diff --git a/evals/src/sync_datasets.ts b/evals/src/sync_datasets.ts
index 0611942b..54ac1a3c 100644
--- a/evals/src/sync_datasets.ts
+++ b/evals/src/sync_datasets.ts
@@ -134,7 +134,11 @@ async function coqaClosedQA(): Promise<ClosedQACase[]> {
 }
 
 function saveFile(cases: unknown[], fname: string) {
-  fs.writeFileSync(path.join(dataDir, fname), JSON.stringify(cases, null, 2));
+  if (!/^[\w-]+\.json$/.test(fname)) {
+    throw new Error(`Invalid output file name: ${fname}`);
+  }
+  const outPath = `${dataDir}${path.sep}${fname}`;
+  fs.writeFileSync(outPath, JSON.stringify(cases, null, 2));
 }
 
 async function main() {