I have seen advice in several places to use the following shebang line

```
#!/usr/bin/env bash

```

instead of

```
#!/usr/bin/bash

```

My knee-jerk reaction is, "what if somebody substitutes this executable for their own in say `~/.local/bin` ?" That directory is often set up in the user's path before the system-wide paths. I see this raised as a security issue often as a side note rather than anything to take seriously, but I wanted to test the theory.

To try this out I did something like this:

```
echo -e "#!/usr/bin/python\nprint 'Hacked!'" > $HOME/.local/bin/bash
chmod 755 $HOME/.local/bin/bash
PATH=$HOME/.local/bin env bash

```

This yields

```
/usr/bin/env: ‘bash’: No such file or directory

```

To check whether it was picking up anything at all I also did

```
echo -e "#!/usr/bin/python\nprint 'Hacked!'" > $HOME/.local/bin/perl
chmod 755 $HOME/.local/bin/perl
PATH=$HOME/.local/bin env perl

```

which prints, as I expected,

```
Hacked!

```

*Can someone explain to me why the substitute `bash` is not found, but the substitute `perl` is? Is this some sort of "security" measure that (from my point of view) misses the point?*

EDIT: Because I have been prompted: I am not asking how `/usr/bin/env bash` is different from using `/bin/bash`. I am asking the question as stated above.

EDIT2: It must have been something I was doing wrong. Tried again today (using explicit path to `env` instead of implicit), and no such "not found" behaviour.