diff --git a/openatlas/display/util.py b/openatlas/display/util.py
index bf18370af..6a33fc1d6 100644
--- a/openatlas/display/util.py
+++ b/openatlas/display/util.py
@@ -197,8 +197,8 @@ def display_menu(entity: Optional[Entity], origin: Optional[Entity]) -> str:
         view_name = origin.class_.view
     html = ''
     for item in [
-            'source', 'event', 'actor', 'place', 'artifact', 'reference',
-            'type']:
+        'source', 'event', 'actor', 'place', 'artifact', 'reference',
+        'type']:
         active = ''
         request_parts = request.path.split('/')
         if view_name == item \
@@ -314,8 +314,8 @@ def get_backup_file_data() -> dict[str, Any]:
     latest_file = None
     latest_file_date = None
     for file in [
-            f for f in path.iterdir()
-            if (path / f).is_file() and f.name != '.gitignore']:
+        f for f in path.iterdir()
+        if (path / f).is_file() and f.name != '.gitignore']:
         file_date = datetime.utcfromtimestamp((path / file).stat().st_ctime)
         if not latest_file_date or file_date > latest_file_date:
             latest_file = file
@@ -334,7 +334,7 @@ def get_backup_file_data() -> dict[str, Any]:
 def get_base_table_data(entity: Entity, show_links: bool = True) -> list[Any]:
     data: list[Any] = [format_name_and_aliases(entity, show_links)]
     if entity.class_.view in [
-            'actor', 'artifact', 'event', 'place', 'reference']:
+        'actor', 'artifact', 'event', 'place', 'reference']:
         data.append(entity.class_.label)
     if entity.class_.standard_type_id:
         data.append(entity.standard_type.name if entity.standard_type else '')
@@ -644,10 +644,15 @@ def manual(site: str) -> str:
         # print(f'Missing manual link: {path}')
         return ''
     return \
-        '<a title="' + uc_first(_('manual')) + '" ' \
-        f'href="/static/manual/{site}.html" class="manual" ' \
-        f'target="_blank" rel="noopener noreferrer">' \
-        f'<i class="fas fs-4 fa-book"></i></a>'
+            '<a title="' + uc_first(_('manual')) + '" ' \
+                                                   f'href="/static/manual/' \
+                                                   f'{site}.html" ' \
+                                                   f'class="manual" ' \
+                                                   f'target="_blank" ' \
+                                                   f'rel="noopener ' \
+                                                   f'noreferrer">' \
+                                                   f'<i class="fas fs-4 ' \
+                                                   f'fa-book"></i></a>'
 
 
 @app.template_filter()
@@ -751,7 +756,7 @@ def get_entities_linked_to_type_recursive(
 
 def check_iiif_activation() -> bool:
     return bool(g.settings['iiif'] and
-    os.access(Path(g.settings['iiif_path']), os.W_OK))
+                os.access(Path(g.settings['iiif_path']), os.W_OK))
 
 
 def check_iiif_file_exist(id_: int) -> bool:
@@ -766,16 +771,22 @@ def get_iiif_file_path(id_: int) -> Path:
 
 
 def convert_image_to_iiif(id_: int) -> None:
-    compression = g.settings['iiif_conversion'] \
-        if g.settings['iiif_conversion'] in ['deflate', 'jpeg'] else 'deflate'
-    vips = "vips" if os.name == 'posix' else "vips.exe"
-    command = \
-        (f"{vips} tiffsave {get_file_path(id_)} {get_iiif_file_path(id_)} "
-         f"--tile --pyramid --compression {compression} "
-         f"--tile-width 128 --tile-height 128")
-    try:
-        process = subprocess.Popen(command, shell=True)
-        process.wait()
+    command = ["vips" if os.name == 'posix' else "vips.exe"]
+    command.extend([
+        'tiffsave',
+        get_file_path(id_),
+        get_iiif_file_path(id_),
+        '--tile',
+        '--pyramid',
+        '--compression',
+        g.settings['iiif_conversion'],
+        '--tile-width',
+        '128',
+        '--tile-height',
+        '128'])
+    process = subprocess.Popen(command)
+    process.wait()
+    if process.returncode == 0:
         flash(_('IIIF converted'), 'info')
-    except Exception as e:  # pragma: no cover
-        flash(f"{_('failed to convert image')}: {e}", 'error')
+    else:
+        flash(f"{_('failed to convert image')}", 'error')
diff --git a/openatlas/models/export.py b/openatlas/models/export.py
index e95736733..3ed330e2c 100644
--- a/openatlas/models/export.py
+++ b/openatlas/models/export.py
@@ -2,6 +2,7 @@
 import shutil
 import subprocess
 from datetime import datetime
+from pathlib import Path
 from typing import Optional
 
 from openatlas import app
@@ -17,21 +18,20 @@ def current_date_for_filename() -> str:
 def sql_export(format_: str, postfix: Optional[str] = '') -> bool:
     file = app.config['EXPORT_PATH'] \
            / f'{current_date_for_filename()}_export{postfix}.{format_}'
-    pg_dump = "pg_dump" if os.name == 'posix' \
-        else f'"{shutil.which("pg_dump.exe")}"'
-    command = \
-        f"{pg_dump} " \
-        f"{'-Fc' if format_ == 'dump' else ''} " \
-        f"-h {app.config['DATABASE_HOST']} " \
-        f"-d {app.config['DATABASE_NAME']} " \
-        f"-U {app.config['DATABASE_USER']} " \
-        f"-p {app.config['DATABASE_PORT']} " \
-        f"-f {file}"
+    command = ["pg_dump" if os.name == 'posix'
+               else Path(shutil.which("pg_dump.exe"))]
+    if format_ == 'dump':
+        command.append('-Fc')
+    command.extend([
+        '-h', app.config['DATABASE_HOST'],
+        '-d', app.config['DATABASE_NAME'],
+        '-U', app.config['DATABASE_USER'],
+        '-p', str(app.config['DATABASE_PORT']),
+        '-f', file])
     try:
         root = os.environ['SYSTEMROOT'] if 'SYSTEMROOT' in os.environ else ''
         subprocess.Popen(
             command,
-            shell=True,
             stdin=subprocess.PIPE,
             env={
                 'PGPASSWORD': app.config['DATABASE_PASS'],
diff --git a/openatlas/views/entity.py b/openatlas/views/entity.py
index aae056164..48ee9ee7d 100644
--- a/openatlas/views/entity.py
+++ b/openatlas/views/entity.py
@@ -212,7 +212,7 @@ def insert_files(manager: BaseManager) -> Union[str, Response]:
             path = app.config['UPLOAD_PATH'] / name
             file.save(str(path))
             if f'.{ext}' in g.display_file_ext:
-                call(f'exiftran -ai {path}', shell=True)  # Fix rotation
+                call(['exiftran', '-ai', path])  # Fix rotation
             filenames.append(name)
             if g.settings['image_processing']:
                 resize_image(name)