Not sure we should consider `safe_system` public, perhaps this should just use Kernel.system and raise a custom exception.