reflex-dev/reflex · error · SecurityReviewError

failed to upload app source for review

Error message

failed to upload app source for review

What it means

Raised when uploading the zipped app source to the presigned storage URL fails with an HTTP status error during security-review submission. The presigned PUT pinned a content length and type; any status failure aborts with this generic message.

Source

Thrown at packages/reflex-hosting-cli/src/reflex_cli/utils/hosting.py:2440

        urljoin(
            constants.Hosting.HOSTING_SERVICE,
            f"{_SECURITY_REVIEW_PREFIX}/jobs/upload-url",
        ),
        json={"content_length": len(zip_bytes), "content_type": "application/zip"},
        headers=auth,
        timeout=constants.Hosting.TIMEOUT,
    )
    try:
        upload_url_response.raise_for_status()
    except httpx.HTTPStatusError as ex:
        raise SecurityReviewError(_security_review_detail(ex.response)) from ex
    upload = upload_url_response.json()

    # 2. Upload the bytes to storage, under the length and type the URL pins.
    try:
        presigned_put(upload, zip_bytes, len(zip_bytes))
    except httpx.HTTPStatusError as ex:
        raise SecurityReviewError("failed to upload app source for review") from ex

    # 3. Submit the uploaded object for review.
    response = httpx.post(
        urljoin(constants.Hosting.HOSTING_SERVICE, f"{_SECURITY_REVIEW_PREFIX}/jobs"),
        json={"key": upload["key"]},
        headers=auth,
        timeout=constants.Hosting.TIMEOUT,
    )
    try:
        response.raise_for_status()
    except httpx.HTTPStatusError as ex:
        raise SecurityReviewError(_security_review_detail(ex.response)) from ex
    return response.json()["job_id"]


def get_security_review(job_id: str, client: AuthenticatedClient) -> dict[str, Any]:
    """Poll a previously submitted security review job.

View on GitHub (pinned to 45b8ed5ab7)

Solutions

1. Retry the scan — expired presigned URLs are transient
2. Update reflex-hosting-cli in case of upload contract changes
3. If persistent, check hosting service status

try:
    submit_security_review(...)
except SecurityReviewError as ex:
    if 'failed to upload app source for review' in str(ex):
        retry_scan_once()  # presigned URLs expire transiently

When it happens

Trigger: presigned_put(upload, zip_bytes, len(zip_bytes)) returns 4xx/5xx — e.g. URL expired, length/content-type mismatch, signature error.

Common situations: Delay between fetching the presigned URL and uploading until expiry; zip bytes mutated; storage service error.

Related errors

• could not upload the build to storage: HTTP {ex.response.sta
• could not upload the build: {ex}
• the upload did not finish before its window closed; this usu
• _security_review_detail(ex.response)
• @rx.event(background=True) is not supported for upload handl

AI-assisted analysis of reflex-dev/reflex@45b8ed5ab7 (2026-08-28). Data as JSON: /api/errors/8a1f371f56448940. Report an issue: GitHub.