When viewing a pull request on GitHub (or the equivalent on any other platform), the web interface displays a diff of the changes for you to review.
Reviewing the diff is obviously vulnerable to human error, as malicious changes can be snuck in (see mortenson/pr-sneaking).
Are there any obfuscation techniques that could not be reasonably spotted by a human performing thorough code review in the GitHub web interface?
One example is a homoglyph attack, that could potentially make a series of characters appear to a human as one value while actually being another.
There could also be a vulnerability/bug in the diff engine or output display that could be exploited to hide or mask malicious code in a pull request.
To clarify I am not asking about a human's ability to accurately review code changes - I am asking about potential spoofing/masking vulnerabilities that could be exploited by an attacker to deceive a human into accepting a seemingly legitimate pull request.