My open-source project, safari-mcp, got a security-hardening pull request from an automated scanner. The idea behind the patch was right. The patch itself un-parsed the codebase. Then the same defect infected my review of the patch, my review of the fix, and eventually the private note I wrote to remind myself to stop letting this happen.
This is a story about one character, told in three acts, and it ends with a rule I now apply to everything I publish.
The character
U+2028 LINE SEPARATOR (and its sibling U+2029 PARAGRAPH SEPARATOR) is a legal Unicode character that most terminals and editors render as a space, or as nothing at all.
In JavaScript it has two sharp edges:
