data exfiltration

Your Bash prompt runs code on every render, so unsafe PS1/PROMPT_COMMAND snippets can leak secrets, be hijacked by crafted dirs/branches, or slow your terminal. This guide shows how to harden it: prefer built-ins, sanitize untrusted text (PWD/VCS), pin absolute paths, move logic to safe PROMPT_COMMAND (array, no eval), keep root ultra-minimal, and use packaged frameworks (e.g., Starship). Includes copy-paste Bash and a quick audit checklist.