Even great programmers can be terribly misguided

Heh. Yeah, we have `rrsync` in use to not allow arbitrary execution on the production host. Authentication is via SSH key which is limited to a single location (so you need multiple keys to access multiple locations). Much more auditable than allowing `tar -C` and symlink considerations.

Really, `rclone` would be the better alternative suggestion (though I'm not aware of its "infection" status with LLM output to know if that is also discounted).