less permits shell escape and file writes outside secure mode

Goal

Keep reviewers from running shell commands or writing files from inside GNU less when viewing untrusted log content.

Constraint

Secure mode is opt-in through LESSSECURE and is off by default. The exact commands disabled in secure mode can vary by less build and version, so this behavior is unverified for a specific release until checked against the installed man page.

Without secure mode, less is not a read-only sandbox: shell escapes and file-writing commands remain available, and other paths such as :e may also let a user change what is displayed.

Questions

Does setting LESSSECURE reliably disable every shell-escape and file-write path in less across common builds?

Which commands remain available in secure mode, and do they provide an escape vector?

Can secure mode be made the default for all less invocations without requiring each caller to set the environment variable?