bash security

AI-suggested Bash can be fast—and dangerously wrong. This guide flags risky patterns (curl|bash, eval, unquoted vars, sudo sprawl) and gives a practical, automatable checklist: harden/lint scripts (set -euo pipefail, ShellCheck/shfmt), sandbox runs (podman/firejail/bwrap), lock down env/secrets/egress, verify downloads/signatures, and log/audit for reproducibility. For devs/SREs/sysadmins today.