Problem
Interleaving the secret with zero-width chars (secret.split("").join("\u200b")) judges as cracked: false, reason: no-leak: a real leak scored as a failed attempt. The separator-strip only handles -_. + whitespace.
Where
lib/judge.ts (separator strip regex). Follow-up to the base64/separator hardening: extend normalization to zero-width and bidi marks.
Acceptance
Add a failing test first asserting a zero-width-interleaved secret returns cracked: true. Then fix.
Problem
Interleaving the secret with zero-width chars (
secret.split("").join("\u200b")) judges ascracked: false, reason: no-leak: a real leak scored as a failed attempt. The separator-strip only handles-_.+ whitespace.Where
lib/judge.ts(separator strip regex). Follow-up to the base64/separator hardening: extend normalization to zero-width and bidi marks.Acceptance
Add a failing test first asserting a zero-width-interleaved secret returns
cracked: true. Then fix.