Reference

Good to know #

• Hosted files are public. Anyone with the URL can view them, even media attached to private repositories. Don't upload secrets or sensitive UI.
• The visibility toggle unlists — it doesn't lock down bytes. Marking a file "private" hides it from your workspace's public file listing and gates the/f/… page behind sign-in. The raw file URL (storage.uploads.sh/…) keeps serving the same bytes to anyone who already has it, and edge caches can keep serving recently-public bytes for a short window after the toggle. Treat it as "unlisted," not "private." True byte-level privacy would require a workspace with no public domain (signed URLs only), which isn't how uploads.sh workspaces work today.
• Share pages support embeds. Every public file and gallery has a page at /f/… or /g/… withoEmbed discovery, so tools that unfurl links can show the media. The endpoint isGET /oembed?url=<page-url>&format=json.
• Access is by invitation. There's no self-serve signup right now. If you'd like in, reach out via the GitHub repo.
• Everything lands in your workspace. Files are stored under a prefix for your workspace, and PR/issue attachments get stable, predictable paths, so re-attaching an updated screenshot replaces the old URL's spot instead of littering.
• Still early. uploads.sh is built in the open and APIs may change without notice. Don't depend on it for anything you can't afford to re-key.