Personally, I am not a big fan of putting more acl/config/monitor requirements to the shell. New features add complexity, possible bugs and hacking vectors.<p>Prefer just simply "git add /{etc,bin,sbin,lib} /usr/{bin,sbin,lib} ... && git commit "<p>And daily cron jobs run a "git status" would give me some idea, trigger and confident if someone have "hack into" the server.
I would have thought the best way to do secure shell scripting is to use a non-shell language, e.g. Python or Go.<p>It seems most shell vulnerabilities (including shellshock) fundamentally come from the awful and dangerous syntax.