FWIW, the source code looks fairly solid to me, considering that it's a bash script meant to be used on trusted inputs. To illustrate my point, look at the ela

FWIW, the source code looks fairly solid to me, considering that it's a bash script meant to be used on trusted inputs. To illustrate my point, look at the elaborate loop to iterate over *.gpg files: https://git.zx2c4.com/password-store/tree/src/password-store.sh?id=38ec1c72e29c872ec0cdde82f75490640d4019bf#n400 https://git.zx2c4.com/password-store/tree/src/password-store... This looks to me like the correct way to do this in bash, as long as you can guarantee that $PREFIX does not start with whitespace (which may be a valid assumption here). From what I can tell, the code quality is way better than what you see in your average bash script.