YAML is popular as a language for declarative configurations because of it's readability, support for hierarchical structure, and comments. However, hidden Unicode characters, homoglyphs, and bidirectional text controls can silently alter the behavior of infrastructure definitions, and CI/CD pipelines written in YAML. These invisible characters can evade code review, and even enable attacks that exploit the gap between what developers see and what machines interpret. In this talk, we'll explore real-world examples of rogue Unicode characters in YAML files, understand how they work, and practical defences — from linting, editor configuration and automated detection tools that can prevent these issues from reaching production.
I build tooling for declarative configuration management, and have previously built tools for API testing and Monitoring.
