X_STORAGE_SECRET_DEV
Means
upload grants would be signed with the shipped development key
Typical cause
STORAGE_SIGNING_SECRET is unset or holds the constant published in @ultimat3/storage, in a non-local environment — anyone can then mint a PUT grant offline with a maxBytes and contentType of their choosing, and the signed constraints outrank the app's uploadPolicy. Reported by x doctor; the local disk driver also refuses to construct
Fix
export STORAGE_SIGNING_SECRET="$(openssl rand -hex 32)"