references/findings.md — Hidden Character Scanner

# Interpreting Hidden Character Scanner findings

The scanner reports a location and Unicode identity. A finding tells you where to inspect; it does not prove malicious intent. Some invisible or non-ASCII characters are valid in natural language and emoji.

| Category | What it indicates | Review action |
| --- | --- | --- |
| Zero-width | U+200B through U+200D, U+2060, or U+FEFF away from file start | Inspect whether a hidden separator changes a token or instruction. |
| Bidirectional control | Direction marks, embeddings, overrides, or isolates | Compare displayed order with source order. An unterminated embedding or isolate on a line is high severity `trojan-source`. |
| Unicode tag | A tag character in U+E0000 through U+E007F | Use `decode-tags` to reveal any ASCII payload, then review the visible text. |
| Variation selector | A selector outside expected emoji-base use; the emoji-base allow-list is a fixed heuristic, not full Unicode emoji data | Check why an otherwise similar glyph was modified. |
| Other format character | A Unicode `Cf` character outside the named groups in a code file | Inspect its effect in the surrounding text. |
| Unusual whitespace | Selected nonstandard spaces in a code file | Check indentation, identifiers, and string contents. |
| Mixed-script word | Latin letters combined with Cyrillic or Greek letters | Review the reported non-Latin letters; the scanner has no confusables table. |

Locations are line and column positions in decoded UTF-8 text. Human-readable output escapes invisible and untrusted text; JSON remains structured JSON. Files with NUL bytes, invalid UTF-8, or read failures appear in the skipped list rather than as findings. A partial result must be investigated before calling a scan clean.

By Zero Width Lab (zerowidthlab.com)

License: MIT (read it).

Back to the listing