEYMBYGA1UEAwwPVGVzdGluZyBSb290IENBMB4XDTIwMDgwMjE3MTEy
likely benign
LLM, confidence 0.93
Embedded server certificate PEM test fixture.
Reasoning
Server certificate PEM literal in a test module, consistent with generating or validating certificates in tests.
-
base64-like blob (2360 bytes over 37 lines, compression ratio 0.77) (raw pass, confidence 0.60)
b"""-----BEGIN RSA PRIVATE KEY-----
MIIG5AIBAAKCAYEApT23GEqDo1zR1Ur1W/gxi5g/oeyhHjzf7ALndXxrGR/LZPKe
sFK6Dwdql5IVbmPB3ByyNoPAQgC6Bl9GjPQ3W9H9DpM4UBifaFHCUCBRdWTc1ekM
1X9BGWIa/GEsBWm+7VrgTF9Vmg5DI9rymiAOCtR0Hd61iaYUc1rT0u/WfIxlaLq3
likely benign
LLM, confidence 0.93
Embedded RSA private key PEM test fixture.
Reasoning
RSA private key PEM literal in the crypto test fixtures; the base64 density is just the encoding of a key.
-
base64-like blob (1496 bytes over 24 lines, compression ratio 0.72) (raw pass, confidence 0.60)
intermediate_server_cert_pem = b"""-----BEGIN CERTIFICATE-----
MIIEXTCCAsWgAwIBAgIRAPQFY9jfskSihdiNSNdt6GswDQYJKoZIhvcNAQELBQAw
ZjEVMBMGA1UEAxMMaW50ZXJtZWRpYXRlMQwwCgYDVQQKEwNvcmcxETAPBgNVBAsT
CG9yZy11bml0MQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEjAQBgNVBAcTCVNh
likely benign
LLM, confidence 0.93
Embedded intermediate server certificate PEM test fixture.
Reasoning
Intermediate server certificate PEM in the test file, the same pattern as the other certificate fixtures.
-
base64-like blob (2360 bytes over 37 lines, compression ratio 0.77) (raw pass, confidence 0.60)
intermediate_server_key_pem = b"""-----BEGIN RSA PRIVATE KEY-----
MIIG5AIBAAKCAYEAvdRxPHAKwxmogT7uWiWby3qVPQhhmQTgvu7aojrib0K/O252
qophlyumtmhtnGo+Gpzwg7cIVHadXPBlbGscJybqcDMmNVdQWtzhMuxVhgkvVC8p
fGv3tUiLJJTvHrFatBCyoO2WtvSMfn0RgVszZ4yTZ8FPZfiHpgxeWrKsONkXpqkK
likely benign
LLM, confidence 0.93
Embedded intermediate server RSA private key PEM test fixture.
Reasoning
RSA private key PEM literal for an intermediate server key within the test suite. Key fixtures of this kind are expected.
-
base64-like blob (1424 bytes over 23 lines, compression ratio 0.75) (raw pass, confidence 0.60)
client_cert_pem = b"""-----BEGIN CERTIFICATE-----
MIIEJzCCAo+gAwIBAgIJAKxpFI5lODkjMA0GCSqGSIb3DQEBCwUAMFgxCzAJBgNV
BAYTAlVTMQswCQYDVQQIDAJJTDEQMA4GA1UEBwwHQ2hpY2FnbzEQMA4GA1UECgwH
VGVzdGluZzEYMBYGA1UEAwwPVGVzdGluZyBSb290IENBMB4XDTIwMDgwMjE3MTEy
likely benign
LLM, confidence 0.93
Embedded client certificate PEM test fixture.
Reasoning
Client certificate PEM in a test module. Certificate encodings trigger the base64 heuristic by design.
-
base64-like blob (2360 bytes over 37 lines, compression ratio 0.77) (raw pass, confidence 0.60)
b"""-----BEGIN RSA PRIVATE KEY-----
MIIG5AIBAAKCAYEAxgoXTjGNeuBUnCan4ieSxLY2DihIOJ5jADBrhyE/MGWRH82m
h4QW8qcyqtnDz9arch4L7VDDOijhRI+MvQKJ6s83ZVcWzIuvgL2C1pT6Aea/xtRn
bJVL123OxdNgf+rAf/ohV5nHYzowEHC1sVYFC/tQqHqGNWsDWJs0Lniv0/Nmv+gG
likely benign
LLM, confidence 0.93
Embedded RSA private key PEM test fixture.
Reasoning
RSA private key PEM literal in the test fixtures, with no execution or decoding logic around it.
