A breezy guide to keeping file operations safe: validate paths, lock down permissions, and never let a privileged process wander into a user’s temp folder.