"Filenames are reasonable" is in practice a perfectly workable assumption. In nearly 20 years of using Linux, I've never – not once – been bitten by a filename

"Filenames are reasonable" is in practice a perfectly workable assumption. In nearly 20 years of using Linux, I've never – not once – been bitten by a filename starting with a hyphen, or one that contains a newline or control characters. It seems plenty dangerous to allow untrusted user input for naming files, so just don't do that and you're fine. I don't get why you'd want to limit yourself to POSIX in 2019. Do you really need to run your script on AIX or what have you? 99.9% of cases you just want GNU and macOS, as far as I know that includes the most important GNU tools. Bash is really good enough for many tasks that involve gluing together a number of utilities or shuffling files around. To do this in Python or Node.js is to invite another world of hurt where you write easily 10x as much code and need to worry about package management all of a sudden.