docs/SECURITY.md

Security Notes

Access keys

MINIO_ROOT_USER and MINIO_ROOT_PASSWORD are equivalent to S3 Access Key and Secret Key.

Do not commit real keys into GitHub.

Configure them as Hugging Face Space Secrets.

Public bucket

PUBLIC_BUCKET=1 makes the default bucket anonymously readable. This is convenient for image hosting, but anyone with the object URL can read the file.

For private user files, set:

PUBLIC_BUCKET=0

Then proxy downloads through your application backend, or generate temporary signed URLs.

Recommended usage

This repository is designed for backup, emergency overflow, and MVP object storage. It is not a substitute for a highly available production object storage service.

Backup strategy

Keep at least one additional backup outside the Hugging Face Space persistent volume.

Suggested minimum:

Tencent COS -> HF MinIO
HF MinIO -> local archive or another object storage