docs/SECURITY.md

# Security Notes

## Access keys

`MINIO_ROOT_USER` and `MINIO_ROOT_PASSWORD` are equivalent to S3 Access Key and Secret Key.

Do not commit real keys into GitHub.

Configure them as Hugging Face Space Secrets.

## Public bucket

`PUBLIC_BUCKET=1` makes the default bucket anonymously readable. This is convenient for image hosting, but anyone with the object URL can read the file.

For private user files, set:

```bash
PUBLIC_BUCKET=0
```

Then proxy downloads through your application backend, or generate temporary signed URLs.

## Recommended usage

This repository is designed for backup, emergency overflow, and MVP object storage. It is not a substitute for a highly available production object storage service.

## Backup strategy

Keep at least one additional backup outside the Hugging Face Space persistent volume.

Suggested minimum:

```text
Tencent COS -> HF MinIO
HF MinIO -> local archive or another object storage
```