Formats

ZIPs are the most common way to ship code and the most abused way to ship malware. Decoder ingests a ZIP server-side with hardened guards and exposes its content for review.

PowerShell is the workhorse of Windows post-exploitation. Decoder reads `.ps1` files statically and surfaces the patterns attackers rely on: encoded commands, `Invoke-Expression`, download cradles, AMSI bypasses.

Python is a first-class format in Decoder. Upload a single .py, a ZIP, or import a GitHub repo and get static + malware findings.

JavaScript and TypeScript are first-class in Decoder. Upload single files, ZIPs, or import a GitHub repo.

Java is supported as a first-class format. Rules cover the common enterprise weakness classes mapped to CWE.

Dockerfiles are configuration that becomes runtime. Decoder flags the common foot-guns before they hit your registry.