Developer publishes 17 real attempts to bypass a merge gate, with full test code

A developer building an open-source merge gate — a tool that blocks pull requests touching protected file paths — documented 17 distinct attempts to evade it, distinguishing those from 5 validity checks included to ensure the gate does not simply reject everything. The attacks covered scenarios such as renaming files, changing letter case, and exploiting Unicode encoding differences like NFC versus NFD, each designed as a hypothesis that the gate could be beaten. The project is publicly available on GitHub under the Apache-2.0 license, allowing anyone to verify the test suite directly. The gate works deterministically, checking only whether a diff contains a protected path, with no AI model involved in the decision. The author emphasized that honest test accounting matters, noting that inflating 17 attacks to 22 by including non-attack tests would undermine the credibility of the work.