Hidden and bidirectional characters in editors
A right-to-left override can make code read one way and run another. How Vim, Neovim, Helix and sim draw U+202E and other hidden characters.
Blog: security notes from the sim editor project
Long-form, sourced articles on editor security, from the sim editor project. They are written in English and Japanese for now.
Six ways a repository can run code through your editor
Opening a repository should not run it. Six ways a repo can run code through an editor, what Vim, Neovim and Helix do about each, and what sim refuses.
Safe saves, outside writes and secrets on the clipboard
How sim saves a file so nothing is lost: atomic writes, a compare-and-swap against outside changes, snapshots after a crash, and what it means for secrets.