diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..c18dd8d
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+__pycache__/
diff --git a/usr/share/sdwdate/onion-tester b/usr/share/sdwdate/onion-tester
index 8b8b861..cca5b6b 100755
--- a/usr/share/sdwdate/onion-tester
+++ b/usr/share/sdwdate/onion-tester
@@ -3,7 +3,12 @@
 ## Copyright (C) 2017 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
 ## See the file COPYING for copying conditions.
 
-import os
+## Comments for reviewers:
+## URLs are read from /etc/sdwdate.d/*.conf which is root-owned and trusted.
+## subprocess.Popen with a list of arguments (no shell) is used in exec_curl()
+## to safely pass URLs as a single argument to curl, avoiding shell interpretation.
+
+import subprocess
 import time
 import datetime
 from sdwdate.remote_times import get_time_from_servers
@@ -19,11 +24,18 @@ def chunks(my_list, n):
         yield my_list[i:i + n]
 
 def exec_curl(c_url):
-    cmd = 'curl --head '+c_url+'> /dev/null 2>&1'
-    c_out = os.system(cmd)
-    if '0' in str(c_out) :
-        return ' (Curl --head is OK)'
-    else:
+    try:
+        result = subprocess.Popen(
+            ['curl', '--head', c_url],
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL
+        )
+        result.wait()
+        if result.returncode == 0:
+            return ' (Curl --head is OK)'
+        else:
+            return ' (Curl --head also Not OK)'
+    except Exception:
         return ' (Curl --head also Not OK)'
 
 class Pool: