In terms of the overall upload code to server and we run it, yes it is an exec in many ways (And we should probably sandbox eventualyl down the road, possibly utilize chrome's sandboxing). 

The security issue I'm talking about here is that this is a general temporary file creation utility, and in particularly why people should use mkstemp() rather than mktemp().

I get that they're all a little different. The thing is effectively tmp_file with an extra copy in / out  utility added. It would be better to use tmp_file, and then copy into the fd it makes.