All too often developers give authenticated users access to a restricted CLI and hope for the best. It usually doesn't work out well for them.