diff --git a/lib/clean/apps.sh b/lib/clean/apps.sh
index 0b900d0..a4c7b7a 100644
--- a/lib/clean/apps.sh
+++ b/lib/clean/apps.sh
@@ -138,7 +138,7 @@ clean_orphaned_app_data() {
 
     # Merge all results
     cat "$scan_tmp_dir"/*.txt >> "$installed_bundles" 2> /dev/null || true
-    rm -rf "$scan_tmp_dir"
+    safe_remove "$scan_tmp_dir" true
 
     # Deduplicate
     sort -u "$installed_bundles" -o "$installed_bundles"
diff --git a/lib/core/base.sh b/lib/core/base.sh
index 699760a..7ca6cfd 100644
--- a/lib/core/base.sh
+++ b/lib/core/base.sh
@@ -304,7 +304,7 @@ cleanup_temp_files() {
 
     if [[ ${#MOLE_TEMP_DIRS[@]} -gt 0 ]]; then
         for file in "${MOLE_TEMP_DIRS[@]}"; do
-            [[ -d "$file" ]] && rm -rf "$file" 2> /dev/null || true
+            [[ -d "$file" ]] && rm -rf "$file" 2> /dev/null || true  # SAFE: cleanup_temp_files
         done
     fi
 
diff --git a/lib/core/file_ops.sh b/lib/core/file_ops.sh
index 615caf5..3697f0a 100644
--- a/lib/core/file_ops.sh
+++ b/lib/core/file_ops.sh
@@ -100,7 +100,7 @@ safe_remove() {
     debug_log "Removing: $path"
 
     # Perform the deletion
-    if rm -rf "$path" 2> /dev/null; then
+    if rm -rf "$path" 2> /dev/null; then  # SAFE: safe_remove implementation
         return 0
     else
         [[ "$silent" != "true" ]] && log_error "Failed to remove: $path"
@@ -135,7 +135,7 @@ safe_sudo_remove() {
     debug_log "Removing (sudo): $path"
 
     # Perform the deletion
-    if sudo rm -rf "$path" 2> /dev/null; then
+    if sudo rm -rf "$path" 2> /dev/null; then  # SAFE: safe_sudo_remove implementation
         return 0
     else
         log_error "Failed to remove (sudo): $path"