CypherScan for Strapi

Protect Strapi uploads before they reach production.

CypherScan securely scans every uploaded file using a presigned upload workflow and can automatically block suspicious or malicious files before they become available inside Strapi.

Features

• Secure presigned upload workflow
• Malware detection
• Secret detection
• Automatic malicious file blocking
• Configurable fail-open / fail-closed behavior
• Native Strapi integration
• Configurable request timeout
• Debug logging
• Lightweight plugin architecture

Requirements

• Strapi 5+
• Node.js 20+
• CypherScan API key

Installation

Install the plugin:

npm install strapi-plugin-cypherscan

Restart your Strapi application after installation.

Configuration

Configure your environment variables:

CYPHERSCAN_API_KEY=cs_xxxxxxxxxxxxxxxxx
CYPHERSCAN_BASE_URL=https://cyphernetsecurity.com

Restart Strapi after updating your environment.

How it works

When a file is uploaded:

1. The plugin requests a presigned upload URL from the CypherScan API.
2. The file is uploaded securely to temporary object storage.
3. CypherScan scans the uploaded object.
4. A scan verdict is returned.
5. Clean files remain available.
6. Suspicious or malicious files are automatically removed.

Architecture

User Upload
      │
      ▼
Strapi Upload Hook
      │
      ▼
Request Presigned Upload URL
      │
      ▼
Temporary Secure Upload
      │
      ▼
CypherScan Scan
      │
      ▼
Verdict
      │
      ├── Clean ─────► Upload allowed
      │
      └── Blocked ───► Upload removed

Example

Upload detected

        │

        ▼

Presigned Upload

        │

        ▼

CypherScan Scan

        │

        ▼

Verdict: Clean

        │

        ▼

File available inside Strapi

Fail Open / Fail Closed

CypherScan supports two operating modes.

Fail Open

Uploads continue if the scanning service is temporarily unavailable.

Recommended for development environments.

Fail Closed

Uploads are rejected when the scan cannot be completed.

Recommended for production environments requiring strict upload enforcement.

Debug Logging

When debug mode is enabled, the plugin logs:

• File name
• MIME type
• File size
• Presign request status
• Upload status
• Scan status
• Scan verdict
• Risk level
• Scan ID
• Upload decision

Tested

Validated with:

• Clean uploads
• Malware detection (EICAR)
• API unavailable (failOpen=true)
• API unavailable (failOpen=false)
• Automatic blocked file removal
• Strapi 5.x

CypherScan Agent

Strapi plugin scans use the canonical CypherScan API workflow:

1. POST /api/v1/upload/presign
2. Upload the file to the returned temporary URL
3. POST /api/v1/scan with the returned objectKey

The plugin sends a stable client identity:

x-cypherscan-client: strapi-plugin

With an active CypherScan Agent subscription, successful authenticated scans automatically become API_INTEGRATION Agent observations. No second Agent event call is required.

Agent can then use those observations for meaningful-change detection, bounded verification, Controller attention decisions, alerts, and activity history.

Roadmap

• Scan history
• Detailed scan reports
• Quarantine support
• Policy-based upload rules

License

MIT License

Copyright (c) 2026 CypherNet Security Inc.

See the LICENSE file for details.

Links

• Website: https://cyphernetsecurity.com
• Marketplace: https://market.strapi.io/plugins/strapi-plugin-cypherscan
• GitHub: https://github.com/cyphernetsecurity/cypherscan-strapi

Built by CypherNet Security Inc.