Palace Guard

What it is

Palace Guard is Zipper’s edge antivirus. It inspects uploads, attachments, and stored objects while they are still bytes in motion: public malware hashes, the EICAR sentinel, a Zipper canary, web-shell names, ransomware notes, MIME polyglots, and ZIP headers without ever inflating a bomb. Hostile objects are quarantined at the gate. The patrol is animated so operators watch the scan in real time.

Cloudflare analogue: edge file antivirus. SLA 99.95% · p99 28ms. Operators scan and quarantine. Admins publish cordon policy.

• ▸Cordon-before-disk
• ▸Public hash reputation
• ▸Detonation-free ZIP headers
• ▸Animated live patrol

How it works

Palace Guard inspects an object while it is still in flight: a filename, SHA-256, declared MIME, and an optional leading sample. Nothing is detonated. ZIP members are read from local-file headers only.

Engines: public hash reputation (EICAR, WannaCry, NotPetya), the Zipper canary, web-shell names, double extensions, ransomware notes, MIME polyglots (PE wearing image/*), script miners, and PHP eval signatures.

POST /api/v1/guard/scan returns verdict, family, confidence, and action. Auto-quarantine holds hostile objects so The Archives, Gallery, Video, and Emails never persist them. Live results animate the patrol in the dashboard.

Use cases

Concrete ways teams use this service on day one.

Set it up in the dashboard

Dashboard → Services → Palace Guard.

Watch the animated cordon. Scan a file or a public intrusion sample. Review the ledger; quarantine or release.

Policy: keep hash reputation, EICAR, header-only archives, and auto-quarantine on. Raise sensitivity to Paranoid during an incident.

API

Control-plane: GET|POST /api/v1/guard/scan. Send Authorization: Bearer tz_live_YOUR_TOKEN.

Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.

curl -sS -X POST https://tinyzipper.com/api/v1/guard/scan \
  -H "Authorization: Bearer tz_live_YOUR_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"name":"invoice.pdf.exe","sha256":"24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c"}'

const res = await fetch("https://tinyzipper.com/api/v1/guard/scan", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
    "Content-Type": "application/json",
    "Idempotency-Key": crypto.randomUUID()
  },
  body: JSON.stringify({ name: "eicar.com", content_b64: Buffer.from("X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*").toString("base64") })
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);

const res = await fetch("https://tinyzipper.com/api/v1/guard/scan", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
    "Content-Type": "application/json"
  }
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);

Tips

Never send the whole file when a SHA-256 is enough for reputation. Samples are truncated and never stored.

Header-only ZIP inspection means zip bombs cannot detonate Palace Guard.

Cloudflare has no analogue. Pair with The Keep for HTTP exploits and Palace Guard for objects.

• ▸SOC 2
• ▸OWASP ASVS
• ▸Detonation-free

Runbook

Leave live cordon and hash reputation on. Scan a file from the console to watch the patrol. Auto-quarantine hostile verdicts. Purge a false origin copy via The Archives if one leaked before the cordon.