Storage

Surplus uses S3-compatible object storage for user-visible uploads (profile images, attachments, partner assets, …). Buckets and prefixes are configured in the server environment and injected into services that wrap the AWS SDK v3 client.

Client access

The browser does not receive long-lived cloud credentials. Upload flows go through signed URLs or server-mediated upload endpoints owned by apps/server and packages/services.

Local development

Use whatever your team documents for MinIO, LocalStack, or dev buckets. Keep secrets out of git; mirror production ACL patterns when testing permissions.

Related packages

Implementation details live alongside the storage helpers in packages/services and the server routes under apps/server/src/routes/files/.