diff --git a/bin/clean.sh b/bin/clean.sh
index b315b8e..fbc3886 100755
--- a/bin/clean.sh
+++ b/bin/clean.sh
@@ -273,7 +273,7 @@ safe_clean() {
                 local size
                 size=$(get_path_size_kb "$path")
                 local count
-                count=$(find "$path" -type f 2> /dev/null | wc -l | tr -d ' ')
+                count=$(find -- "$path" -type f 2> /dev/null | wc -l | tr -d ' ')
                 # Use index + PID for unique filename
                 local tmp_file="$temp_dir/result_${idx}.$$"
                 echo "$size $count" > "$tmp_file"
@@ -332,7 +332,7 @@ safe_clean() {
             local size_bytes
             size_bytes=$(get_path_size_kb "$path")
             local count
-            count=$(find "$path" -type f 2> /dev/null | wc -l | tr -d ' ')
+            count=$(find -- "$path" -type f 2> /dev/null | wc -l | tr -d ' ')
 
             if [[ "$count" -gt 0 && "$size_bytes" -gt 0 ]]; then
                 if [[ "$DRY_RUN" != "true" ]]; then
diff --git a/lib/clean/brew.sh b/lib/clean/brew.sh
index f72bf2a..40f9a06 100644
--- a/lib/clean/brew.sh
+++ b/lib/clean/brew.sh
@@ -34,6 +34,8 @@ clean_orphaned_casks() {
     else
         # Rebuild cache: query all installed casks and extract app names
         mkdir -p "$cache_dir"
+        # Remove stale cache if it exists but has permission issues
+        rm -f "$cask_cache" 2> /dev/null || true
         true > "$cask_cache"
 
         while IFS= read -r cask; do
diff --git a/lib/core/common.sh b/lib/core/common.sh
index 2c5780f..517d067 100755
--- a/lib/core/common.sh
+++ b/lib/core/common.sh
@@ -241,7 +241,7 @@ safe_find_delete() {
     fi
 
     # Execute find with safety limits
-    find "$base_dir" \
+    find -- "$base_dir" \
         -maxdepth 3 \
         -name "$pattern" \
         -type "$type_filter" \
@@ -277,7 +277,7 @@ safe_sudo_find_delete() {
     fi
 
     # Execute find with safety limits
-    sudo find "$base_dir" \
+    sudo find -- "$base_dir" \
         -maxdepth 3 \
         -name "$pattern" \
         -type "$type_filter" \
@@ -1150,7 +1150,7 @@ clean_tool_cache() {
 get_path_size_kb() {
     local path="$1"
     local result
-    result=$(du -sk "$path" 2> /dev/null | awk '{print $1}')
+    result=$(du -sk -- "$path" 2> /dev/null | awk '{print $1}')
     echo "${result:-0}"
 }
 
diff --git a/mole b/mole
index 58f0a41..2f591d2 100755
--- a/mole
+++ b/mole
@@ -22,7 +22,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/lib/core/common.sh"
 
 # Version info
-VERSION="1.11.17"
+VERSION="1.11.18"
 MOLE_TAGLINE="can dig deep to clean your Mac."
 
 # Check if Touch ID is already configured