I am starting to wonder if I can't get a PR into a codebase with lots of invisible unicode characters that together create a backdoor. A simple typo-fixing PR could become a Trojan horse for a bunch of code the owner of the repo won't see. 🤔