A file arrives at your door; a threat lab knows what’s bad. They match by signature — the dangerous file never changes hands, and neither does the malware. Bring any threat feed you trust (published, signed, versioned), and a signature still catches a threat even when it’s been changed to slip past a checklist. Live.
Tip: try the amber preset with only the base feed — it comes back clear. Then subscribe to the community feed and check it again.
← Or seal & prove a document at the door — the custody demo
A live demonstration. The “known-bad” samples are synthetic and inert — harmless stand-ins used only to derive signatures; nothing is ever run. Feeds carry signatures only, never code, and are signed and verified so you can trust who published them; your door turns an arrival into a signature and checks it against the feeds you subscribe to, so the dangerous file and the malware never move. Matching is by shape, so variants are caught where an exact-copy checklist would miss them. Bring your own feed — including open community feeds published and versioned like any other code. Not for distribution.