$output = json_decode($commandTester->getDisplay(), true);
 $this->assertIsArray($output);
 $this->assertArrayHasKey('status', $output);
+$this->assertArrayHasKey('files', $output);
+// Verify nested files are included
+$files = array_column($output['files'] ?? [], 'path');
+$this->assertNotEmpty(array_filter($files, fn($f) => str_contains($f, 'nested')));

 public function testExecuteWithRecursiveOption(): void
 {
     $application = new Application();
     $application->add(new ValidateTranslationCommand());

     $command = $application->find('validate-translations');
     $commandTester = new CommandTester($command);

     $commandTester->execute([
-        'path' => [__DIR__.'/../Fixtures/translations/xliff/success'],
+        'path' => [__DIR__.'/../Fixtures/recursive'],
         '--recursive' => true,
         '--dry-run' => true,
     ]);

     $output = $commandTester->getDisplay();
-    $this->assertStringContainsString('Language validation', $output);
+    $this->assertStringContainsString('Language validation succeeded', $output);
+    // Verify that nested files were found
+    $this->assertStringContainsString('nested', $output);
     $this->assertSame(0, $commandTester->getStatusCode());
 }

         $logger = $this->createMock(LoggerInterface::class);
-        // The path will be resolved by realpath, so we might not get the warning anymore
-        // But the result should still be empty or handled safely
+        $logger->expects($this->once())
+            ->method('warning')
+            ->with($this->stringContains('Skipping potentially unsafe path'));

         $detector = $this->createMock(DetectorInterface::class);
         $collector = new Collector($logger);

-        // Test path traversal attack prevention - this should not find files in system directories
+        // Test path traversal - resolves to /etc which is blocked
         $result = $collector->collectFiles(['/etc/../etc'], $detector, null, true);

-        // Should return empty result due to security prevention
         $this->assertEmpty($result);

-        // Debug: verify files exist
-        $this->assertFileExists($this->tempDir.'/root.xlf', 'root.xlf should exist');
-        $this->assertFileExists($this->tempDir.'/level1/nested.xlf', 'nested.xlf should exist');
-        $this->assertFileExists($this->tempDir.'/level1/level2/deep.xlf', 'deep.xlf should exist');
-
-        // Debug: test RecursiveDirectoryIterator directly
-        $iterator = new \RecursiveIteratorIterator(
-            new \RecursiveDirectoryIterator($this->tempDir, \RecursiveDirectoryIterator::SKIP_DOTS),
-            \RecursiveIteratorIterator::LEAVES_ONLY
-        );
-        $foundFiles = [];
-        foreach ($iterator as $file) {
-            $foundFiles[] = $file->getPathname();
-        }
-        $this->assertNotEmpty($foundFiles, 'RecursiveDirectoryIterator should find files');
-        $this->assertContains($this->tempDir.'/root.xlf', $foundFiles, 'Should find root.xlf');
-        $this->assertContains($this->tempDir.'/level1/nested.xlf', $foundFiles, 'Should find nested.xlf');

         $logger = $this->createMock(LoggerInterface::class);
         $detector = $this->createMock(DetectorInterface::class);
-        $detector->method('mapTranslationSet')->willReturn(['recursive_mapped_data']);
+        $detector->expects($this->once())
+            ->method('mapTranslationSet')
+            ->with($this->callback(function ($files) {
+                return count($files) === 3 &&
+                    in_array($this->tempDir.'/root.xlf', $files) &&
+                    in_array($this->tempDir.'/level1/nested.xlf', $files) &&
+                    in_array($this->tempDir.'/level1/level2/deep.xlf', $files);
+            }))
+            ->willReturn(['recursive_mapped_data']);

     private function isPathSafe(string $path): bool
     {
-        $dangerousPaths = ['/etc', '/usr', '/bin', '/sbin', '/proc', '/sys', '/private/etc'];
+        $dangerousPaths = [
+            // Unix/Linux/macOS
+            '/etc', '/usr', '/bin', '/sbin', '/proc', '/sys', '/private/etc',
+            // Windows
+            'C:\\Windows', 'C:\\Program Files', 'C:\\Program Files (x86)',
+            'C:\\ProgramData', 'C:\\System32'
+        ];
 
         foreach ($dangerousPaths as $dangerousPath) {
-            if (str_starts_with($path, $dangerousPath)) {
+            if (str_starts_with(strtolower($path), strtolower($dangerousPath))) {
                 return false;
             }
         }
 
+        // Document why 20 is the limit or make it configurable
         return substr_count($path, '/') + substr_count($path, '\\') <= 20;
     }

         try {
             $iterator = new \RecursiveIteratorIterator(
-                new \RecursiveDirectoryIterator($normalizedPath, \RecursiveDirectoryIterator::SKIP_DOTS),
+                new \RecursiveDirectoryIterator(
+                    $normalizedPath,
+                    \RecursiveDirectoryIterator::SKIP_DOTS | \RecursiveDirectoryIterator::FOLLOW_SYMLINKS
+                ),
                 \RecursiveIteratorIterator::LEAVES_ONLY
             );
 
             foreach ($iterator as $file) {
+                // Skip symbolic links to prevent security bypass
+                if ($file->isLink()) {
+                    continue;
+                }
                 $filePath = $file->getPathname();