Build on blocks
that already ran
in production.

Join our waitlist

THE CANVAS

The diagram is the deployment.

{{b.sub}}

Healthy {{b.meta}}

HOW IT WORKS

Request, approval, build, verify.

+ new request

request #4,182 · just now proposed

you

When a customer uploads a file, scan it before anyone can download it.

canvas

virus-scanner v7 Verified

Healthy 48 teams · 291,733 calls · 402 failures

approval before anything runs waiting on you

permissions — all of them

s3:GetObject sqs:SendMessage

outcomes — five declared

clean infected quarantined timeout oversize

seal — the code that was reviewed is the code that runs

sha256 : a9c42e81f5d30b67a2c95e40f1b83d76c4a2…

cost

$0.85 per 1k · fleet median $0.92

approve & build →

virus-scanner-v7 minutes later live · us-east-1

virus-scanner v7 on your canvas

Healthy first scans on the books

deploy 14.3s · clamav layer 180 MB

fears held all four fears pass

keys stay in your AWS account

OPEN ANY BLOCK

Every block has three tabs: evidence, code, fears.

virus-scanner v7 · Verified · lambda / x86 / 1024 MB running

teams in production48

calls on the books291,733

failures recorded402

fleet failure rate0.138%

cost per 1k calls$0.85 · fleet median $0.92

sealed commita9c42e81f5d30b67a2c95e40f1b83d76c4a2…

Every failure stays on the books. The record is the argument for installing it.

1export async function handler(event) {
2  const object = s3.stream(event.bucket, event.key);
F-01  const scan = await clamav.scan(object, { maxDepth: 8, maxExpansion: 100 });
F-02  if (scan.encrypted) return outcome("encrypted-archive");
F-03  if (definitions.ageHours() > 24) return outcome("definitions-stale");
6  return outcome(scan.clean ? "clean" : "infected");
7}

The code tab is the actual code. Lines that carry a documented fear are marked in the gutter.

F-01

Zip bombs

A 46 KB archive expanding to 4.5 PB takes any naive scanner down. Extraction stops at depth 8 and a 100-to-1 expansion ratio, and past either cap the verdict is scan-timeout instead of clean.

held on deploy · 42:1 expansion archive is refused at depth 3 · pass

F-02

Encrypted archives passing as clean

A scanner that cannot see inside a password-protected zip and says clean anyway is lying. Encrypted archives return their own outcome, and the policy call stays with you.

held on deploy · password-protected zip returns encrypted-archive, never clean · pass

F-03

Scanning against stale signatures

A clean verdict from three-day-old definitions is a different fact than one from fresh definitions. Definitions older than twenty-four hours withhold the verdict until the mirror refreshes.

held on deploy · 25 h old definitions withhold the verdict · pass

Every block ships with this tab filled in.

Runs in any cloud account you already have.

AWS · GCP · Azure

Deploys into the account, project, or subscription you already run.

Stripe · Twilio · SendGrid

Vendor blocks run on the contracts you already signed.

Nothing new

No new infrastructure. CloudBricks orchestrates what is there.

Join the waitlist.

We are onboarding teams in small batches.

Waitlist