Security research PoC from Bountyy Oy. ComfortSans uses OpenType ligature tables to visually replace one string with another at the font rendering level. Type bountyy.fi, your screen shows google.com. The DOM, view-source, copy-paste, DevTools all show the original text. Only the rendered pixels change. No JavaScript. No browser exploit. Just a font doing what fonts are allowed to do. The attack surface: any context where an attacker can load a custom font and the user trusts what they see on screen. Crypto addresses, domain names, install commands. No security tool inspects font ligature tables. Source and build instructions in the repo.