I moved over to shellharden a while ago. It can actually apply the suggestions it makes. Aside from that, my employer is somewhat disapproving for GPLv3 tools, but MPL that shellharden uses is essentially auto-approved.

https://github.com/anordal/shellharden

> my employer is somewhat disapproving for GPLv3 tools

Let's hope it's not bash scripts you're writing :-)

http://git.savannah.gnu.org/cgit/bash.git/tree/COPYING

Yeah, other shell flavors are fine.

How is GPLv3 any different from MPL when it comes to use (as opposed to modification or distribution)?

I can only guess about the distinction our legal department sees.

Agree, this is the way.

ShellCheck is great, but since it works on syntax, it can't catch problems that can only be determined at runtime, like "if myfunc" with set -e on.

Example here: https://news.ycombinator.com/item?id=33122256