Writing a secret to /tmp securely

secret.sh

file=/tmp/test.txt

rm -f "$file"
touch "$file" # make sure file exists
chown -h $(id -u):$(id -g) "$file" # make us the owner of the file
chmod -h 600 "$file" # make sure it's not world-accessible
# now that the attacker cannot swap the file from underneath us, 
# check that it's not a symlink
if [[ -L "$file" ]]; then
  >&2 echo "File is a symlink" # 
  rm -f "$file"
  exit 1
fi
# We are good to go
printf "Enter a secret: "
read -s secret
cat  >"$file" <<< "$secret" # in case secret contains "-n" or some such
echo

A much easier way is to keep secrets in a directory that is not world-writeable, but hey, where's fun in that