Edge antivirus cordon
Palace Guard
Palace Guard is Zipper’s antivirus at the gate. It looks at uploads and stored objects while they are still in flight: known malware hashes, EICAR, a Zipper canary, web-shell names, filename tricks, and ZIP headers without opening a bomb. Bad Gallery, Archives, Video, Site Hosting HTML, inbound mail, and function source is held. Quarantined hashes stay held when served. You can watch the scan on the dashboard. This is a Cloudflare edge file antivirus alternative included on every Zipper plan.
Cloudflare analogue: edge file antivirus
What it is
Palace Guard is Zipper’s antivirus at the gate. It looks at uploads and stored objects while they are still in flight: known malware hashes, EICAR, a Zipper canary, web-shell names, filename tricks, and ZIP headers without opening a bomb. Bad Gallery, Archives, Video, Site Hosting HTML, inbound mail, and function source is held. Quarantined hashes stay held when served. You can watch the scan on the dashboard.
Cloudflare analogue: edge file antivirus. SLA 99.95% · p99 28ms. Operators scan and quarantine. Admins publish cordon policy.
- ▸Cordon-before-disk ingest
- ▸Filename tricks + polyglots
- ▸SVG / PDF / GIF smuggle
- ▸Detonation-free ZIP headers
- ▸Animated live patrol
How it works
Palace Guard inspects an object while it is still in flight: a filename, SHA-256, declared MIME, and a leading sample. Nothing is detonated. ZIP members are read from local-file headers only.
Engines: public hash reputation (EICAR, WannaCry, NotPetya), the Zipper canary, web-shell names and bodies (PHP, ASPX, JSP, encoded PowerShell, UTF-16 PHP, gzinflate/rot13 obfuscation), filename tricks (RLO, NTFS ADS, double extensions, .htaccess), ransomware notes, MIME polyglots (PE/LNK/ZIP/ISO wearing image or video types), SVG/HTML/PDF smuggle, script miners, and OLE macros.
Live cordon is on by default. PUT to The Gallery, The Archives, or Video Delivery, Site Hosting HTML, inbound mail (subject and preview — not MIME attachments), and function source is scanned first. Hostile objects return 422 palace_guard_cordon and never persist. Quarantined SHA-256s stay held when Gallery, Archives, or Video serve. POST /api/v1/guard/scan returns the same verdict for CI and the dashboard radar.
Use cases
Concrete ways teams use this service on day one.
Stop an uploaded webshell
A CMS allows media uploads. An attacker posts c99.php as a “photo”.
- Leave live cordon and web-shell names on (default).
- The attacker POSTs c99.php to the CMS media folder. Gallery or Archives PUT runs enforceCordon before the object is written.
- Verdict is hostile. The API returns 422 palace_guard_cordon. Auto-quarantine stores the finding. Watchtower writes cordon.hostile.
Prove the scanner with EICAR
A security review asks for an antivirus self-test without live malware.
- Open Dashboard → Services → Palace Guard.
- Tap “EICAR test” or “Guard canary”. The radar turns hostile and the ledger stores the finding.
- Ship the same canary in CI: POST the PALACE-GUARD-STANDARD-ANTIVIRUS-TEST-OBJECT string and assert verdict=hostile.
Set it up in the dashboard
Dashboard → Services → Palace Guard.
Drop a file on the pad or tap a public sample (EICAR, SVG XSS, PDF JavaScript, GIF smuggle, RLO name). Review the ledger; quarantine or release.
Policy: keep live cordon, hash reputation, EICAR, header-only archives, and auto-quarantine on. Raise sensitivity to Paranoid during an incident.
API
Control-plane: GET|POST /api/v1/guard/scan. Send Authorization: Bearer tz_live_YOUR_TOKEN.
Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.
Scan a filename + hash
curl -sS -X POST https://tinyzipper.com/api/v1/guard/scan \
-H "Authorization: Bearer tz_live_YOUR_TOKEN" \
-H "Idempotency-Key: $(uuidgen)" \
-H "Content-Type: application/json" \
-d '{"name":"invoice.pdf.exe","sha256":"24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c"}'Scan the EICAR sentinel
const res = await fetch("https://tinyzipper.com/api/v1/guard/scan", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
"Content-Type": "application/json",
"Idempotency-Key": crypto.randomUUID()
},
body: JSON.stringify({ name: "eicar.com", content_b64: Buffer.from("X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*").toString("base64") })
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);List the same resource in JavaScript
const res = await fetch("https://tinyzipper.com/api/v1/guard/scan", {
method: "GET",
headers: {
Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
"Content-Type": "application/json"
}
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);Tips
Never send the whole file when a SHA-256 is enough for reputation. Samples are truncated and never stored.
Header-only ZIP inspection means zip bombs cannot detonate Palace Guard.
Turn live cordon off only if you must accept raw objects. Gallery, Archives, Video, Site Hosting HTML, inbound mail, and function source skip the ingest scan while it is off. Quarantined hashes still stay held on serve.
Git-built Site Hosting trees are not walked by Palace Guard. Paste-HTML on the site pad is scanned. Inbound mail has no MIME-attachment walk — only subject and preview.
Cloudflare has no analogue. Pair with The Keep for HTTP exploits and Palace Guard for objects.
- ▸SOC 2
- ▸OWASP ASVS
- ▸Detonation-free
Runbook
Leave live cordon on. Gallery, Archives, Video PUT, Site Hosting HTML, inbound mail, and function source are scanned before persist. Hostile uploads return 422. Quarantined hashes stay held on serve. Drop a file on the console to watch the patrol. Allowlist a SHA-256 for a known-good false positive. Purge a false origin copy via The Archives if one leaked before the cordon.
Next: The Cellar · All docs · Create a free account