{"data":{"verdict":"block","verdictReason":"6 finding(s) fail the policy","mode":"files","summary":{"total":8,"returned":8,"truncated":false,"bySeverity":{"critical":6,"high":0,"medium":2,"low":0},"byRule":{"USC001":4,"USC002":0,"USC003":0,"USC004":0,"USC005":0,"USC006":0,"USC007":0,"USC008":0,"USC009":0,"USC010":0,"USC011":0,"USC012":0,"USC013":0,"USC014":0,"USC015":2,"USC016":0,"USC017":0,"USC018":0,"USC019":2},"blocking":6,"filesScanned":1,"filesSkipped":0},"findings":[{"id":"F1","ruleId":"USC001","ruleName":"bidi-control","severity":"critical","path":"src/auth.js","line":2,"column":12,"codePoints":"U+202E","snippet":"if (isAdmin\\u{202E} \\u{2066}// check later\\u{2069} \\u{2066}...","message":"Bidirectional control character U+202E RIGHT-TO-LEFT OVERRIDE in identifier","charInfo":"U+202E RIGHT-TO-LEFT OVERRIDE"},{"id":"F2","ruleId":"USC001","ruleName":"bidi-control","severity":"critical","path":"src/auth.js","line":2,"column":14,"codePoints":"U+2066","snippet":"if (isAdmin\\u{202E} \\u{2066}// check later\\u{2069} \\u{2066}) ...","message":"Bidirectional control character U+2066 LEFT-TO-RIGHT ISOLATE in identifier","charInfo":"U+2066 LEFT-TO-RIGHT ISOLATE"},{"id":"F3","ruleId":"USC001","ruleName":"bidi-control","severity":"critical","path":"src/auth.js","line":2,"column":29,"codePoints":"U+2069","snippet":"...min\\u{202E} \\u{2066}// check later\\u{2069} \\u{2066}) {","message":"Bidirectional control character U+2069 POP DIRECTIONAL ISOLATE in identifier","charInfo":"U+2069 POP DIRECTIONAL ISOLATE"},{"id":"F4","ruleId":"USC001","ruleName":"bidi-control","severity":"critical","path":"src/auth.js","line":2,"column":31,"codePoints":"U+2066","snippet":"...n\\u{202E} \\u{2066}// check later\\u{2069} \\u{2066}) {","message":"Bidirectional control character U+2066 LEFT-TO-RIGHT ISOLATE in identifier","charInfo":"U+2066 LEFT-TO-RIGHT ISOLATE"},{"id":"F5","ruleId":"USC015","ruleName":"bidi-pairing","severity":"critical","path":"src/auth.js","line":2,"column":1,"codePoints":"U+202E","snippet":"if (isAdmin\\u{202E} \\u{2066}// check later\\u{2069} \\u{2066}) {","message":"Unbalanced bidi embedding/override controls (unclosed: 1, orphan closers: 0)","charInfo":"embed imbalance: 1"},{"id":"F6","ruleId":"USC015","ruleName":"bidi-pairing","severity":"critical","path":"src/auth.js","line":2,"column":1,"codePoints":"U+2066 U+2069","snippet":"if (isAdmin\\u{202E} \\u{2066}// check later\\u{2069} \\u{2066}) {","message":"Unbalanced bidi isolate controls (unclosed: 1, orphan closers: 0)","charInfo":"isolate imbalance: 1"},{"id":"F7","ruleId":"USC019","ruleName":"non-ascii-identifier","severity":"medium","path":"src/auth.js","line":2,"column":12,"codePoints":"U+202E","snippet":"isAdmin\\u{202E}","message":"Non-ASCII U+202E RIGHT-TO-LEFT OVERRIDE in identifier 'isAdmin\\u{202E}' (policy: ascii-only)","charInfo":"U+202E RIGHT-TO-LEFT OVERRIDE"},{"id":"F8","ruleId":"USC019","ruleName":"non-ascii-identifier","severity":"medium","path":"src/auth.js","line":2,"column":14,"codePoints":"U+2066","snippet":"\\u{2066}","message":"Non-ASCII U+2066 LEFT-TO-RIGHT ISOLATE in identifier '\\u{2066}' (policy: ascii-only)","charInfo":"U+2066 LEFT-TO-RIGHT ISOLATE"}],"sarif":{"$schema":"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"unicode-safety-check","informationUri":"https://github.com/dcondrey/unicode-safety-check","version":"3.0.0","semanticVersion":"3.0.0","rules":[{"id":"USC001","name":"bidi-control","shortDescription":{"text":"Bidirectional control character"},"defaultConfiguration":{"level":"error"},"helpUri":"https://github.com/dcondrey/unicode-safety-check#what-it-detects","properties":{"tags":["security","unicode","supply-chain"]}},{"id":"USC002","name":"invisible-format","shortDescription":{"text":"Invisible formatting