docs
stormdoor.dev
FINDING

spam.invisible_characters

The text contains zero-width, bidi-control or other invisible formatting characters.

SEVERITY
medium
LEADS TO
suspect
GATE
/v1/spam
CHECK
spam.invisible_characters
Jump to what to do

What it looks at#

A curated set of Unicode characters that render as nothing or next to nothing: zero-width space/joiner/non-joiner, the zero-width no-break space (byte-order mark), word joiner, left-to-right/right-to-left marks, and the bidi embedding/override/isolate control characters. Not the full Unicode “format character” category — that also covers controls that are ordinary in real Arabic and other right-to-left text; this list is scoped to characters whose legitimate use in real messages is rare to nonexistent.

Ordinary whitespace is never flagged. Neither is a zero-width joiner used inside a real emoji sequence (the character that glues a family or profession emoji together, 👨‍👩‍👧‍👦) — only a zero-width joiner that isn’t sitting between two emoji characters counts.

Why it matters#

Invisible characters are a real evasion technique: splitting a blocked word so pattern matching misses it (“v​i​a​g​r​a” with zero-width spaces inside), or using bidi override characters to make text display differently than its actual character order — used to disguise file extensions and link destinations.

What to do#

Medium severity — this is a deliberate technique, not something that happens by accident in normal writing.

OTHER FINDING CODES FROM /V1/SPAM