diff --git a/Tests/PlainSettingsTests/main.swift b/Tests/PlainSettingsTests/main.swift
new file mode 100644
index 0000000..66c66a4
--- /dev/null
+++ b/Tests/PlainSettingsTests/main.swift
@@ -0,0 +1,35 @@
+import Foundation
+
+private func expect(_ condition: @autoclosure () -> Bool, _ message: String) {
+    guard condition() else {
+        FileHandle.standardError.write(Data("FAIL: \(message)\n".utf8))
+        exit(1)
+    }
+}
+
+let shellScriptRule = PlainSettings(
+    patternFile: ".*",
+    patternMime: "^text/x-shellscript$",
+    isRegExp: true,
+    isCaseInsensitive: true,
+    UTI: "public.shell-script",
+    syntax: "shellscript"
+)
+
+expect(
+    shellScriptRule.test(filename: "hproxy", mimeType: "text/x-shellscript"),
+    "MIME regex should use the complete MIME value for short filenames"
+)
+expect(
+    shellScriptRule.test(
+        filename: String(repeating: "extensionless-shell-script-", count: 4),
+        mimeType: "text/x-shellscript"
+    ),
+    "MIME regex should not use an out-of-bounds filename-derived range"
+)
+expect(
+    !shellScriptRule.test(filename: "script", mimeType: "text/x-python"),
+    "MIME regex should reject a different MIME type"
+)
+
+print("PlainSettingsTests passed")
diff --git a/Tests/PlainSettingsTests/run.sh b/Tests/PlainSettingsTests/run.sh
new file mode 100755
index 0000000..2d98bdc
--- /dev/null
+++ b/Tests/PlainSettingsTests/run.sh
@@ -0,0 +1,13 @@
+#!/bin/sh
+set -eu
+
+script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+repo_root=$(dirname "$(dirname "$script_dir")")
+test_binary=$(mktemp "${TMPDIR:-/tmp}/PlainSettingsTests.XXXXXX")
+trap 'rm -f "$test_binary"' EXIT
+
+xcrun swiftc \
+    "$repo_root/XPCService/PlainSettings.swift" \
+    "$script_dir/main.swift" \
+    -o "$test_binary"
+"$test_binary"
diff --git a/XPCService/PlainSettings.swift b/XPCService/PlainSettings.swift
index 0361984..1021a98 100644
--- a/XPCService/PlainSettings.swift
+++ b/XPCService/PlainSettings.swift
@@ -85,7 +85,7 @@ struct PlainSettings {
                 guard let regex = self.mimeRegExp else {
                     return false
                 }
-                guard regex.firstMatch(in: mimeType, options: [], range: NSRange(filename.startIndex..., in: filename)) != nil else {
+                guard regex.firstMatch(in: mimeType, options: [], range: NSRange(mimeType.startIndex..., in: mimeType)) != nil else {
                     return false
                 }
                 valid = true