promptdecode

The problem

Hidden text in a pull request or issue can tell a coding agent to merge, and the reviewer never sees it.

What it does

promptdecode decodes hidden Unicode text in your browser, sends nothing, and shows what it says.

How it works

1. Paste any text and it reveals hidden characters and decodes their message
2. Runs entirely in your browser; nothing is sent anywhere
3. A config scanner checks your GitHub workflows for agent steps that untrusted input can reach

TodayThe decoder works today in the browser. promptdecode-core 0.1.0 is on crates.io; the scanner and the GitHub Action are not released yet.

Aims

Autonomous operation

Review is the automation target. A coding agent with a write token reads a pull request that a human reviewer has already approved, and the two of them are not reading the same document: tag-block characters, bidi overrides and variation selectors render as nothing and tokenize normally. The scanners are meant to run in CI on every change, decode what they find rather than merely flag it, and post the plain text back on the pull request, with no model in the loop and nothing leaving the runner.

Intelligence

Deliberately none where none is needed. Both planned engines are deterministic: one tracing untrusted workflow input to an agent step that holds a write token, one matching named Unicode classes across repository content. A detector that needs a model to decide what is suspicious cannot state its own coverage, and coverage that can be stated is the product.

Growth

Evidence-led, and slower for it. No percentage of attacks blocked is published, because character-level evasion rates move too far with technique for one number to mean anything. What gets published is deterministic coverage of a named list of Unicode classes and recall at a stated false-positive rate on a named corpus, with the corpus and the harness in the open. Growth is repositories scanned per week once the Action exists.