> ## Documentation Index
> Fetch the complete documentation index at: https://docs.spurtcommerce.com/llms.txt
> Use this file to discover all available pages before exploring further.

# File uploading

The repository `.env.example` supports a configurable image server (`IMAGE_SERVER`) and includes AWS S3 settings. It also contains optional GCP storage variables. Confirm which storage adapters are actually enabled in the deployed release.

## Upload flow

A typical upload flow validates the request, checks authorization, verifies the file, stores it in the configured backend, and returns a reference/URL. Exact routes and multipart field names must be read from the upload controller and generated API docs.

## Security controls

* Allowlist file extensions and MIME types; inspect file signatures rather than trusting the client header.
* Enforce file size and image dimension limits.
* Generate server-side object names; do not use raw client filenames as storage paths.
* Store uploads outside executable application directories.
* Scan files where the risk profile requires it.
* Restrict bucket access and use short-lived signed URLs for private assets.
* Prevent path traversal and unauthorized overwrite/delete operations.

## Storage configuration

Keep cloud credentials in a secret manager or instance role where supported. Apply least-privilege bucket permissions, encryption, lifecycle rules, and backup/retention policies.

## Verify

Trace the upload controller, storage adapter, configuration loader, and tests. Document exact fields, accepted formats, maximum sizes, and response shape only after confirming the target version.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.