SC2029

Note that, unescaped, this expands on the client side.

Problematic code:

ssh host "echo $HOSTNAME"

Correct code:

ssh host "echo \$HOSTNAME"

or

ssh host 'echo $HOSTNAME'

Rationale:

Bash expands all arguments that are not escaped/singlequoted. This means that the problematic code is identical to

ssh host "echo clienthostname"

and will print out the client's hostname, not the server's hostname.

By escaping the $ in $HOSTNAME, it will be transmitted literally and evaluated on the server instead.

Contraindications

If you do want your string expanded on the client side, you can safely ignore this message.