fix(core): use mktemp for temporary output file creation

Replaces $$.$RANDOM with mktemp, which provides cryptographically
random names and atomic file creation.

1 files changed, 3 insertions, 1 deletions

diff --git a/transcode.sh b/transcode.sh
index 500111d..a25bc6a 100755
--- a/transcode.sh
+++ b/transcode.sh
@@ -690,7 +690,9 @@ encode_one() {
 
   # Temp file is created in the same directory as the input so that `mv` is
   # atomic on the same filesystem (avoid cross-device rename issues).
-  tmp="$directory/.${stem}_$PRESET_NAME.$$.$RANDOM${extension:+.$extension}"
+  # mktemp provides cryptographically random names and atomic creation,
+  # unlike $$.$RANDOM which has limited entropy and is predictable.
+  tmp=$(mktemp -- "$directory/.${stem}_${PRESET_NAME}.XXXXXX${extension:+.$extension}")
   TMP_FILES+=("$tmp")
   debug "Temporary output path:" "$tmp"