obfuscate much? TODO: "data.json.tmp" is not a safe name