# X_STORAGE_SECRET_DEV

## Means

upload grants would be signed with the shipped development key

## Typical cause

`STORAGE_SIGNING_SECRET` is unset or holds the constant published in `@ultimat3/storage`, in a non-local environment — anyone can then mint a `PUT` grant offline with a `maxBytes` and `contentType` of their choosing, and the signed constraints outrank the app's `uploadPolicy`. Reported by `x doctor`; the local disk driver also refuses to construct

## Fix

`export STORAGE_SIGNING_SECRET="$(openssl rand -hex 32)"`

[Storage](/error-codes#storage)