JA3/JA3S fingerprints are defined by their specs as MD5 digests of the ClientHello/ServerHello feature tuples — they are identifiers, not security primitives. Pass usedforsecurity=False at the two call sites so bandit stops flagging them as B324 High when scanning outside the templates/ exclude.