**Read the exact preset name in the request.** Log the preset value the client sends, without logging any secret. Expected: you can compare it character by character with the console.

**Find the preset in the same cloud.** Open the Cloudinary console for the cloud name the app actually uses and list upload presets. Success check: a preset with that exact name exists there, including case and underscores.

**Check the preset mode.** Open the preset settings and confirm signing mode is unsigned for unsigned browser uploads. Expected: unsigned mode is shown; a signed preset will not serve an unsigned request the same way.

**Fix the client values together.** Set the cloud name and preset name as a pair from the same account, in the environment the failing build uses. Success check: staging and production do not mix a preset from one cloud with the cloud name of another.

**Retest with a small file.** Upload one small image through the same form. Expected: the upload returns 200 with a public id and secure url.

**Check for a renamed or deleted preset in deploys.** If it worked before, compare the preset value in the last working release. Success check: the change point matches when the error started.