diff --git a/cmd/main.go b/cmd/main.go
index 6b9cc2c..6791b7a 100644
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -40,18 +40,20 @@ func main() {
 		fmt.Println(err)
 		os.Exit(1)
 	}
+
+	//nolint:errcheck // log.Sync may return an error which is safe to ignore here
 	defer log.Sync()
 
 	home, err := os.UserHomeDir()
 	if err != nil {
 		log.Errorw("failed to get user home directory", "error", err)
+		//nolint:gocritic // exitAfterDefer: ensure immediate exit on unrecoverable error
 		os.Exit(1)
 	}
 	sshConfigFile := filepath.Join(home, ".ssh", "config")
 	metaDataFile := filepath.Join(home, ".lazyssh", "metadata.json")
 
 	serverRepo := file.NewServerRepo(log, sshConfigFile, metaDataFile)
-	// serverInMemoryRepo := memory.NewServerRepository(log)
 	serverService := services.NewServerService(log, serverRepo)
 	tui := ui.NewTUI(log, serverService, version, gitCommit, buildTime)
 
diff --git a/internal/adapters/data/file/ssh_config_manager.go b/internal/adapters/data/file/ssh_config_manager.go
index d57ee29..69b79ca 100644
--- a/internal/adapters/data/file/ssh_config_manager.go
+++ b/internal/adapters/data/file/ssh_config_manager.go
@@ -43,7 +43,9 @@ func (m *sshConfigManager) parseServers() ([]domain.Server, error) {
 		}
 		return nil, err
 	}
-	defer file.Close()
+	defer func() {
+		_ = file.Close()
+	}()
 
 	parser := &SSHConfigParser{}
 	return parser.Parse(file)
@@ -58,7 +60,9 @@ func (m *sshConfigManager) writeServers(servers []domain.Server) error {
 	if err != nil {
 		return err
 	}
-	defer file.Close()
+	defer func() {
+		_ = file.Close()
+	}()
 
 	writer := &SSHConfigWriter{}
 	return writer.Write(file, servers)
diff --git a/internal/adapters/data/file/writer.go b/internal/adapters/data/file/writer.go
index ece1f3e..fce4eca 100644
--- a/internal/adapters/data/file/writer.go
+++ b/internal/adapters/data/file/writer.go
@@ -26,36 +26,55 @@ type SSHConfigWriter struct{}
 
 func (w *SSHConfigWriter) Write(writer io.Writer, servers []domain.Server) error {
 	bufWriter := bufio.NewWriter(writer)
-	defer bufWriter.Flush()
+	defer func() {
+		_ = bufWriter.Flush()
+	}()
 
-	fmt.Fprintf(bufWriter, "%s\n\n", ManagedByComment)
+	if _, err := fmt.Fprintf(bufWriter, "%s\n\n", ManagedByComment); err != nil {
+		return err
+	}
 
 	for i, server := range servers {
 		if i > 0 {
-			bufWriter.WriteString("\n")
+			if _, err := bufWriter.WriteString("\n"); err != nil {
+				return err
+			}
+		}
+		if err := w.writeServer(bufWriter, server); err != nil {
+			return err
 		}
-		w.writeServer(bufWriter, server)
 	}
 
 	return nil
 }
 
-func (w *SSHConfigWriter) writeServer(writer *bufio.Writer, server domain.Server) {
-	fmt.Fprintf(writer, "Host %s\n", server.Alias)
+func (w *SSHConfigWriter) writeServer(writer *bufio.Writer, server domain.Server) error {
+	if _, err := fmt.Fprintf(writer, "Host %s\n", server.Alias); err != nil {
+		return err
+	}
 
 	if server.Host != "" {
-		fmt.Fprintf(writer, "    HostName %s\n", server.Host)
+		if _, err := fmt.Fprintf(writer, "    HostName %s\n", server.Host); err != nil {
+			return err
+		}
 	}
 
 	if server.User != "" {
-		fmt.Fprintf(writer, "    User %s\n", server.User)
+		if _, err := fmt.Fprintf(writer, "    User %s\n", server.User); err != nil {
+			return err
+		}
 	}
 
 	if server.Port != 0 && server.Port != DefaultPort {
-		fmt.Fprintf(writer, "    Port %d\n", server.Port)
+		if _, err := fmt.Fprintf(writer, "    Port %d\n", server.Port); err != nil {
+			return err
+		}
 	}
 
 	if server.Key != "" {
-		fmt.Fprintf(writer, "    IdentityFile %s\n", server.Key)
+		if _, err := fmt.Fprintf(writer, "    IdentityFile %s\n", server.Key); err != nil {
+			return err
+		}
 	}
+	return nil
 }
diff --git a/internal/adapters/ui/utils.go b/internal/adapters/ui/utils.go
index 59a3cca..cb753f6 100644
--- a/internal/adapters/ui/utils.go
+++ b/internal/adapters/ui/utils.go
@@ -30,10 +30,10 @@ func renderTagBadgesForList(tags []string) string {
 	if len(tags) == 0 {
 		return ""
 	}
-	max := 2
+	maxTags := 2
 	shown := tags
-	if len(tags) > max {
-		shown = tags[:max]
+	if len(tags) > maxTags {
+		shown = tags[:maxTags]
 	}
 	parts := make([]string, 0, len(shown)+1)
 	for _, t := range shown {
@@ -93,11 +93,12 @@ func humanizeDuration(t time.Time) string {
 func BuildSSHCommand(s domain.Server) string {
 	parts := []string{"ssh"}
 	userHost := ""
-	if s.User != "" && s.Host != "" {
+	switch {
+	case s.User != "" && s.Host != "":
 		userHost = fmt.Sprintf("%s@%s", s.User, s.Host)
-	} else if s.Host != "" {
+	case s.Host != "":
 		userHost = s.Host
-	} else {
+	default:
 		userHost = s.Alias
 	}
 	parts = append(parts, userHost)
@@ -114,7 +115,7 @@ func BuildSSHCommand(s domain.Server) string {
 // quoteIfNeeded returns the value quoted if it contains spaces.
 func quoteIfNeeded(val string) string {
 	if strings.ContainsAny(val, " \t") {
-		return fmt.Sprintf("\"%s\"", val)
+		return fmt.Sprintf("%q", val)
 	}
 	return val
 }
diff --git a/internal/logger/logger.go b/internal/logger/logger.go
index 9e8a413..359c936 100644
--- a/internal/logger/logger.go
+++ b/internal/logger/logger.go
@@ -40,7 +40,7 @@ func New(service string, outputPaths ...string) (*zap.SugaredLogger, error) {
 		return nil, err
 	}
 	logDir := filepath.Join(home, ".lazyssh")
-	if err := os.MkdirAll(logDir, 0o755); err != nil {
+	if err := os.MkdirAll(logDir, 0o750); err != nil {
 		return nil, err
 	}
 	config.OutputPaths = []string{filepath.Join(logDir, "lazyssh.log")}