-
base64-like blob (824 bytes over 13 lines, compression ratio 0.80) (raw pass, confidence 0.60)
SHOho56WxDkT0ht10UTeKc0F5u8cqIa01kzFAmETw0MAs8ezYtK15NPdCXUm3X/2
a17G7LSF5bkxOgZ7vpXyMzun/owrj7CzvLxyncyEFZWvtvzaAhPhvTJtTIB3kf8B
8+qRcpTGK7NgXEgYBW5bj1y4qZkD4zCL9o9NQzsKI3Ie8i0239jsDOWR38AxjXBH
likely benign
LLM, confidence 0.90
Continuation of a PEM key literal in a crypto test.
Reasoning
Fragment of a PEM-encoded key in a test file; the snippet is only base64 text with no decoding or execution, so the raw flag is a false positive.
-
base64-like blob (848 bytes over 14 lines, compression ratio 0.80) (raw pass, confidence 0.60)
cleartextPrivateKeyPEM = """-----BEGIN PRIVATE KEY-----
MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAMcRMugJ4kvkOEuT
AvMFr9+3A6+HAB6nKYcXXZz93ube8rJpBZQEfWn73H10dQiQR/a+rhxYEeLy8dPc
UkFcGR9miVkukJ59zex7iySJY76bdBD8gyx1LTKrkCstP2XHKEYqgbj+tm7VzJnY
likely benign
LLM, confidence 0.90
Cleartext PKCS#8 private key PEM literal used as a test fixture.
Reasoning
A PEM-encoded private key in a variable named cleartextPrivateKeyPEM, which is typical of a test that exercises key parsing. The file is a crypto test suite and nothing in the snippet decodes or runs the content.
-
base64-like blob (392 bytes over 7 lines, compression ratio 0.84) (raw pass, confidence 0.60)
cleartextPublicKeyPEM = b"""-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxszlc+b71LvlLS0ypt/l
gT/JzSVJtnEqw9WUNGeiChywX2mmQLHEt7KP0JikqUFZOtPclNY823Q4pErMTSWC
90qlUxI47vNJbXGRfmO2q6Zfw6SE+E9iUb74xezbOJLjBuUIkQzEKEFV+8taiRV+
likely benign
LLM, confidence 0.93
Test fixture containing an RSA public key in PEM form.
Reasoning
A PEM public key literal in a crypto library's test file. Base64 DER key material is expected here, and the raw pass has a high false-positive rate for this pattern.
-
base64-like blob (428 bytes over 7 lines, compression ratio 0.84) (raw pass, confidence 0.60)
inconsistentPrivateKeyPEM = b"""-----BEGIN RSA PRIVATE KEY-----
MIIBPAIBAAJBAKy+e3dulvXzV7zoTZWc5TzgApr8DmeQHTYC8ydfzH7EECe4R1Xh
5kwIzOuuFfn178FBiS84gngaNcrFi0Z5fAkCAwEaAQJBAIqm/bz4NA1H++Vx5Ewx
OcKp3w19QSaZAwlGRtsUxrP7436QjnREM3Bm8ygU11BjkPVmtrKm6AayQfCHqJoT
likely benign
LLM, confidence 0.93
Test fixture containing an intentionally inconsistent RSA private key in PEM form.
Reasoning
A deliberately inconsistent RSA private key used as a negative test case in a crypto test suite. The base64 is key data, not a hidden payload.
-
base64-like blob (3208 bytes over 51 lines, compression ratio 0.76) (raw pass, confidence 0.60)
large_key_pem = b"""-----BEGIN RSA PRIVATE KEY-----
MIIJYgIBAAKCAg4AtRua8eIeevRfsj+fkcHr1vmse7Kgb+oX1ssJAvCb1R7JQMnH
hNDjDP6b3vEkZuPUzlDHymP+cNkXvvi4wJ4miVbO3+SeU4Sh+jmsHeHzGIXat9xW
9PFtuPM5FQq8zvkY8aDeRYmYwN9JKu4/neMBCBqostYlTEWg+bSytO/qWnyHTHKh
likely benign
LLM, confidence 0.94
Test fixture containing a large RSA private key in PEM form.
Reasoning
A large RSA private key PEM in a test file, matching the expected structure of a key fixture. Nothing here executes or decodes into code.
-
base64-like blob (184 bytes over 3 lines, compression ratio 0.92) (raw pass, confidence 0.60)
ec_private_key_pem = b"""-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgYirTZSx+5O8Y6tlG
cka6W6btJiocdrdolfcukSoTEk+hRANCAAQkvPNu7Pa1GcsWU4v7ptNfqCJVq8Cx
zo0MUVPQgwJ3aJtNM1QMOQUayCrRwfklg+D/rFSUwEUqtZh7fJDiFqz3
likely benign
LLM, confidence 0.94
Test fixture containing an EC private key in PEM form.
Reasoning
An EC private key in standard PKCS#8 PEM form inside a test module. The encoding is the normal representation of key material.
