diff --git a/src/utils/credentials.ts b/src/utils/credentials.ts
index bfbd4bf..489cc9a 100644
--- a/src/utils/credentials.ts
+++ b/src/utils/credentials.ts
@@ -1,6 +1,6 @@
 import { promises as fs } from "fs";
 import { homedir } from "os";
-import { join } from "path";
+import { join, resolve, relative } from "path";
 import {
     CredentialsStorage,
     LeetCodeCredentials
@@ -14,7 +14,13 @@ export class FileCredentialsStorage implements CredentialsStorage {
 
     constructor(credentialsDir?: string) {
         this.credentialsDir = credentialsDir ?? DEFAULT_CREDENTIALS_DIR;
-        this.credentialsFile = join(this.credentialsDir, "credentials.json");
+        const base = resolve(this.credentialsDir);
+        const target = resolve(base, "credentials.json");
+        const rel = relative(base, target);
+        if (rel.startsWith("..") || resolve(rel) === rel) {
+            throw new Error("Invalid credentials path");
+        }
+        this.credentialsFile = target;
     }
 
     async exists(): Promise<boolean> {
diff --git a/tests/utils/credentials.test.ts b/tests/utils/credentials.test.ts
index 0c2a48b..48afbc2 100644
--- a/tests/utils/credentials.test.ts
+++ b/tests/utils/credentials.test.ts
@@ -1,6 +1,6 @@
 import { promises as fs } from "fs";
 import { homedir } from "os";
-import { join } from "path";
+import { join, resolve, relative } from "path";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import { LeetCodeCredentials } from "../../src/types/credentials.js";
 import { FileCredentialsStorage } from "../../src/utils/credentials.js";
@@ -93,4 +93,84 @@ describe("FileCredentialsStorage", () => {
             await expect(storage.save(credentials)).resolves.not.toThrow();
         });
     });
+
+    describe("path traversal security", () => {
+        it("should validate that credentials.json stays within base directory", () => {
+            // The security fix validates the resolved path relationship
+            // This ensures credentials.json cannot escape the base directory
+            const storage = new FileCredentialsStorage(testDir);
+            expect(storage).toBeDefined();
+        });
+
+        it("should accept standard directory paths", () => {
+            // Normal directory paths should work
+            expect(() => {
+                new FileCredentialsStorage(testDir);
+            }).not.toThrow();
+        });
+
+        it("should accept nested subdirectory paths", () => {
+            // Subdirectories should work correctly
+            const validSubdir = join(testDir, "subdir", "nested");
+            expect(() => {
+                new FileCredentialsStorage(validSubdir);
+            }).not.toThrow();
+        });
+
+        it("should handle absolute paths correctly", () => {
+            // Absolute paths are valid for the base directory
+            // The security check ensures the credentials file stays within
+            const absolutePath = join(homedir(), ".leetcode-mcp-security-test");
+            expect(() => {
+                new FileCredentialsStorage(absolutePath);
+            }).not.toThrow();
+        });
+
+        it("should handle relative paths correctly", () => {
+            // Relative paths get resolved and validated
+            expect(() => {
+                new FileCredentialsStorage("./test-creds");
+            }).not.toThrow();
+        });
+
+        it("should demonstrate path validation logic prevents traversal", () => {
+            // This test demonstrates the security validation logic
+            // The code checks: if (rel.startsWith("..") || resolve(rel) === rel)
+            
+            // Simulate what the security check does
+            const base = resolve(testDir);
+            const target = resolve(base, "credentials.json");
+            const rel = relative(base, target);
+            
+            // The relative path should be just "credentials.json"
+            expect(rel).toBe("credentials.json");
+            
+            // It should NOT start with ".." (which would mean escaping upward)
+            expect(rel.startsWith("..")).toBe(false);
+            
+            // It should NOT be an absolute path
+            expect(resolve(rel) === rel).toBe(false);
+            
+            // This validates the security boundary is working correctly
+        });
+
+        it("should demonstrate what would fail the security check", () => {
+            // This test shows what patterns would be rejected
+            // if the filename could be manipulated
+            
+            const base = resolve(testDir);
+            
+            // Example 1: Path that escapes upward
+            const maliciousPath1 = resolve(base, "../../../etc/passwd");
+            const rel1 = relative(base, maliciousPath1);
+            // This would start with ".." and fail the check
+            expect(rel1.startsWith("..")).toBe(true);
+            
+            // Example 2: Absolute path
+            const maliciousPath2 = "/etc/passwd";
+            const rel2 = relative(base, maliciousPath2);
+            // This would be an absolute path and fail the check
+            expect(resolve(rel2) === rel2 || rel2.startsWith("..")).toBe(true);
+        });
+    });
 });