My personal best is backslash in a json string in an env variable passed to bash in a docker container, in a batch file.
Tbf I caught a coworker make the same mistake but I’d much rather explain security to a human than to a machine.
Definitely not a bubble.
That alarm will give up before I will.