diff --git a/chfs-ng/internal/api/path_security_test.go b/chfs-ng/internal/api/path_security_test.go
new file mode 100644
index 0000000..6f20193
--- /dev/null
+++ b/chfs-ng/internal/api/path_security_test.go
@@ -0,0 +1,20 @@
+package api
+
+import "testing"
+
+func TestUnsafePath(t *testing.T) {
+	cases := map[string]bool{
+		"../secret":     true,
+		"a/../secret":   true,
+		`..\\secret`:    true,
+		"%2e%2e/secret": false,
+		"secret":        false,
+		"a//b":          false,
+		"":              false,
+	}
+	for p, want := range cases {
+		if got := unsafePath(p); got != want {
+			t.Fatalf("unsafePath(%q)=%v, want %v", p, got, want)
+		}
+	}
+}