The code passed review because it was read correctly. It runs differently.

▤ Summary

This article discusses the Trojan Source vulnerability and how malicious Unicode characters can make source code look different from how it actually executes. It shows examples in Python where hidden bidirectional and zero-width characters can alter code review outcomes. It also presents a script that scans source files for suspicious Unicode characters and token anomalies. The piece recommends using security and code-quality tools such as ruff, flake8, and gitleaks to catch these issues earlier.

▦ Linked Companies