diff --git a/modules/security/live-attack-monitor.sh b/modules/security/live-attack-monitor.sh
index c23ac9d..1a6d5c3 100755
--- a/modules/security/live-attack-monitor.sh
+++ b/modules/security/live-attack-monitor.sh
@@ -229,7 +229,7 @@ update_ip_intelligence() {
     hits=$((hits + 1))
 
     # Enrich with threat intelligence on first encounter (hits == 1)
-    if [ $hits -eq 1 ]; then
+    if [ "${hits:-0}" -eq 1 ]; then
         # Check if whitelisted first
         if is_whitelisted_service "$ip" 2>/dev/null; then
             score=0
@@ -250,14 +250,14 @@ update_ip_intelligence() {
                     local current_data="${IP_DATA[$ip]}"
                     IFS='|' read -r old_score old_hits old_bot old_attacks old_ban old_rep <<< "$current_data"
                     local new_score=$((old_score + 30))
-                    [ $new_score -gt 100 ] && new_score=100
+                    [ "${new_score:-0}" -gt 100 ] && new_score=100
                     IP_DATA[$ip]="$new_score|$old_hits|$old_bot|$old_attacks|$old_ban|$old_rep"
                 elif [ "${abuse_conf:-0}" -ge 50 ]; then
                     # Medium confidence - add 15 points
                     local current_data="${IP_DATA[$ip]}"
                     IFS='|' read -r old_score old_hits old_bot old_attacks old_ban old_rep <<< "$current_data"
                     local new_score=$((old_score + 15))
-                    [ $new_score -gt 100 ] && new_score=100
+                    [ "${new_score:-0}" -gt 100 ] && new_score=100
                     IP_DATA[$ip]="$new_score|$old_hits|$old_bot|$old_attacks|$old_ban|$old_rep"
                 fi
 
@@ -266,7 +266,7 @@ update_ip_intelligence() {
                     local current_data="${IP_DATA[$ip]}"
                     IFS='|' read -r old_score old_hits old_bot old_attacks old_ban old_rep <<< "$current_data"
                     local new_score=$((old_score + 5))
-                    [ $new_score -gt 100 ] && new_score=100
+                    [ "${new_score:-0}" -gt 100 ] && new_score=100
                     IP_DATA[$ip]="$new_score|$old_hits|$old_bot|$old_attacks|$old_ban|$old_rep"
                 fi
             ) &
@@ -316,7 +316,7 @@ update_ip_intelligence() {
     fi
 
     # Request volume scoring
-    if [ $hits -gt 100 ]; then
+    if [ "${hits:-0}" -gt 100 ]; then
         score=$((score + 5))
     elif [ $hits -gt 50 ]; then
         score=$((score + 3))
diff --git a/modules/security/malware-scanner.sh b/modules/security/malware-scanner.sh
index 460c1ed..9c8a3ee 100755
--- a/modules/security/malware-scanner.sh
+++ b/modules/security/malware-scanner.sh
@@ -430,7 +430,7 @@ sanitize_docroots() {
             fi
         done
 
-        if [ $skip -eq 0 ]; then
+        if [ "${skip:-0}" -eq 0 ]; then
             sanitized_docroot+=("$docroot")
         fi
     done
@@ -935,7 +935,7 @@ done
             fi
         done < <(sort -u "$INFECTED_LIST" | head -20)  # Limit to first 20 files to avoid long processing
 
-        if [ $flagged_ips -gt 0 ]; then
+        if [ "${flagged_ips:-0}" -gt 0 ]; then
             echo "✓ Flagged $flagged_ips IPs in reputation database"
             echo "  (See $LOG_DIR/flagged_ips.log for details)"
         else
diff --git a/modules/security/optimize-ct-limit.sh b/modules/security/optimize-ct-limit.sh
index 754b214..4143d18 100755
--- a/modules/security/optimize-ct-limit.sh
+++ b/modules/security/optimize-ct-limit.sh
@@ -808,7 +808,7 @@ main() {
         AUTO_MODE=1
     fi
 
-    if [ $AUTO_MODE -eq 0 ]; then
+    if [ "${AUTO_MODE:-0}" -eq 0 ]; then
         clear
         print_banner "CT_LIMIT Optimizer - Intelligent Connection Limit Calculator"
         echo ""
@@ -842,7 +842,7 @@ main() {
     generate_recommendation
 
     # Apply automatically in auto mode, otherwise ask
-    if [ $AUTO_MODE -eq 1 ]; then
+    if [ "${AUTO_MODE:-0}" -eq 1 ]; then
         # Extract balanced value from recommendation
         local balanced=$(grep "2. BALANCED" -A1 "$TEMP_ANALYSIS/recommendation.txt" | grep "CT_LIMIT" | grep -oE '[0-9]+')
 
@@ -876,7 +876,7 @@ main() {
     fi
 
     echo ""
-    if [ $AUTO_MODE -eq 0 ]; then
+    if [ "${AUTO_MODE:-0}" -eq 0 ]; then
         print_success "Analysis complete!"
     fi
 }