anordal/shellharden

Shellharden is a tool for finding and fixing unsafe patterns in bash shell scripts. The most common problem it targets is missing quotation marks around variables. In bash, a variable without quotes gets split on spaces and can expand into multiple arguments, which causes bugs that are often hard to track down. The README describes this concisely: a bash variable without its quotes is like a hand grenade with the pin pulled. The tool works in two modes. In its default mode, it reads a script and displays it with color highlighting that shows the current code in the foreground and marks where quotes should be added or removed using colored backgrounds. This lets you see exactly what changes would be made before committing to them. With the transform option, it actually rewrites the file, applying those fixes automatically. Shellharden is designed to complement ShellCheck, a separate and widely-used tool that finds problems in shell scripts and explains them. ShellCheck can tell you what is wrong but cannot fix it. Shellharden can apply the fixes. The README notes that you should still review changes before applying them, because a script that deliberately relies on the word-splitting behavior that Shellharden removes will behave differently after the transform, and a human needs to judge whether the change is safe. The tool is written in Rust and available as a package on crates.io, which is the Rust package registry. You can install it with a single command if you have Rust installed, or build it from source yourself. Linux distributions also package it through their own repositories. An accompanying guide in the repository explains how to write bash scripts safely by hand, covering patterns that avoid the common pitfalls Shellharden is designed to catch.