Launched this week
ZeroSieve
Malware scanning for every file your users upload 🛡️
5 followers
Malware scanning for every file your users upload 🛡️
5 followers
Your users upload files. Some carry malware. ZeroSieve scans every file before you trust it: POST its link, get clean, infected or error back in seconds via signed webhook. No storage credentials shared, files never kept. Free to start, no card.
Free Options
Launch Team / Built With
Render Sandboxes: a computer for every agentRun untrusted code safely. Idle sandboxes cost nothing
Promoted
Hey Product Hunt 👋 I'm Dru, and I built ZeroSieve.
Every app I've worked on that accepts user uploads eventually hits the same question: what if someone uploads something nasty, and we store it, serve it, or forward it to another user? The usual answer is running malware scanners, workers, a queue, signature updates, and keeping all of it alive. That's a side project nobody signed up for.
ZeroSieve is that pipeline as an API, it's what i personally needed and couldn't find.
When an upload lands, you POST its presigned S3 URL. A worker fetches the object, scans it and deletes the temporary copy, and you get clean / infected / error back on a signed webhook within seconds.
No S3 keys or cloud logins are ever shared, just a link, and we never keep your files.
Not on S3? Any file link works, as long as its domain is verified with the same token-file check.
"Why not just use VirusTotal?" VirusTotal is great for investigating one suspicious file. It isn't built to sit inside your upload flow: its free public API allows 4 requests a minute and 500 a day, it "must not be used in commercial products or services", and on the standard service the files you submit may be shared with its premium customers. That's not where your users' invoices and ID scans should go.
ZeroSieve is the private, production version of that check.
Files are scanned, then deleted, and nobody else ever sees them.
"Why not just use AWS GuardDuty?" Because it would vendor-lock you into AWS, and while many other S3-compatible providers exist, almost none have S3 malware scans. You can instead use ZeroSieve with any S3 provider out there.
Things I cared about:
• Scans only run against hosts you've proven you own, and verdicts only go to webhook URLs you've verified.
• Every webhook is HMAC-SHA256 signed.
• It's free to start, with no card required.
The free plan gets the entire pipeline: API, webhooks and dashboard. Paid plans add volume, not features.
This is day one, and the roadmap is open.
Tell me what you'd need to drop this into your stack, such as a specific storage provider, an SDK, or a different way to get results. Let's discuss it here and I'll build it.
I'd love your feedback, especially if you've solved "scan what users upload" before, whether you rolled your own or skipped it.
What would make this a no-brainer to drop into your upload flow?