character"},"defaultConfiguration":{"level":"error"},"helpUri":"https://github.com/dcondrey/unicode-safety-check#what-it-detects","properties":{"tags":["security","unicode","supply-chain"]}},{"id":"USC003","name":"mixed-script","shortDescription":{"text":"Mixed-script identifier"},"defaultConfiguration":{"level":"error"},"helpUri":"https://github.com/dcondrey/unicode-safety-check#what-it-detects","properties":{"tags":["security","unicode","supply-chain"]}},{"id":"USC004","name":"confusable-collision","shortDescription":{"text":"Confusable identifier collision"},"defaultConfiguration":{"level":"error"},"helpUri":"https://github.com/dcondrey/unicode-safety-check#what-it-detects","properties":{"tags":["security","unicode","supply-chain"]}},{"id":"USC005","name":"suspicious-spacing","shortDescription":{"text":"Suspicious spacing character"},"defaultConfiguration":{"level":"warning"},"helpUri":"https://github.com/dcondrey/unicode-safety-check#what-it-detects","properties":{"tags":["security","unicode","supply-chain"]}},{"id":"USC006","name":"normalization-drift","shortDescription":{"text":"Normalization-unstable text"},"defaultConfiguration":{"level":"warning"},"helpUri":"https://github.com/dcondrey/unicode-safety-check#what-it-detects","properties":{"tags":["security","unicode","supply-chain"]}},{"id":"USC007","name":"control-character","shortDescription":{"text":"Disallowed control character"},"defaultConfiguration":{"level":"error"},"helpUri":"https://github.com/dcondrey/unicode-safety-check#what-it-detects","properties":{"tags":["security","unicode","supply-chain"]}},{"id":"USC008","name":"invalid-encoding","shortDescription":{"text":"Invalid UTF-8 encoding"},"defaultConfiguration":{"level":"error"},"helpUri":"https://github.com/dcondrey/unicode-safety-check#what-it-detects","properties":{"tags":["security","unicode","supply-chain"]}},{"id":"USC009","name":"misplaced-bom","shortDescription":{"text":"Misplaced byte-order mark"},"defaultConfiguration":{"level":"error"},"helpUri":"https://github.com/dcondrey/unicode-safety-check#what-it-detects","properties":{"tags":["security","unicode","supply-chain"]}},{"id":"USC010","name":"variation-selector","shortDescription":{"text":"Suspicious variation selector sequence"},"defaultConfiguration":{"level":"error"},"helpUri":"https://github.com/dcondrey/unicode-safety-check#what-it-detects","properties":{"tags":["security","unicode","supply-chain"]}},{"id":"USC011","name":"private-use","shortDescription":{"text":"Private Use Area code point"},"defaultConfiguration":{"level":"error"},"helpUri":"https://github.com/dcondrey/unicode-safety-check#what-it-detects","properties":{"tags":["security","unicode","supply-chain"]}},{"id":"USC012","name":"tag-character","shortDescription":{"text":"Tag character (payload encoding)"},"defaultConfiguration":{"level":"error"},"helpUri":"https://github.com/dcondrey/unicode-safety-check#what-it-detects","properties":{"tags":["security","unicode","supply-chain"]}},{"id":"USC013","name":"deprecated-format","shortDescription":{"text":"Deprecated format character"},"defaultConfiguration":{"level":"error"},"helpUri":"https://github.com/dcondrey/unicode-safety-check#what-it-detects","properties":{"tags":["security","unicode","supply-chain"]}},{"id":"USC014","name":"annotation-anchor","shortDescription":{"text":"Interlinear annotation anchor"},"defaultConfiguration":{"level":"error"},"helpUri":"https://github.com/dcondrey/unicode-safety-check#what-it-detects","properties":{"tags":["security","unicode","supply-chain"]}},{"id":"USC015","name":"bidi-pairing","shortDescription":{"text":"Unbalanced bidi control pairing"},"defaultConfiguration":{"level":"error"},"helpUri":"https://github.com/dcondrey/unicode-safety-check#what-it-detects","properties":{"tags":["security","unicode","supply-chain"]}},{"id":"USC016","name":"default-ignorable","shortDescription":{"text":"Default-ignorable code