@Kludex I can't apply it universally because on POSIX I'm using shell=False (passing a raw list), where subprocess handles the arguments directly. If I quoted them there, the quotes would be treated as literal parts of the filename. Manual quoting is only necessary when I'm forced to use shell=True on Windows.

Also, I realized shlex.quote uses single quotes which isn't ideal for cmd.exe. I'll update this to use list2cmdline instead to ensure it works correctly on Windows.

Also, please don't create PRs with "SECURITY". Security vulnerabilities are supposed to be disclosed via proper means.

@Kludex Thanks for the clarification and the CPython reference. I see now that subprocess.run already handles the argument quoting internally through list2cmdline, making this manual check redundant. Apologies for the 'SECURITY' tag in the title as well; I'll stick to the official disclosure channels for any future security-related findings. Closing this PR now.