Op here. The urls are randomly generated combined with the chosen filename, I assume this should be safe enough. Links will expire in 2 weeks. Working on functionality where you can configure the lifetime. Eg, just 1 download or 2 days.