From 49665210885c7fa1395fb4dee0f41105f775b24f Mon Sep 17 00:00:00 2001
From: Luis Rodriguez <luisangelrod17@gmail.com>
Date: Wed, 24 Jun 2026 20:22:52 +0000
Subject: [PATCH] docs: use crypto.randomBytes in DiskStorage filename example

---
 README.md | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index ed2a4e6d..64416ecc 100644
--- a/README.md
+++ b/README.md
@@ -207,13 +207,20 @@ where you are handling the uploaded files.
 The disk storage engine gives you full control on storing files to disk.
 
 ```javascript
+const crypto = require('crypto')
+
 const storage = multer.diskStorage({
   destination: function (req, file, cb) {
     cb(null, '/tmp/my-uploads')
   },
   filename: function (req, file, cb) {
-    const uniqueSuffix = Date.now() + '-' + Math.round(Math.random() * 1E9)
-    cb(null, file.fieldname + '-' + uniqueSuffix)
+    // Use crypto.randomBytes for a cryptographically secure unique name.
+    // Math.random() is NOT cryptographically secure and should be avoided
+    // for filenames in web-accessible upload directories.
+    crypto.randomBytes(16, function (err, raw) {
+      if (err) return cb(err)
+      cb(null, file.fieldname + '-' + raw.toString('hex'))
+    })
   }
 })