Tier-S: #43 sub — security tests (15 → 75, +60 across 7 categories)

[hyperpolymath]

Scope (sub-issue of #43)

Expand security tests from 15 → 75 (+60).

Cover the OWASP-shell threat surface comprehensively: command injection, path traversal, IFS poisoning, env-var injection, signal-handler races, set-uid context, restricted-mode bypass, ANSI-escape injection.

Resolution

Per category PR (~6-8 PRs of ~7-10 tests each):

Category	Target
Command injection	10
Path traversal (incl. .., symlink, junction)	10
IFS / parameter expansion injection	10
Env-var injection	8
Signal/race conditions	8
Restricted mode bypass	7
ANSI-escape injection (terminal corruption)	7

References

• Parent: Test + bench dramatic expansion — 736 → 2000+ tests, 3 → 15 benches, 7 → 20 fuzz targets #43
• Current: tests/security_tests.rs (15 tests, 1 path-traversal)
• Companion: practice-gap chore(deps): bump the actions group with 3 updates #10 in Filesystem-theory + practice gap analysis (POSIX 2024, atomicity, crash-consistency) #45 (no sandboxing layer)