-
base64-like blob (124 bytes over 2 lines, compression ratio 1.02) (raw pass, confidence 0.60)
ec_public_key_pem = b"""-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJLzzbuz2tRnLFlOL+6bTX6giVavA
sc6NDFFT0IMCd2ibTTNUDDkFGsgq0cH5JYPg/6xUlMBFKrWYe3yQ4has9w==
-----END PUBLIC KEY-----
likely benign
LLM, confidence 0.94
Test fixture containing an EC public key in PEM form.
Reasoning
A short EC public key in PEM form inside a crypto test module, consistent with a key fixture.
-
base64-like blob (224 bytes over 4 lines, compression ratio 0.90) (raw pass, confidence 0.60)
ec_root_key_pem = b"""-----BEGIN EC PRIVATE KEY-----
MIGlAgEBBDEAz/HOBFPYLB0jLWeTpJn4Yc4m/C4mdWymVHBjOmnwiPHKT326iYN/
ZhmSs+RM94RsoAcGBSuBBAAioWQDYgAEwE5vDdla/nLpWAPAQ0yFGqwLuw4BcN2r
U+sKab5EAEHzLeceRa8ffncYdCXNoVsBcdob1y66CFZMEWLetPTmGapyWkBAs6/L
likely benign
LLM, confidence 0.94
Test fixture containing an EC private key in PEM form.
Reasoning
An EC private key in SEC1 PEM form in a test file. This is ordinary key-format test data.
-
base64-like blob (748 bytes over 12 lines, compression ratio 0.74) (raw pass, confidence 0.60)
ec_root_cert_pem = b"""-----BEGIN CERTIFICATE-----
MIICLTCCAbKgAwIBAgIMWW/hwTl6ufz6/WkCMAoGCCqGSM49BAMDMFgxGDAWBgNV
BAMTD1Rlc3RpbmcgUm9vdCBDQTEQMA4GA1UEChMHVGVzdGluZzEQMA4GA1UEBxMH
Q2hpY2FnbzELMAkGA1UECBMCSUwxCzAJBgNVBAYTAlVTMCAXDTE3MDcxOTIyNDgz
likely benign
LLM, confidence 0.94
Test fixture containing an X.509 certificate in PEM form.
Reasoning
An X.509 certificate PEM block in a crypto test module. Certificates are expected in such suites and contain no executable content.
-
base64-like blob (824 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)
dsa_private_key_pem = b"""-----BEGIN PRIVATE KEY-----
MIICZAIBADCCAjkGByqGSM44BAEwggIsAoIBAQD7UzdlshSCIIuntch43VmfCX1+
WQDTvGw83sRZcN+B7nwFn4dm2PU8cby17oCjX7buBvalVqofnUokrSIDA6Rozm/f
2wpGR9oVpd0xh9cI50pw1G3RZ4lcNWTP8C8O20eIzJoCH1KElcWLCHLAa3XoGOMv
likely benign
LLM, confidence 0.94
Test fixture containing a DSA private key in PEM form.
Reasoning
A DSA private key in PKCS#8 PEM form inside a test module, consistent with key-format fixtures.
-
base64-like blob (1124 bytes over 18 lines, compression ratio 0.78) (raw pass, confidence 0.60)
dsa_public_key_pem = b"""-----BEGIN PUBLIC KEY-----
MIIDRjCCAjkGByqGSM44BAEwggIsAoIBAQD7UzdlshSCIIuntch43VmfCX1+WQDT
vGw83sRZcN+B7nwFn4dm2PU8cby17oCjX7buBvalVqofnUokrSIDA6Rozm/f2wpG
R9oVpd0xh9cI50pw1G3RZ4lcNWTP8C8O20eIzJoCH1KElcWLCHLAa3XoGOMvp4Xn
likely benign
LLM, confidence 0.94
Test fixture containing a DSA public key in PEM form.
Reasoning
A DSA public key in PEM form in a crypto test file. The blob is structured key data, not an obfuscated payload.
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
ed25519_private_key_pem = b"""-----BEGIN PRIVATE KEY-----
MC4CAQAwBQYDK2VwBCIEIKlxBbhVsSURoLTmsu9uTqYH6oF7zpxmp1ZQCAPhDmI2
-----END PRIVATE KEY-----
"""
likely benign
LLM, confidence 0.95
Test fixture containing an Ed25519 private key in PEM form.
Reasoning
A short Ed25519 private key in PEM form, a standard key fixture in a crypto test suite.
-
base64-like blob (60 bytes, compression ratio 1.18) (raw pass, confidence 0.60)
ed25519_public_key_pem = b"""-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEAq+FrpdwI1oTPytx8kGzuLVc+78zJE7hjYG4E9hwXoKI=
-----END PUBLIC KEY-----
"""
likely benign
LLM, confidence 0.95
Test fixture containing an Ed25519 public key in PEM form.
