How a Windows junction silently bypassed a path-safety guard in a test suite

A developer on DEV Community documented a bug where a safety guard designed to prevent test code from writing to a permanent log was bypassed despite passing its own checks. The guard validated a path string from an environment variable, but the test environment contained a Windows directory junction (symlink) that redirected writes to the real log after the check had already passed. Because the guard compared string values rather than resolved filesystem paths, it could not detect that the actual write destination differed from the intended scratch directory. The fix involved resolving both paths with realpathSync before comparison, and more robustly, checking the inode of the file handle after opening rather than validating the path string beforehand. The author concludes that any guard checking an intent rather than the actual resolved target is vulnerable to this class of failure, which applies equally to DNS resolution, database connections, and other indirection layers.