diff --git a/lib/common-functions.sh b/lib/common-functions.sh
index dda7563..8747604 100755
--- a/lib/common-functions.sh
+++ b/lib/common-functions.sh
@@ -5,6 +5,12 @@
 # Shared utilities for all Server Management Toolkit modules
 #############################################################################
 
+# Source guard - prevent re-sourcing
+if [ -n "${_COMMON_FUNCTIONS_LOADED:-}" ]; then
+    return 0
+fi
+readonly _COMMON_FUNCTIONS_LOADED=1
+
 #############################################################################
 # Professional Color Scheme
 # - Uses ONLY basic ANSI colors (works on ANY terminal)
diff --git a/lib/reference-db.sh b/lib/reference-db.sh
index 8ec8f8d..33d19df 100755
--- a/lib/reference-db.sh
+++ b/lib/reference-db.sh
@@ -6,6 +6,12 @@
 # Format: Pipe-delimited structured data
 #############################################################################
 
+# Source guard - prevent re-sourcing
+if [ -n "${_REFERENCE_DB_LOADED:-}" ]; then
+    return 0
+fi
+readonly _REFERENCE_DB_LOADED=1
+
 # Source dependencies
 if [ -z "$TOOLKIT_BASE_DIR" ]; then
     SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -19,6 +25,31 @@ fi
 export SYSREF_DB="${TOOLKIT_BASE_DIR}/.sysref.beta"
 export SYSREF_TIMESTAMP="${TOOLKIT_BASE_DIR}/.sysref.beta.timestamp"
 
+# Timeout for domain HTTP checks
+export DOMAIN_CHECK_TIMEOUT=${DOMAIN_CHECK_TIMEOUT:-3}
+
+#############################################################################
+# URL Encoding Helper
+#############################################################################
+
+# URL encode a string for safe use in curl requests
+url_encode() {
+    local string="${1:-}"
+    local strlen=${#string}
+    local encoded=""
+    local pos c o
+
+    for (( pos=0 ; pos<strlen ; pos++ )); do
+        c=${string:$pos:1}
+        case "$c" in
+            [-_.~a-zA-Z0-9] ) o="${c}" ;;
+            * ) printf -v o '%%%02X' "'$c"
+        esac
+        encoded+="${o}"
+    done
+    echo "${encoded}"
+}
+
 #############################################################################
 # DATABASE STRUCTURE
 #############################################################################
@@ -125,7 +156,13 @@ build_system_section() {
 build_users_section() {
     echo "[USERS]" >> "$SYSREF_DB"
 
-    local users=($(list_all_users))
+    # Safely populate users array from function output
+    local users=()
+    while IFS= read -r user; do
+        [ -z "$user" ] && continue
+        users+=("$user")
+    done < <(list_all_users)
+
     local total_users=${#users[@]}
     local current=0
 
@@ -215,14 +252,17 @@ check_domain_status() {
         return 0
     fi
 
-    # Try HTTP (timeout 3 seconds, max 2 redirects, check for valid response)
-    http_code=$(timeout 3 curl -s -o /dev/null -w "%{http_code}" --max-redirs 2 -m 3 "http://$domain" 2>/dev/null)
+    # URL encode domain for safe curl request (handles special characters)
+    local encoded_domain=$(url_encode "$domain")
+
+    # Try HTTP (with configurable timeout, max 2 redirects)
+    http_code=$(timeout "$DOMAIN_CHECK_TIMEOUT" curl -s -o /dev/null -w "%{http_code}" --max-redirs 2 -m "$DOMAIN_CHECK_TIMEOUT" "http://$encoded_domain" 2>/dev/null)
     if [ $? -ne 0 ] || [ -z "$http_code" ]; then
         http_code="timeout"
     fi
 
-    # Try HTTPS (timeout 3 seconds, max 2 redirects, ignore cert errors)
-    https_code=$(timeout 3 curl -s -o /dev/null -w "%{http_code}" --max-redirs 2 -m 3 -k "https://$domain" 2>/dev/null)
+    # Try HTTPS (with configurable timeout, max 2 redirects, ignore cert errors)
+    https_code=$(timeout "$DOMAIN_CHECK_TIMEOUT" curl -s -o /dev/null -w "%{http_code}" --max-redirs 2 -m "$DOMAIN_CHECK_TIMEOUT" -k "https://$encoded_domain" 2>/dev/null)
     if [ $? -ne 0 ] || [ -z "$https_code" ]; then
         https_code="timeout"
     fi
diff --git a/lib/system-detect.sh b/lib/system-detect.sh
index 73490fd..f9d5103 100755
--- a/lib/system-detect.sh
+++ b/lib/system-detect.sh
@@ -6,6 +6,12 @@
 # No persistent caching - detects fresh every time
 #############################################################################
 
+# Source guard - prevent re-sourcing (but allow re-initialization if needed)
+if [ -n "${_SYSTEM_DETECT_LOADED:-}" ]; then
+    return 0
+fi
+readonly _SYSTEM_DETECT_LOADED=1
+
 # Source common functions if not already loaded
 if [ -z "$TOOLKIT_BASE_DIR" ]; then
     SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"