point"},"defaultConfiguration":{"level":"error"},"helpUri":"https://github.com/dcondrey/unicode-safety-check#what-it-detects","properties":{"tags":["security","unicode","supply-chain"]}},{"id":"USC017","name":"homoglyph","shortDescription":{"text":"Homoglyph character"},"defaultConfiguration":{"level":"error"},"helpUri":"https://github.com/dcondrey/unicode-safety-check#what-it-detects","properties":{"tags":["security","unicode","supply-chain"]}},{"id":"USC018","name":"mixed-line-endings","shortDescription":{"text":"Mixed line endings"},"defaultConfiguration":{"level":"warning"},"helpUri":"https://github.com/dcondrey/unicode-safety-check#what-it-detects","properties":{"tags":["security","unicode","supply-chain"]}},{"id":"USC019","name":"non-ascii-identifier","shortDescription":{"text":"Non-ASCII in identifier (policy violation)"},"defaultConfiguration":{"level":"warning"},"helpUri":"https://github.com/dcondrey/unicode-safety-check#what-it-detects","properties":{"tags":["security","unicode","supply-chain"]}}]}},"columnKind":"unicodeCodePoints","results":[{"ruleId":"USC001","level":"error","message":{"text":"U+202E RIGHT-TO-LEFT OVERRIDE -- Bidirectional control character U+202E RIGHT-TO-LEFT OVERRIDE in identifier"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/auth.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":2,"startColumn":12}}}],"properties":{"findingId":"F1","severity":"critical","codePoints":"U+202E"}},{"ruleId":"USC001","level":"error","message":{"text":"U+2066 LEFT-TO-RIGHT ISOLATE -- Bidirectional control character U+2066 LEFT-TO-RIGHT ISOLATE in identifier"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/auth.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":2,"startColumn":14}}}],"properties":{"findingId":"F2","severity":"critical","codePoints":"U+2066"}},{"ruleId":"USC001","level":"error","message":{"text":"U+2069 POP DIRECTIONAL ISOLATE -- Bidirectional control character U+2069 POP DIRECTIONAL ISOLATE in identifier"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/auth.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":2,"startColumn":29}}}],"properties":{"findingId":"F3","severity":"critical","codePoints":"U+2069"}},{"ruleId":"USC001","level":"error","message":{"text":"U+2066 LEFT-TO-RIGHT ISOLATE -- Bidirectional control character U+2066 LEFT-TO-RIGHT ISOLATE in identifier"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/auth.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":2,"startColumn":31}}}],"properties":{"findingId":"F4","severity":"critical","codePoints":"U+2066"}},{"ruleId":"USC015","level":"error","message":{"text":"embed imbalance: 1 -- Unbalanced bidi embedding/override controls (unclosed: 1, orphan closers: 0)"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/auth.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":2,"startColumn":1}}}],"properties":{"findingId":"F5","severity":"critical","codePoints":"U+202E"}},{"ruleId":"USC015","level":"error","message":{"text":"isolate imbalance: 1 -- Unbalanced bidi isolate controls (unclosed: 1, orphan closers: 0)"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/auth.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":2,"startColumn":1}}}],"properties":{"findingId":"F6","severity":"critical","codePoints":"U+2066 U+2069"}},{"ruleId":"USC019","level":"warning","message":{"text":"U+202E RIGHT-TO-LEFT OVERRIDE -- Non-ASCII U+202E RIGHT-TO-LEFT OVERRIDE in identifier 'isAdmin\\u{202E}' (policy: ascii-only)"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/auth.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":2,"startColumn":12}}}],"properties":{"findingId":"F7","severity":"medium","codePoints":"U+202E"}},{"ruleId":"USC019","level":"warning","message":{"text":"U+2066 LEFT-TO-RIGHT ISOLATE -- Non-ASCII U+2066 LEFT-TO-RIGHT ISOLATE in identifier '\\u{2066}' (policy: ascii-only)"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/auth.