Zero Trust API

Military-grade image sanitization API built in Rust/WASM

Visit Website
December 23, 2025 I spent 3 months researching why image sanitizers fail. Then I built a fix.

Hey IH! 👋

I want to share Zero Trust API — the first Content Disarm & Reconstruction (CDR) API for images.

The Problem I Solved:

Every app that accepts user-uploaded images is vulnerable. Most developers strip EXIF metadata and call it "sanitized."

But I discovered 3 attacks that survive this:

- 🎭 Steganography (hidden data in pixels)

- 🧬 Polyglot files (image + executable hybrid)

- 💣 Image bombs (crash your server)

My Solution:

Instead of trying to detect threats, I destroy the original file and rebuild from raw pixels. If it's not visible pixel data, it dies.

The Stack:

- Rust core (memory safety)

- WebAssembly sandbox (isolation)

- Cloudflare edge (global, fast)

Status:

- ✅ Live on RapidAPI

- ✅ Free tier: 100 requests/month

- ✅ Processing real traffic

What I'd love feedback on:

1. Is "Content Disarm & Reconstruction" too jargon-y?

2. Would you pay for this? At what price point?

3. What's missing from the value prop?

Link: Zero Trust App

Thanks for reading! 🙏

Comment

December 21, 2025 I built an image CDR API after discovering why metadata stripping isn't enough

Hey all,

I'm sharing Zero Trust API — the world's first Content Disarm & Reconstruction

API for images.

The problem I solved:

Most apps that accept user-uploaded images just strip EXIF metadata and call it

"sanitized." But sophisticated attacks survive:

- Steganographic payloads (data hidden in pixel values)

- Polyglot files (valid as both image AND executable)

- Image bombs (1x50000 pixel files that crash processors)

My approach:

Instead of trying to detect threats, I destroy the original file entirely and

rebuild a clean PNG from raw pixels. If it's not visible pixel data, it doesn't

survive.

Stack: Rust core → WebAssembly sandbox → Cloudflare Workers edge deployment

Would love feedback on the messaging — is "Content Disarm & Reconstruction"

clear or too jargon-y?

Comment

About

After 3 months researching image attacks, I found every "sanitizer" was broken. Metadata stripping doesn't stop steganography. Magic bytes don't stop polyglots. Size limits don't stop image bombs.