diff --git a/test-docker.sh b/test-docker.sh
index 68a6b41..29fd1be 100755
--- a/test-docker.sh
+++ b/test-docker.sh
@@ -3,7 +3,7 @@
 SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 
 # build the executable
-${SCRIPT_DIR}/build.sh amd64
+"${SCRIPT_DIR}/build.sh" amd64
 
 # build the docker image
 docker buildx build --load -t gitea.jde.nz/public/simple-object-storage:test --platform linux/amd64 .
@@ -22,6 +22,6 @@ fi
 docker run --rm \
   -p 8123:80 \
   --name simple-object-storage-test \
-  -v ${DATADIR}:/data/storage \
-  -v ${CONFIGFILE}:/data/sos_config.json:ro \
+  -v "${DATADIR}":/data/storage \
+  -v "${CONFIGFILE}":/data/sos_config.json:ro \
   gitea.jde.nz/public/simple-object-storage:test
diff --git a/test.sh b/test.sh
index 9b0b923..045ade5 100755
--- a/test.sh
+++ b/test.sh
@@ -1,7 +1,12 @@
 #! /bin/bash
 
-SCRIPT_DIR=$(dirname $0)
-SCRIPT_NAME=$(basename $0)
+set -euo pipefail
+
+
+
+#------------------------------------------------------------------------------------------------
+SCRIPT_DIR=$(dirname "$0")
+SCRIPT_NAME=$(basename "$0")
 
 # FUNCTIONS
 function title() {
@@ -22,6 +27,15 @@ function die() {
 }
 
 
+#------------------------------------------------------------------------------------------------
+cat << EOF
+
+
+EOF
+# Test 0: Verify the script is running
+title "0: Verify the server is running"
+
+
 # test jq is installed
 if ! command -v jq &> /dev/null; then
     echo "jq could not be found"
@@ -41,7 +55,7 @@ HOST=localhost
 PORT=8123
 
 # extract the first write token from the config
-WRITE_TOKEN=$(echo $CONFIG | jq -r '.write_tokens[0]')
+WRITE_TOKEN=$(echo "$CONFIG" | jq -r '.write_tokens[0]')
 
 BASE_URL="http://${HOST}:${PORT}"
 
@@ -68,6 +82,10 @@ METADATA_JSON=$(cat <<EOF
 EOF
 )
 
+#------------------------------------------------------------------------------------------------
+# Test 1: Verify extra metadata fields are preserved
+title "1: Upload script to ${BASE_TAG}:test1"
+
 # upload this script as an object
 echo "uploading ${SCRIPT_DIR}/${SCRIPT_NAME} to ${BASE_TAG}:test1"
 UPLOAD_RESPONSE=$(curl -X PUT \
@@ -78,7 +96,10 @@ UPLOAD_RESPONSE=$(curl -X PUT \
 
 echo "upload response: ${UPLOAD_RESPONSE}"
 
-OBJECT_HASH=$(echo ${UPLOAD_RESPONSE} | jq -r '.hash')
+OBJECT_HASH=$(echo "${UPLOAD_RESPONSE}" | jq -r '.hash')
+
+#------------------------------------------------------------------------------------------------
+title "2: Check sos hash matches"
 
 # check the hash matches.
 CMD="${BASE_URL}/hash/${BASE_TAG}:test1"
@@ -86,31 +107,39 @@ echo "checking hash via ${CMD}"
 CHECK_HASH=$(curl -s "${CMD}" | jq -r '.hash')
 [ "${OBJECT_HASH}" != "${CHECK_HASH}" ] && die "hash does not match: ${OBJECT_HASH} != ${CHECK_HASH}"
 
+
+#------------------------------------------------------------------------------------------------
+title "3: Check MD5Sum matches, for both label:tag and hash downloads"
+
 # get md5sum of this file
-MD5SUM=$(md5sum ${SCRIPT_DIR}/${SCRIPT_NAME} | awk '{print $1}')
+MD5SUM=$(md5sum "${SCRIPT_DIR}/${SCRIPT_NAME}" | awk '{print $1}')
 echo "md5sum of ${SCRIPT_DIR}/${SCRIPT_NAME} is ${MD5SUM}"
 
 # download the object
 echo "downloading ${OBJECT_HASH} to ${SCRIPT_DIR}/${SCRIPT_NAME}.downloaded1"
-if ! curl -s "${BASE_URL}/object/${OBJECT_HASH}" -o ${SCRIPT_DIR}/${SCRIPT_NAME}.downloaded1; then
+if ! curl -s "${BASE_URL}/object/${OBJECT_HASH}" -o "${SCRIPT_DIR}/${SCRIPT_NAME}.downloaded1"; then
     die "failed to download ${OBJECT_HASH}"
 fi
 
 # download the object again via the label:tag
 echo "downloading ${BASE_TAG}:test1 to ${SCRIPT_DIR}/${SCRIPT_NAME}.downloaded2"
-if ! curl -s "${BASE_URL}/object/${BASE_TAG}:test1" -o ${SCRIPT_DIR}/${SCRIPT_NAME}.downloaded2; then
+if ! curl -s "${BASE_URL}/object/${BASE_TAG}:test1" -o "${SCRIPT_DIR}/${SCRIPT_NAME}.downloaded2"; then
     die "failed to download ${BASE_TAG}:test1"
 fi
 
 # get md5sum of the downloaded file
-MD5SUM_DOWNLOADED1=$(md5sum ${SCRIPT_DIR}/${SCRIPT_NAME}.downloaded1 | awk '{print $1}')
+MD5SUM_DOWNLOADED1=$(md5sum "${SCRIPT_DIR}/${SCRIPT_NAME}.downloaded1" | awk '{print $1}')
 echo "md5sum of ${SCRIPT_DIR}/${SCRIPT_NAME}.downloaded1 is ${MD5SUM_DOWNLOADED1}"
 [ "${MD5SUM}" != "${MD5SUM_DOWNLOADED1}" ] && die "md5sums do not match"
-MD5SUM_DOWNLOADED2=$(md5sum ${SCRIPT_DIR}/${SCRIPT_NAME}.downloaded2 | awk '{print $1}')
+MD5SUM_DOWNLOADED2=$(md5sum "${SCRIPT_DIR}/${SCRIPT_NAME}.downloaded2" | awk '{print $1}')
 [ "${MD5SUM}" != "${MD5SUM_DOWNLOADED2}" ] && die "md5sums do not match"
 
-rm ${SCRIPT_DIR}/${SCRIPT_NAME}.downloaded1
-rm ${SCRIPT_DIR}/${SCRIPT_NAME}.downloaded2
+rm "${SCRIPT_DIR}/${SCRIPT_NAME}.downloaded1"
+rm "${SCRIPT_DIR}/${SCRIPT_NAME}.downloaded2"
+
+
+#------------------------------------------------------------------------------------------------
+title "4: Delete the object"
 
 # delete the object
 echo "deleting ${OBJECT_HASH}"
@@ -125,8 +154,8 @@ if ! echo "${DELETE_RESPONSE}" | jq -r '.result' | grep -q 'error'; then
     die "failed to verify ${OBJECT_HASH} is deleted"
 fi
 
-# Test 1: Verify extra metadata fields are preserved
-title "Testing metadata field preservation"
+#------------------------------------------------------------------------------------------------
+title "5: Test metadata field preservation"
 
 # Upload with extra metadata fields
 EXTRA_METADATA_JSON=$(cat <<EOF
@@ -158,7 +187,7 @@ if ! echo "${UPLOAD_RESPONSE}" | jq -e . >/dev/null 2>&1; then
     die "Invalid JSON response from upload: ${UPLOAD_RESPONSE}"
 fi
 
-OBJECT_HASH=$(echo ${UPLOAD_RESPONSE} | jq -r '.hash')
+OBJECT_HASH=$(echo "${UPLOAD_RESPONSE}" | jq -r '.hash')
 echo "Received hash: ${OBJECT_HASH}"
 
 # Verify the object exists
@@ -188,12 +217,12 @@ if ! echo "${METADATA_RESPONSE}" | jq -r '.metadata.extra_field2' | grep -q 'val
     die "extra_field2 not preserved in metadata"
 fi
 
+#------------------------------------------------------------------------------------------------
+title "6: Test tag versioning behavior"
+
 # Clean up
 curl -s -H "Authorization: Bearer ${WRITE_TOKEN}" "${BASE_URL}/deleteobject?hash=${OBJECT_HASH}" > /dev/null
 
-# Test 2: Verify tag versioning behavior
-title "Testing tag versioning behavior"
-
 # Upload first version with tag 'latest'
 FIRST_METADATA_JSON=$(cat <<EOF
 {
@@ -210,7 +239,7 @@ UPLOAD_RESPONSE=$(curl -X PUT \
   -F "metadata=${FIRST_METADATA_JSON}" \
   "http://localhost:8123/upload")
 
-FIRST_HASH=$(echo ${UPLOAD_RESPONSE} | jq -r '.hash')
+FIRST_HASH=$(echo "${UPLOAD_RESPONSE}" | jq -r '.hash')
 
 # Store first version's metadata before uploading second version
 FIRST_METADATA=$(curl -s "${BASE_URL}/meta/${FIRST_HASH}")
@@ -239,7 +268,7 @@ UPLOAD_RESPONSE=$(curl -X PUT \
   -F "metadata=${SECOND_METADATA_JSON}" \
   "http://localhost:8123/upload")
 
-SECOND_HASH=$(echo ${UPLOAD_RESPONSE} | jq -r '.hash')
+SECOND_HASH=$(echo "${UPLOAD_RESPONSE}" | jq -r '.hash')
 
 # Verify first version's metadata still has v1 tag
 FIRST_METADATA=$(curl -s "${BASE_URL}/meta/${FIRST_HASH}")
@@ -263,13 +292,14 @@ if ! echo "${SECOND_METADATA}" | jq -r '.metadata.labeltags[]' | grep -q "${BASE
     die "Second version does not have v2 tag"
 fi
 
+#------------------------------------------------------------------------------------------------
+title "7: Test rate limiting behavior"
+
+
 # Clean up
 curl -s -H "Authorization: Bearer ${WRITE_TOKEN}" "${BASE_URL}/deleteobject?hash=${FIRST_HASH}" > /dev/null
 curl -s -H "Authorization: Bearer ${WRITE_TOKEN}" "${BASE_URL}/deleteobject?hash=${SECOND_HASH}" > /dev/null
 
-# Test 3: Verify rate limiting behavior
-title "Testing rate limiting behavior"
-
 # Use a known invalid token
 INVALID_TOKEN="invalid_token"
 
@@ -306,4 +336,5 @@ if ! curl -s -H "Authorization: Bearer ${WRITE_TOKEN}" "${BASE_URL}/deleteobject
     die "failed to delete ${TODELHASH}"
 fi
 
+#------------------------------------------------------------------------------------------------
 title "ALL TESTS PASSED"