reflex-dev/reflex · error · SecurityReviewError

_security_review_detail(ex.response)

Error message

_security_review_detail(ex.response)

What it means

Raised when the initial request for a presigned upload URL during security-review submission returns an HTTP error status. The server-provided detail (parsed by _security_review_detail) is surfaced inside SecurityReviewError.

Source

Thrown at packages/reflex-hosting-cli/src/reflex_cli/utils/hosting.py:2433

    if not isinstance(client, AuthenticatedClient):
        raise NotAuthenticatedError("not authenticated")

    auth = authorization_header(client.token)

    # 1. Ask the API for a presigned URL to upload the archive directly.
    upload_url_response = httpx.post(
        urljoin(
            constants.Hosting.HOSTING_SERVICE,
            f"{_SECURITY_REVIEW_PREFIX}/jobs/upload-url",
        ),
        json={"content_length": len(zip_bytes), "content_type": "application/zip"},
        headers=auth,
        timeout=constants.Hosting.TIMEOUT,
    )
    try:
        upload_url_response.raise_for_status()
    except httpx.HTTPStatusError as ex:
        raise SecurityReviewError(_security_review_detail(ex.response)) from ex
    upload = upload_url_response.json()

    # 2. Upload the bytes to storage, under the length and type the URL pins.
    try:
        presigned_put(upload, zip_bytes, len(zip_bytes))
    except httpx.HTTPStatusError as ex:
        raise SecurityReviewError("failed to upload app source for review") from ex

    # 3. Submit the uploaded object for review.
    response = httpx.post(
        urljoin(constants.Hosting.HOSTING_SERVICE, f"{_SECURITY_REVIEW_PREFIX}/jobs"),
        json={"key": upload["key"]},
        headers=auth,
        timeout=constants.Hosting.TIMEOUT,
    )
    try:
        response.raise_for_status()
    except httpx.HTTPStatusError as ex:

View on GitHub (pinned to 45b8ed5ab7)

Solutions

1. Inspect the detail text in the message to identify the status code and act (re-login for 401/403)
2. Confirm the app exists via `reflex app list`
3. Wait and retry if rate-limited (429) or during a 5xx incident
4. Update reflex-hosting-cli

try:
    submit_security_review(...)
except SecurityReviewError as ex:
    detail = str(ex)
    if '401' in detail or '403' in detail:
        relogin_and_retry()
    elif '429' in detail:
        sleep_and_retry()

When it happens

Trigger: The POST requesting the presigned URL fails raise_for_status: e.g. 401/403 (bad token despite client type), 404 (app not found), 429 (rate limit), 5xx.

Common situations: Expired/revoked token; app_id not registered; rate-limited repeated scans; hosting service incident.

Related errors

• _response_detail(ex.response, f"HTTP {ex.response.status_cod
• could not reach the deployment service: {ex}
• could not upload the build to storage: HTTP {ex.response.sta
• failed to upload app source for review
• @rx.event(background=True) is not supported for upload handl

AI-assisted analysis of reflex-dev/reflex@45b8ed5ab7 (2026-08-28). Data as JSON: /api/errors/01dd396b65da653c. Report an issue: GitHub.