pub fn bash_is_safe(cmd: &str) -> Result<(), String>
Hard-blocks Bash payloads unconditionally if they attempt to reference OS-critical locations