use safe_open