[kevinoid]

https://github.com/scponly/scponly can be used to prevent command execution and supports chroot. It avoids the server-side scp protocol security issues by rejecting shell metacharacters in commands. It also supports sftp.

If you don't need scp, you could force the use of internal-sftp <https://serverfault.com/a/354618>.