Never hardcode /tmp/myapp.tmp

mktemp creates unique files safely. Write to temp, then mv atomically to final destination. Trap cleanup on exit.

Security: Predictable temp paths enable symlink attacks — mktemp exists for a reason.