Security test: file path exposure in shared sessions