I fucked up: temp names for uploads are just random string