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":2,"startColumn":14}}}],"properties":{"findingId":"F8","severity":"medium","codePoints":"U+2066"}}]}]},"skipped":[],"warnings":[],"explanations":[{"id":"F1","ruleId":"USC001","codePoints":"U+202E","attackVector":"A right-to-left override placed right after isAdmin in an if condition can reorder how the line renders, so the visible text no longer matches the token order the parser reads. This is the Trojan Source pattern (CVE-2021-42574) in a JavaScript auth check.","impact":"A reviewer may read the condition as a benign check while the compiler evaluates different logic, which can bypass or invert the admin authorization gate.","remediation":"Remove the bidi control character, then verify the condition's logic against the raw token sequence rather than the rendered view."},{"id":"F2","ruleId":"USC001","codePoints":"U+2066","attackVector":"A left-to-right isolate inside the condition, followed by a comment and a closing isolate, lets the displayed order differ from the parsed order of the if expression.","impact":"The rendered line can look like a finished check while the parser evaluates a different expression, so the authorization decision is hidden from review.","remediation":"Strip the isolate control, then re-read the condition with bidi characters shown explicitly and confirm the parsed expression matches intent."},{"id":"F3","ruleId":"USC001","codePoints":"U+2069","attackVector":"A pop-directional-isolate closes the earlier isolate near a line comment, so text that looks commented out may actually be parsed as code, or the reverse.","impact":"A reviewer can be shown a comment or inert text that the compiler treats as live logic, enabling a hidden condition change in the auth path.","remediation":"Remove the isolate terminator and check that the comment boundary and the code tokens are the same as the raw source shows."},{"id":"F4","ruleId":"USC001","codePoints":"U+2066","attackVector":"A second left-to-right isolate just before the closing parenthesis of the condition reorders the visual layout of the closing brace and parenthesis relative to the logic.","impact":"The rendered block structure can misrepresent where the condition and body end, hiding the real control flow from a human reviewer.","remediation":"Remove the isolate control and confirm the braces and parentheses by inspecting the raw bytes or a bidi-revealing diff."},{"id":"F5","ruleId":"USC015","codePoints":"U+202E","attackVector":"The override control is unpaired or not properly closed at the start of the condition, so its reordering effect may extend across following tokens, which is the Trojan Source bidi-pairing hazard.","impact":"Reviewers see a different sequence of tokens than the compiler parses, so the auth logic can change without any visible diff signal.","remediation":"Remove the unbalanced override and ensure all directional controls in the file are balanced before merging."},{"id":"F6","ruleId":"USC015","codePoints":"U+2066 U+2069","attackVector":"The isolate pair wraps a comment-like segment inside the if statement, so the visually enclosed region can differ from the parsed region the compiler sees.","impact":"The displayed scope of the check can be misleading, so the actual condition evaluated at runtime can differ from what reviewers approved.","remediation":"Delete the isolate pair and re-verify the condition's parsed scope with bidi-aware tooling."},{"id":"F7","ruleId":"USC019","codePoints":"U+202E","attackVector":"The override is embedded inside the identifier isAdmin, so the identifier's displayed form can differ from its actual code-point sequence, making it look like a different name than the one the code uses.","impact":"A lookalike or reordered identifier can make a reviewer believe the admin check refers to a trusted variable while it refers to a different binding.","remediation":"Rename the identifier to plain ASCII with no embedded control characters and confirm all references resolve to the intended variable."