Skip to main content
The repository .env.example supports a configurable image server (IMAGE_SERVER) and includes AWS S3 settings. It also contains optional GCP storage variables. Confirm which storage adapters are actually enabled in the deployed release.

Upload flow

A typical upload flow validates the request, checks authorization, verifies the file, stores it in the configured backend, and returns a reference/URL. Exact routes and multipart field names must be read from the upload controller and generated API docs.

Security controls

  • Allowlist file extensions and MIME types; inspect file signatures rather than trusting the client header.
  • Enforce file size and image dimension limits.
  • Generate server-side object names; do not use raw client filenames as storage paths.
  • Store uploads outside executable application directories.
  • Scan files where the risk profile requires it.
  • Restrict bucket access and use short-lived signed URLs for private assets.
  • Prevent path traversal and unauthorized overwrite/delete operations.

Storage configuration

Keep cloud credentials in a secret manager or instance role where supported. Apply least-privilege bucket permissions, encryption, lifecycle rules, and backup/retention policies.

Verify

Trace the upload controller, storage adapter, configuration loader, and tests. Document exact fields, accepted formats, maximum sizes, and response shape only after confirming the target version.