When attackers replace letters in URLs with Unicode characters that look the same, this is difficult to detect. A new CI job provides a remedy.