`abcd guard` steps over the value of `bash --init-file` and `--rcfile`, and interactive bash runs that file before `-c`, so a blocker in it runs while the checked command reads `bash -i -c true`.

abcd guard steps over the value of bash --init-file and --rcfile, and interactive bash runs that file before -c, so a blocker in it runs while the checked command reads bash -i -c true.

Private security advisory GHSA-xr66-hjpp-xwgc (draft, severity high). Full text, evidence and reproduction: the security-drain-2026-10-09 run directory in the main checkout's local tier. This record stays uncommitted until its fix lands; the fix commit adds it directly to resolved/.

Evidence (lines at main 7549ca2d5): shellReadsStream knows the two options only to skip their value (internal/core/guard/payload.go:1914, the list shellStreamValueOptions at :1943). The same process substitution in script position is a block through readsScriptStream (internal/core/guard/payload.go:1816).

Reproduction: Defaults().Check returns allow for bash --init-file <(printf '%s\n' 'git push --force origin main') -i -c true, the same with --rcfile, and bash --init-file /tmp/init.sh -i -c true after printf writes the file. /bin/bash 3.2.57 runs each (a touch stand-in creates the mark). bash <(printf '%s\n' 'git push --force origin main') is block / interpreter-reads-stream. Related: the file-form decision in the BASH_ENV advisory GHSA-r2w5-wf2r-jmf8.