I would argue for /tmp on Debian, but I don't know if you want to go that fine-grained. Does MLton do the create/unlink before writing? If so then the window for leaving the file around is pretty small. (The point being both security and cleanliness.)