diff --git a/ext/dl/dl.c b/ext/dl/dl.c
index 00762c5be1..6bef7bb326 100644
--- a/ext/dl/dl.c
+++ b/ext/dl/dl.c
@@ -13,7 +13,6 @@ ID rbdl_id_stdcall;
 VALUE
 rb_dl_dlopen(int argc, VALUE argv[], VALUE self)
 {
-    rb_secure(2);
     return rb_class_new_instance(argc, argv, rb_cDLHandle);
 }
 
diff --git a/ext/dl/handle.c b/ext/dl/handle.c
index 0db66c70b4..a9df5d6119 100644
--- a/ext/dl/handle.c
+++ b/ext/dl/handle.c
@@ -114,6 +114,8 @@ rb_dlhandle_initialize(int argc, VALUE argv[], VALUE self)
 	rb_bug("rb_dlhandle_new");
     }
 
+    rb_secure(2);
+
 #if defined(HAVE_WINDOWS_H)
     if( !clib ){
 	HANDLE rb_libruby_handle(void);
diff --git a/test/dl/test_handle.rb b/test/dl/test_handle.rb
new file mode 100644
index 0000000000..d46e16c084
--- /dev/null
+++ b/test/dl/test_handle.rb
@@ -0,0 +1,27 @@
+require 'test_base'
+
+module DL
+  class TestHandle < TestBase
+    def test_dlopen_returns_handle
+      assert_instance_of DL::Handle, dlopen(LIBC_SO)
+    end
+
+    def test_dlopen_safe
+      assert_raises(SecurityError) do
+        Thread.new do
+          $SAFE = 2
+          dlopen(LIBC_SO)
+        end.join
+      end
+    end
+
+    def test_initialize_safe
+      assert_raises(SecurityError) do
+        Thread.new do
+          $SAFE = 2
+          DL::Handle.new(LIBC_SO)
+        end.join
+      end
+    end
+  end
+end