### High — Background work inherits a request context that is canceled immediately

Relevant expression: `go s.runExport(r.Context(), id, req)`

`net/http` cancels `r.Context()` when the handler returns. After the `202 Accepted` response is written, ongoing downloads are canceled and later `http.DefaultClient.Do` calls receive an already-canceled context. The loop ignores those errors and ultimately records the export as `"done"`, producing an empty or partial file while reporting success.

### High — Unsynchronized access to `jobs` can crash the server

Relevant expressions: `var jobs = map[string]string{}`, `jobs[id] = ...`, and `status, ok := jobs[id]`

Request handlers and export goroutines access the same map concurrently without synchronization. A status request can read while a job writes, or multiple jobs can write simultaneously, causing data races and potentially a fatal `concurrent map read and map write` or `concurrent map writes` runtime panic.

### Medium — Second-resolution IDs merge distinct exports

Relevant expression: `id := strconv.FormatInt(time.Now().Unix(), 10)`

Any exports created during the same second receive the same ID. Their status updates overwrite the same `jobs` entry, so one export can report `"done"` or `"failed"` based on the other job, and clients cannot independently track the requests.

### High — Concurrent exports can corrupt the same output file

Relevant expressions: `path := filepath.Join(s.exportDir, req.Name)` and `out, err := os.Create(path)`

`req.Name` is shared client-controlled naming with no uniqueness or locking. Two requests using the same name run concurrently; each calls `os.Create`, truncating the shared file, then both file descriptors write independently. Their downloads can overwrite one another or leave a mixed, truncated artifact even though both jobs report `"done"`.

### Medium — Response bodies accumulate for the full job lifetime

Relevant expression: `defer resp.Body.Close()` inside the URL loop

Each successful download defers closing its response body until the entire export finishes. A request containing many URLs therefore retains many response bodies and associated resources concurrently, which can exhaust file descriptors or connection capacity and make later downloads fail.