For BiDi attacks, assuming a shell that understands $''-strings (such as bash or zsh) and that the locale encoding matches the source encoding, this should work:

    grep -r $'[\u061C\u200E\u200F\u202A\u202B\u202C\u202D\u202E\u2066\u2067\u2068\u2069]' /path/to/source

Just use sin

https://github.com/oriansj/stage0/blob/master/High_level_pro...

It'll dehex any non-humanly used ASCII characters

If your source code is ascii-only you can just strip out any multi-byte character.