cypherscan payload

CypherScan for Payload

Protect Payload uploads before they reach production.

CypherScan securely scans every uploaded file using a presigned upload workflow and can automatically block suspicious or malicious files before they become available inside Payload CMS.

---

Features

• Secure presigned upload workflow
• Malware detection
• Secret detection
• Automatic malicious file blocking
• Configurable fail-open / fail-closed behavior
• Native Payload CMS integration
• Collection targeting

---

Requirements

• Payload CMS 3+
• Node.js 20+
• CypherScan API key

---

Installation

Install the plugin:

npm install cypherscan-payload

---

Configuration

Configure the plugin inside your Payload configuration:

import { cypherScanPayload } from "cypherscan-payload";

export default buildConfig({
  plugins: [
    cypherScanPayload({
      apiKey: process.env.CYPHERSCAN_API_KEY!,
      apiUrl: "https://cyphernetsecurity.com",
      failOpen: true,
    }),
  ],
});

---

Options

Option	Description
apiKey	CypherScan API key
apiUrl	CypherScan API base URL
collections	Restrict scanning to specific upload collections
blockVerdicts	Verdicts that should block uploads
failOpen	Enable Fail Open mode

---

How it works

When a file is uploaded:

1. The plugin requests a presigned upload URL from the CypherScan API.
2. The file is uploaded securely to temporary object storage.
3. CypherScan scans the uploaded object.
4. A scan verdict is returned.
5. Clean files remain available.
6. Suspicious or malicious files are automatically blocked.

---

Architecture

User Upload
      │
      ▼
Payload Upload Hook
      │
      ▼
Request Presigned Upload URL
      │
      ▼
Temporary Secure Upload
      │
      ▼
CypherScan Scan
      │
      ▼
Verdict
      │
      ├── Clean ─────► Upload allowed
      │
      └── Blocked ───► Upload rejected

---

Example

Upload detected

        │

        ▼

Presigned Upload

        │

        ▼

CypherScan Scan

        │

        ▼

Verdict: Clean

        │

        ▼

File available inside Payload CMS

---

Fail Open / Fail Closed

CypherScan supports two operating modes.

Fail Open

Uploads continue if the scanning service is temporarily unavailable.

Recommended for development environments.

Fail Closed

Uploads are rejected when the scan cannot be completed.

Recommended for production environments requiring strict upload enforcement.

---

Logging

The plugin logs scan activity through the Payload logger.

---

Tested

Validated with:

• Clean uploads
• Malware detection (EICAR)
• API unavailable (failOpen=true)
• API unavailable (failOpen=false)
• Collection targeting
• Payload CMS 3.x

---

CypherScan Agent

Payload plugin scans use the canonical CypherScan API workflow:

1. POST /api/v1/upload/presign
2. Upload the file to the returned temporary URL
3. POST /api/v1/scan with the returned objectKey

The plugin sends a stable client identity:

x-cypherscan-client: payload-plugin

With an active CypherScan Agent subscription, successful authenticated scans automatically become API_INTEGRATION Agent observations. No second Agent event call is required for normal Payload plugin scans.

Agent can then use those observations for meaningful-change detection, bounded verification, Controller attention decisions, alerts, and activity history.

---

Roadmap

• Scan history
• Detailed scan reports
• Quarantine support
• Policy-based upload rules

---

License

MIT License

Copyright (c) 2026 CypherNet Security Inc.

See the LICENSE file for details.

---

Links

• Website: https://cyphernetsecurity.com
• GitHub: https://github.com/cyphernetsecurity/cypherscan-payload

Built by CypherNet Security Inc.