diff --git a/src/filedust/cli.py b/src/filedust/cli.py
index d05106a..42077f3 100644
--- a/src/filedust/cli.py
+++ b/src/filedust/cli.py
@@ -172,6 +172,19 @@ def main(argv: list[str] | None = None) -> int:
     args = parser.parse_args(argv)
 
     root = Path(args.path).expanduser()
+    home = Path.home().resolve()
+    root_resolved = root.resolve()
+
+    # Ensure root is inside the user's home directory
+    try:
+        root_resolved.relative_to(home)
+    except ValueError:
+        console.print(
+            f"[red]Error:[/] Refusing to operate outside the user's home directory.\n"
+            f"Requested: {root_resolved}\n"
+            f"Allowed:   {home}"
+        )
+        return 1
 
     if not root.exists():
         console.print(f"[red]Error:[/] Path not found: {root}")
diff --git a/src/filedust/junk.py b/src/filedust/junk.py
index 7b21c4a..54c6543 100644
--- a/src/filedust/junk.py
+++ b/src/filedust/junk.py
@@ -23,7 +23,6 @@ JUNK_DIR_NAMES = {
     ".nox",
     ".tox",
     ".hypothesis",
-    ".cache",
     ".gradle",
     ".parcel-cache",
     ".turbo",
@@ -31,7 +30,6 @@ JUNK_DIR_NAMES = {
     ".vite",
     ".sass-cache",
     ".sass-cache",
-    "build",
     "dist",
 }
 
@@ -53,6 +51,8 @@ JUNK_FILE_PATTERNS = [
 
 # VCS / system dirs
 SKIP_DIR_NAMES = {
+    ".cache",
+    "build",
     ".git",
     ".hg",
     ".svn",