I built a Strapi plugin to scan uploads — early signals from real usage
I kept running into the same issue with file uploads.
Files pass validation… but break later in production.
The idea came from a recurring pattern:
files pass basic checks (size, mime-type), but issues show up later when they’re actually used in production.
So I moved the check earlier:
upload → scan → verdict
Right now it returns:
- verdict (clean / suspicious / malicious)
- risk level
- score
- traceId
- findings
- summary
Early signals so far:
~120 downloads day 1
real scans happening outside local testing
dev feedback from Reddit + Indie Hackers
Still early, but interesting to see real usage vs just local testing.
Quick demo (15s):
👉 https://youtu.be/LmmMnfcR-CA
Curious how you're handling upload validation today — especially in production, not just at upload time.
Really solid problem to tackle - the passes validation but breaks in production gap is so common and usually invisible until something actually fails. Are you only catching this at upload time, or do you also track things post-deploy? Curious how you're thinking about ongoing monitoring once the file's already live in production.
Great question — this is actually the direction I ended up taking it.
The original Strapi plugin was focused on catching issues at upload time, but I've since been building a continuous monitoring layer into CypherScan as well.
The idea is that the initial scan becomes a baseline, then CypherScan Agent can keep observing monitored assets and detect meaningful security changes after deployment instead of treating the upload verdict as the end of the lifecycle.
I'm starting with integrations like WordPress and expanding the same model to other sources over time.
So basically: upload-time scanning catches the initial risk, while the Agent is meant to handle what changes afterward.
That makes a lot of sense. I like the idea of treating the upload scan as a baseline, not a one-time check. As you expand beyond WordPress, are you mainly looking at other CMS platforms, or also broader production environments?
Since the original Strapi integration, I've actually expanded CypherScan to several other CMS platforms, including WordPress, Ghost, Payload and Directus.
CMS integrations are still an important part of the roadmap, and I'll likely continue adding more over time.
But I'm also interested in taking the Agent model beyond CMS platforms eventually. The broader idea is continuous monitoring of production assets rather than limiting CypherScan to a specific type of platform.
Are there any other CMS platforms or production environments you'd personally like to see supported?
I’d be interested in seeing support for Shopify and Webflow, especially since both are widely used for managing production content and assets. It would also be interesting to see how the Agent model works in broader environments beyond CMS platforms.
Those are great suggestions. I’m actually going to prioritize Shopify and Webflow as the first two integrations in my next plugin expansion.
I think both are a natural fit for the Agent model, and your feedback helped confirm that direction.
Since you mentioned being interested in seeing how the Agent works, I recently published a public demo of CypherScan Agent. Here it is if you'd like to take a look:
https://youtu.be/UZo5MauNnvQ?si=ytTmWR9PLbkATo3m
I’d be really interested to hear what you think, especially from the perspective of using this model with Shopify, Webflow, or broader production environments.
Thanks again for the feedback!