diff --git a/bin/clean.sh b/bin/clean.sh
index 76ca5b8..05a9ab1 100755
--- a/bin/clean.sh
+++ b/bin/clean.sh
@@ -222,16 +222,9 @@ safe_clean() {
         [[ "$skip" == "true" ]] && continue
 
         # Check user-defined whitelist
-        if [[ ${#WHITELIST_PATTERNS[@]} -gt 0 ]]; then
-            for w in "${WHITELIST_PATTERNS[@]}"; do
-                # Match both exact path and glob pattern
-                # shellcheck disable=SC2053
-                if [[ "$path" == "$w" ]] || [[ $path == $w ]]; then
-                    skip=true
-                    ((skipped_count++))
-                    break
-                fi
-            done
+        if is_path_whitelisted "$path"; then
+            skip=true
+            ((skipped_count++))
         fi
         [[ "$skip" == "true" ]] && continue
         [[ -e "$path" ]] && existing_paths+=("$path")
diff --git a/lib/clean/user.sh b/lib/clean/user.sh
index 5e00634..f9d6bcf 100644
--- a/lib/clean/user.sh
+++ b/lib/clean/user.sh
@@ -14,27 +14,7 @@ clean_user_essentials() {
     safe_clean ~/Library/Logs/* "User app logs"
 
     # Check if Trash directory is whitelisted
-    local trash_protected=false
-    local trash_path="$HOME/.Trash"
-
-    if [[ ${#WHITELIST_PATTERNS[@]} -gt 0 ]]; then
-        for w in "${WHITELIST_PATTERNS[@]}"; do
-            # Expand tilde in whitelist pattern for comparison
-            local expanded_w="${w/#\~/$HOME}"
-
-            # Remove trailing slash for consistent comparison
-            expanded_w="${expanded_w%/}"
-
-            # Check for exact match or glob pattern match
-            # shellcheck disable=SC2053
-            if [[ "$trash_path" == "$expanded_w" ]] || [[ "$trash_path" == $expanded_w ]]; then
-                trash_protected=true
-                break
-            fi
-        done
-    fi
-
-    if [[ "$trash_protected" == "true" ]]; then
+    if is_path_whitelisted "$HOME/.Trash"; then
         note_activity
         echo -e "  ${GREEN}${ICON_EMPTY}${NC} Trash · whitelist protected"
     else
@@ -103,24 +83,9 @@ scan_external_volumes() {
 
         # 1. Clean Trash on volume
         local volume_trash="$volume/.Trashes"
-        local volume_trash_protected=false
 
         # Check if external volume Trash is whitelisted
-        if [[ ${#WHITELIST_PATTERNS[@]} -gt 0 ]]; then
-            for w in "${WHITELIST_PATTERNS[@]}"; do
-                local expanded_w="${w/#\~/$HOME}"
-                expanded_w="${expanded_w%/}"
-
-                # Check for exact match or glob pattern match
-                # shellcheck disable=SC2053
-                if [[ "$volume_trash" == "$expanded_w" ]] || [[ "$volume_trash" == $expanded_w ]]; then
-                    volume_trash_protected=true
-                    break
-                fi
-            done
-        fi
-
-        if [[ -d "$volume_trash" && "$DRY_RUN" != "true" && "$volume_trash_protected" != "true" ]]; then
+        if [[ -d "$volume_trash" && "$DRY_RUN" != "true" ]] && ! is_path_whitelisted "$volume_trash"; then
             # Safely iterate and remove each item
             while IFS= read -r -d '' item; do
                 safe_remove "$item" true || true
diff --git a/lib/core/app_protection.sh b/lib/core/app_protection.sh
index dc2cd52..3666df1 100755
--- a/lib/core/app_protection.sh
+++ b/lib/core/app_protection.sh
@@ -590,6 +590,35 @@ should_protect_path() {
     return 1
 }
 
+# Check if a path is protected by whitelist patterns
+# Args: $1 - path to check
+# Returns: 0 if whitelisted, 1 if not
+is_path_whitelisted() {
+    local target_path="$1"
+    [[ -z "$target_path" ]] && return 1
+
+    # Normalize path (remove trailing slash)
+    local normalized_target="${target_path%/}"
+
+    # Empty whitelist means nothing is protected
+    [[ ${#WHITELIST_PATTERNS[@]} -eq 0 ]] && return 1
+
+    for pattern in "${WHITELIST_PATTERNS[@]}"; do
+        # Expand tilde in whitelist pattern for comparison
+        local expanded_pattern="${pattern/#\~/$HOME}"
+        expanded_pattern="${expanded_pattern%/}"
+
+        # Check for exact match or glob pattern match
+        # shellcheck disable=SC2053
+        if [[ "$normalized_target" == "$expanded_pattern" ]] ||
+           [[ "$normalized_target" == $expanded_pattern ]]; then
+            return 0
+        fi
+    done
+
+    return 1
+}
+
 # Locate files associated with an application
 find_app_files() {
     local bundle_id="$1"