},{"id":"F8","ruleId":"USC019","codePoints":"U+2066","attackVector":"The isolate sits in the non-ASCII identifier position, so the name's rendered form can diverge from the raw identifier the compiler binds.","impact":"Two names may look identical to a reviewer while being distinct bindings, which can let a check silently refer to the wrong variable.","remediation":"Remove the isolate and rename the identifier using only ASCII letters, then rerun a check that all identifier uses match."}],"llm":"ok","deterministic":{"engine":"unicode-safety-check 3.0.0, rules USC001-USC019 (github.com/dcondrey/unicode-safety-check, rust/)","findings":8,"verdictBasis":"block: any critical finding, or a high finding in a code/config file; warn: any other finding (including high findings in .md/.txt/.html/.css/.xml/.csv files); pass: no findings","notes":["USC008 (invalid UTF-8) is detected as an unpaired surrogate only: request bodies are decoded before scanning"]}},"_provenance":{"version":"writerslogic-provenance/1","issuer":"did:web:agents.writerslogic.com","verify":{"endpoint":"POST /api/v1/verify-provenance","did":"did:web:agents.writerslogic.com"},"manifest":{"format":"application/json","instance_id":"xmp:iid:96a5131a-d19d-4828-a7dc-498f46bbd938","claim_generator_info":[{"name":"WritersLogic x402 Agent Hub","version":"2.0.0"}],"title":"Adversarial Unicode & Trojan Source gatekeeper","assertions":[{"label":"c2pa.actions.v2","data":{"actions":[{"action":"c2pa.created","when":"2026-11-04T20:24:45.352Z","softwareAgent":{"name":"writerslogic-agent-hub/unicode-safety-gate","version":"2.0.0"},"digitalSourceType":"http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia","parameters":{"endpoint":"POST /api/v1/unicode-safety-gate","inputDigest":{"alg":"sha256","hash":"0faa5c20c662e5fb96b1506539ecb79b2e3c061f140c6fa4d887c55e437c1d96","canonicalization":"JCS"}}}]}},{"label":"c2pa.hash.data","data":{"alg":"sha256","hash":"c6bf87e7bb646588c3b29005eb3434b51f05cd2395f239f98e630cf4c3c80912","name":"jcs-canonical-json(data)"}}]},"credential":{"@context":["https://www.w3.org/ns/credentials/v2"],"id":"urn:uuid:b689815e-1627-4f4f-81b3-6fda048d9292","type":["VerifiableCredential","AgentOutputCredential"],"issuer":"did:web:agents.writerslogic.com","validFrom":"2026-11-04T20:24:45.352Z","credentialSubject":{"id":"urn:sha256:c6bf87e7bb646588c3b29005eb3434b51f05cd2395f239f98e630cf4c3c80912","agent":"unicode-safety-gate","endpoint":"POST /api/v1/unicode-safety-gate","outputDigest":{"alg":"sha256","value":"c6bf87e7bb646588c3b29005eb3434b51f05cd2395f239f98e630cf4c3c80912","canonicalization":"JCS"},"inputDigest":{"alg":"sha256","value":"0faa5c20c662e5fb96b1506539ecb79b2e3c061f140c6fa4d887c55e437c1d96","canonicalization":"JCS"},"manifestDigest":{"alg":"sha256","value":"343b683ff0fc6ad3d9ed3980a6155acf29a8c227c9a2aa11f419be7503bfcb5f","canonicalization":"JCS"},"ingredients":[],"payment":{"scheme":"api-key","network":"eip155:8453","payer":"sample"}},"proof":{"type":"DataIntegrityProof","cryptosuite":"eddsa-jcs-2022","created":"2026-11-04T20:24:45.352Z","verificationMethod":"did:web:agents.writerslogic.com#key-1","proofPurpose":"assertionMethod","proofValue":"z4boU4m9NTV9d2j62YQigWikmKvJd7Aukc8sFTnPVrCKk6gA6L4RAPre8w5w2EfWqVuZigH7EHsp6KZtNtJW4wWoF"}},"ethSignature":{"type":"EIP-191","signer":"did:pkh:eip155:8453:0x3DBd42560cA7a7E448A2c7DfC9E785526189411f","address":"0x3DBd42560cA7a7E448A2c7DfC9E785526189411f","message":"writerslogic-provenance:dd89cd75587bbf271781d3630766d8aa50cc7b70fd114b875979dd8eeaa0ee2c","signature":"0x36d0ec430e235bc243b37ac67f6ddde3cf45d2533bf9f3cefcd09c7afd6b58415f624957b8f27608281b764386d58ff45308fa0d2cab1cc3350276866a75f2d71b"}}}