From 1eb2755c4adf26412989eb29bd6996e7cc2a43b9 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 26 Aug 2026 18:25:41 +0100
Subject: [PATCH] fix(audit): mangled escaping swallowed the closing quote

security-audit.sh:112 built a grep pattern whose trailing backslashes escaped the closing double quote, so the string ran on and the file did not parse. Rewritten with a single-quoted ERE, which needs no escaping and expresses '../ or ..\' directly.

Found by an estate-wide shellcheck sweep of 5,111 tracked scripts across 375
repos: 11 files fail to PARSE (SC1073/SC1072). shellcheck stops analysing at
the failure, so everything after it in the file was never checked either.

Verified: shellcheck -S error reports 0 parse errors for the file(s) touched.
---
 scripts/security-audit.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/security-audit.sh b/scripts/security-audit.sh
index 4bfa9993..fde80fbf 100644
--- a/scripts/security-audit.sh
+++ b/scripts/security-audit.sh
@@ -109,7 +109,7 @@ else
 fi
 
 # Check for dangerous path patterns
-if grep -rq "\\.\\./\|\\.\\.\\\\\" "$IMPL_DIR/src" | grep -v "test\|comment"; then
+if grep -rqE '\.\./|\.\.\\' "$IMPL_DIR/src"; then
     check "Hardcoded traversal patterns" "WARN" "Found ../ patterns - verify they're safe"
 else
     check "Hardcoded traversal patterns" "PASS"