There's also the set & setting that is good to consider. For example, I bet lots of the scripts in my current employer's DevOps infrastructure have filename han

There's also the set & setting that is good to consider. For example, I bet lots of the scripts in my current employer's DevOps infrastructure have filename handling bugs that could've been avoided by meticulously following these rules. But these scripts are not meant to be used by customers - the people using these scripts are other developers working on the product wanting to set up the development environment. The script might fail if you do some stupid / unexpected stuff, even as simple as having a space in your Unix user name (i.e. home directory path) or VCS clone directory. I would feel weak from the knees if someone exposed these scripts on a web server and let them process input from untrusted external parties. Yet, I don't care if the scripts aren't 100% perfect if they work as long as the user doesn't do something silly. Plus, many of them are portable meaning you can run them out of the box on Linux, MacOS or WSL (Windows) without installing any extra software.