diff --git a/Project-Tests/run-tests.sh b/Project-Tests/run-tests.sh
index f0190ba..cbd490d 100755
--- a/Project-Tests/run-tests.sh
+++ b/Project-Tests/run-tests.sh
@@ -58,10 +58,10 @@ function run_single_test() {
     
     if timeout 300 bash "$test_file"; then
         print_success "✅ $test_name PASSED"
-        ((TESTS_PASSED++))
+        TESTS_PASSED=$((TESTS_PASSED + 1))
     else
         print_error "❌ $test_name FAILED"
-        ((TESTS_FAILED++))
+        TESTS_FAILED=$((TESTS_FAILED + 1))
     fi
 }
 
diff --git a/Project-Tests/security/2fa-validation.sh b/Project-Tests/security/2fa-validation.sh
index f1b9b78..ade228a 100755
--- a/Project-Tests/security/2fa-validation.sh
+++ b/Project-Tests/security/2fa-validation.sh
@@ -158,6 +158,8 @@ function test_user_2fa_setup() {
     
     for user in "${users[@]}"; do
         if id "$user" &>/dev/null; then
+            local user_home; user_home="$(getent passwd "$user" | cut -d: -f6)"
+
             # Check if setup script exists
             if [[ -f "/tmp/setup-2fa-$user.sh" ]]; then
                 echo "✅ 2FA setup script exists for user: $user"
@@ -167,7 +169,7 @@ function test_user_2fa_setup() {
             fi
             
             # Check if instructions exist
-            if [[ -f "/home/$user/2fa-setup-instructions.txt" ]]; then
+            if [[ -n "$user_home" && -f "$user_home/2fa-setup-instructions.txt" ]]; then
                 echo "✅ 2FA instructions exist for user: $user"
             else
                 echo "❌ 2FA instructions missing for user: $user"
diff --git a/Project-Tests/security/https-enforcement.sh b/Project-Tests/security/https-enforcement.sh
index 08f1073..e2a2d12 100755
--- a/Project-Tests/security/https-enforcement.sh
+++ b/Project-Tests/security/https-enforcement.sh
@@ -18,7 +18,9 @@ function test_no_http_urls() {
         if [[ -d "$dir" ]]; then
             # Find HTTP URLs in shell scripts (excluding comments)
             while IFS= read -r -d '' file; do
-                if grep -n "http://" "$file" | grep -v "^[[:space:]]*#" | grep -v "schema.org" | grep -v "xmlns"; then
+                # grep -n prefixes "linenum:", so the comment filter must allow
+                # for that prefix before the leading '#' of a comment line.
+                if grep -n "http://" "$file" | grep -vE '^[0-9]+:[[:space:]]*#' | grep -v "schema.org" | grep -v "xmlns"; then
                     echo "❌ HTTP URL found in: $file"
                     ((++http_violations))
                 fi