More hardening measures

tests/test_multi.py

@@ -123,3 +123,15 @@ def test_process_directory_ini_union_marks_optional_sections_and_keys(tmp_path:
 def test_process_directory_rejects_empty_folder(tmp_path: Path):
     with pytest.raises(ValueError, match="No supported config files"):
         process_directory(tmp_path, recursive=False, role_prefix="role")
+
+
+def test_directory_mode_skips_supported_symlinks(tmp_path: Path):
+    outside = tmp_path / "outside.yaml"
+    outside.write_text("secret: value\n", encoding="utf-8")
+    root = tmp_path / "root"
+    root.mkdir()
+    (root / "real.yaml").write_text("name: ok\n", encoding="utf-8")
+    (root / "link.yaml").symlink_to(outside)
+
+    files = iter_supported_files(root, recursive=False)
+    assert files == [root / "real.yaml"]