diff --git a/lib/rate-anomaly-detector.sh b/lib/rate-anomaly-detector.sh
index 0081573..e2e284f 100644
--- a/lib/rate-anomaly-detector.sh
+++ b/lib/rate-anomaly-detector.sh
@@ -73,7 +73,7 @@ detect_rate_anomaly() {
 
     # Cleanup old entries (keep last 60 seconds only)
     if [ -f "$rate_file" ]; then
-        awk -v cutoff="$((current_time - 60))" '$1 > cutoff' "$rate_file" > "${rate_file}.tmp" 2>/dev/null
+        awk -v cutoff="$((current_time - 60))" '$1 > cutoff' -- "$rate_file" > "${rate_file}.tmp" 2>/dev/null
         mv "${rate_file}.tmp" "$rate_file" 2>/dev/null
     fi
 
@@ -98,7 +98,7 @@ analyze_request_pattern() {
     local cutoff=$((current_time - window))
 
     # Get timestamps in window
-    local timestamps=$(awk -v cutoff="$cutoff" '$1 > cutoff {print $1}' "$rate_file" 2>/dev/null | sort -n)
+    local timestamps=$(awk -v cutoff="$cutoff" '$1 > cutoff {print $1}' -- "$rate_file" 2>/dev/null | sort -n)
     local total_count=$(echo "$timestamps" | wc -l)
 
     if [ "$total_count" -lt 5 ]; then
@@ -182,7 +182,7 @@ get_current_rate() {
 
     local current_time=$(date +%s)
     local cutoff=$((current_time - window))
-    local count=$(awk -v cutoff="$cutoff" '$1 > cutoff' "$rate_file" 2>/dev/null | wc -l)
+    local count=$(awk -v cutoff="$cutoff" '$1 > cutoff' -- "$rate_file" 2>/dev/null | wc -l)
 
     # Calculate requests per second
     local rate=$((count / window))