---
title: "Hidden Unicode"
description: "Finds Trojan Source bidi controls, invisible and zero-width characters, hidden text in Unicode tag characters, variation-selector payloads and homoglyph identifiers in code, docs and agent instruction files. Known limits: string and comment detection is approximate per language and only ever lowers severity when certain; only UTF-8, UTF-16 and UTF-32 are decoded; files over 16 MB are reported as not scanned; homoglyphs are checked for Cyrillic and Greek look-alikes only."
url: https://openaudit.se/auditors/code.unicode/
---

# Hidden Unicode

`code.unicode`

Finds Trojan Source bidi controls, invisible and zero-width characters, hidden text in Unicode tag characters, variation-selector payloads and homoglyph identifiers in code, docs and agent instruction files. Known limits: string and comment detection is approximate per language and only ever lowers severity when certain; only UTF-8, UTF-16 and UTF-32 are decoded; files over 16 MB are reported as not scanned; homoglyphs are checked for Cyrillic and Greek look-alikes only.

- **Engine:** Built-in
- **Targets:** Codebase
- **Areas:** Security
- **Runs:** By default, when the target applies
- **Network:** Only the target itself

## Run only this auditor

```sh
bunx @openaudit/cli . --only code.unicode
```

Built into openaudit; nothing to install.

## More security auditors

- [Secrets in source](https://openaudit.se/auditors/code.secrets/) (`code.secrets`)
- [Static security analysis](https://openaudit.se/auditors/code.security/) (`code.security`)
- [API definition and server configuration](https://openaudit.se/auditors/code.api/) (`code.api`)
- [AI agent configuration](https://openaudit.se/auditors/code.agent-config/) (`code.agent-config`)
- [gitleaks secret scan](https://openaudit.se/auditors/code.gitleaks/) (`code.gitleaks`)
- [Semgrep SAST](https://openaudit.se/auditors/code.semgrep/) (`code.semgrep`)
- [Trivy filesystem scan](https://openaudit.se/auditors/code.trivy-fs/) (`code.trivy-fs`)
- [trufflehog secret scan](https://openaudit.se/auditors/code.trufflehog/) (`code.trufflehog`)