PowerShell 7.6

Use these rules for PowerShell 7.6 scripts, modules, automation, and remote administration that process untrusted data or perform privileged operations.

Trust and execution boundaries

• Treat execution policy as an accident-prevention feature, not as an authorization or sandbox boundary; it is not enforced on non-Windows systems.
• Run downloaded scripts only after verifying their source, signature or integrity, and intended version.
• Keep scripts and modules loaded by privileged automation non-writable by less-privileged identities.
• Use Windows App Control for Business in enforcement mode with constrained language where an actual code-execution boundary is required; setting LanguageMode alone is insufficient.
• Do not weaken system-wide policy or language mode to make one script run.

Parsing and invocation

• Never pass untrusted text to Invoke-Expression, ScriptBlock::Create, or another dynamic code parser.
• Invoke commands with the call operator and a separated argument array when the command path is trusted.
• Check $PSNativeCommandArgumentPassing before relying on that array. On Windows it defaults to Windows, which reverts to legacy string-joined argument parsing for cmd.exe, batch files, and a few other targets, where embedded quotes and empty arguments may not be preserved; do not pass untrusted text through batch-file command strings.
• Use Start-Process -ArgumentList only after accounting for its native command-line rejoining and target-specific parsing.
• Insert --% or -- only when the exact native program semantics are known;