removed original name

frontend/src/App.svelte

@@ -53,8 +53,7 @@
         id: data.id,
         key: data.key,
         url: data.url,
-        originalName: data.originalName,
-        downloadName: data.downloadName || data.originalName,
+        downloadName: data.downloadName || '',
         mimeType: data.mimeType || '',
         size: data.size,
         createdAt: new Date().toISOString(),

frontend/src/components/FileList.svelte

@@ -8,7 +8,7 @@
 
   async function onDelete(item) {
     const ok = window.confirm(
-      `Delete "${item.originalName || item.downloadName}" permanently? This cannot be undone.`
+      `Delete "${item.downloadName || 'file'}" permanently? This cannot be undone.`
     );
     if (!ok) return;
     try {

frontend/src/components/FileRow.svelte

@@ -14,7 +14,7 @@
 
   let copied = false;
 
-  $: name = item.originalName || item.downloadName || 'file';
+  $: name = item.downloadName || 'file';
 
   async function copy() {
     await copyText(downloadUrl(item));

frontend/src/components/ResultPanel.svelte

@@ -8,7 +8,7 @@
   let copied = false;
 
   $: url = result ? downloadUrl(result) : '';
-  $: name = result ? result.originalName || result.downloadName || 'file' : '';
+  $: name = result ? result.downloadName || 'file' : '';
 
   async function copy() {
     await copyText(url);

frontend/src/lib/api.js

@@ -1,9 +1,27 @@
+// Generate a short, unguessable lowercase-alphanumeric name (client side),
+// keeping the original extension so the backend can derive a cosmetic name.
+function randomRename(name) {
+  const charset = 'abcdefghijklmnopqrstuvwxyz0123456789';
+  let id = '';
+  const bytes = crypto.getRandomValues(new Uint8Array(8));
+  for (let i = 0; i < 8; i += 1) id += charset[bytes[i] % charset.length];
+  const dot = name.lastIndexOf('.');
+  const ext = dot > 0 && dot < name.length - 1 ? name.slice(dot) : '';
+  return `${id}${ext}`;
+}
+
 export function uploadFile(file, password, onProgress) {
   return new Promise((resolve, reject) => {
     const xhr = new XMLHttpRequest();
     const form = new FormData();
+
+    // Rename the file client side before uploading: guard against the
+    // original name leaking and collisions. The backend re-asserts its own
+    // random id as the authoritative stored name regardless.
+    const renamed = new File([file], randomRename(file.name), { type: file.type });
+
     if (password) form.append('password', password);
-    form.append('file', file);
+    form.append('file', renamed);
 
     xhr.upload.addEventListener('progress', (e) => {
       if (e.lengthComputable && onProgress) onProgress(e.loaded, e.total);

frontend/src/lib/formats.js

@@ -9,7 +9,7 @@ export function forcedDownloadUrl(item) {
 }
 
 export function displayName(item) {
-  return item.downloadName || item.originalName || 'file';
+  return item.downloadName || 'file';
 }
 
 export function fileExtension(item) {
@@ -20,7 +20,7 @@ export function fileExtension(item) {
 }
 
 export function linkLabel(item) {
-  return item.originalName || item.downloadName || 'file';
+  return item.downloadName || 'file';
 }
 
 export function buildLinkFormats(item) {