Reasoning
A short Ed25519 public key in PEM form, a standard key fixture in a crypto test suite.
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
ed448_private_key_pem = b"""-----BEGIN PRIVATE KEY-----
MEcCAQAwBQYDK2VxBDsEOcqZ7a3k6JwrJbYO8CNTPT/d7dlWCo5vCf0EYDj79ZvA\nhD8u9EPHlYJw5Y8ZQdH4WmVEfpKA23xkdQ==
-----END PRIVATE KEY-----
"""
likely benign
LLM, confidence 0.90
Test fixture containing an Ed448 private key in PEM form.
Reasoning
An Ed448 private key fixture in PEM form. The literal \n escapes inside the blob are an odd formatting artifact of a test fixture, not evidence of concealed code.
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
ed448_public_key_pem = b"""-----BEGIN PUBLIC KEY-----
MEMwBQYDK2VxAzoAKFfWGCuqIaxgR9GmEXLRciYDyEjTnF56kr0sOVfwHEj+bHSU\neMJTZJR8qFSg8hNsHY1iZh9PIXcA
-----END PUBLIC KEY-----
"""
likely benign
LLM, confidence 0.90
Test fixture containing an Ed448 public key in PEM form.
Reasoning
An Ed448 public key fixture in PEM form with the same escaped-newline artifact. Consistent with a test vector in a crypto library.
-
base64-like blob (1620 bytes over 26 lines, compression ratio 0.77) (raw pass, confidence 0.60)
rsa_private_key_pem = b"""-----BEGIN PRIVATE KEY-----
MIIEuwIBADANBgkqhkiG9w0BAQEFAASCBKUwggShAgEAAoIBAQDZ5FaSaXKn/RTF
xyNr+GRvYnMvLz5XxSDD4JzVRKXxKGFzKKXMJAeXJkvPlho7Ta/HgMNXhMPAe8TT
wcIRnHJqAfmSOnka1ks3Kl6EGQBTevKzyJy8MaUhzZsL4FUUgWUETFQQT8Dwcghf
likely benign
LLM, confidence 0.90
An RSA private key PEM literal used as a test fixture.
Reasoning
Raw-pass base64 hit on a PEM private key literal inside a test module named test_crypto.py. Key material in test fixtures is a normal way to exercise crypto code. Raw findings have a high false-positive rate, and nothing in the snippet shows execution, decoding into code, or exfiltration.
-
base64-like blob (392 bytes over 7 lines, compression ratio 0.84) (raw pass, confidence 0.60)
rsa_public_key_pem = b"""-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2eRWkmlyp/0Uxccja/hk
b2JzLy8+V8Ugw+Cc1USl8ShhcyilzCQHlyZLz5YaO02vx4DDV4TDwHvE08HCEZxy
agH5kjp5GtZLNypehBkAU3rys8icvDGlIc2bC+BVFIFlBExUEE/A8HIIXyaG1dJP
likely benign
LLM, confidence 0.92
An RSA public key PEM literal used in crypto tests.
Reasoning
Raw-pass base64 hit on a PEM public key literal in a crypto test file. Public keys are not secrets, and the pattern is ordinary test data with no execution or obfuscation involved.
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
x25519_private_key_pem = b"""-----BEGIN PRIVATE KEY-----
MC4CAQAwBQYDK2VuBCIEIPAjVfPNTm25VxtBRg+JjjFx9tA3M8aaBdVhjb92iBts
-----END PRIVATE KEY-----
"""
likely benign
LLM, confidence 0.90
An X25519 private key PEM literal in a crypto test.
Reasoning
Raw-pass base64 hit on a short X25519 private key PEM in a test file. The blob is a standard PKCS#8 structure for an X25519 key, which is the kind of fixture a crypto test suite would contain. Nothing decodes it into code or runs it.
-
base64-like blob (360 bytes over 6 lines, compression ratio 0.85) (raw pass, confidence 0.60)
-----BEGIN DH PARAMETERS-----
MIIBCAKCAQEA2F5e976d/GjsaCdKv5RMWL/YV7fq1UUWpPAer5fDXflLMVUuYXxE
3m3ayZob9lbpgEU0jlPAsXHfQPGxpKmvhv+xV26V/DEoukED8JeZUY/z4pigoptl
+8+TYdNNE/rFSZQFXIp+v2D91IEgmHBnZlKFSbKR+p8i0KjExXGjU6ji3S5jkOku
likely benign
LLM, confidence 0.92
DH parameters PEM text in an SSL test module.
Reasoning
Raw-pass base64 hit on DH PARAMETERS PEM text in an SSL test file. This is standard TLS test data for Diffie-Hellman parameters, and the snippet shows no decoding, execution, or network activity.
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
disclude.io