Make using `realpath` safer

Maybe fixes #361