Validiti Janus — Threat Signature Feeds

Publish and share known-bad signatures so any Janus can recognize a threat without anyone ever handling the dangerous file.

A feed carries signatures only — never payloads, never malware. Janus turns an arriving file into a signature and checks it against the feeds you subscribe to. Because only the signature moves, dangerous code can be recognized, compared, and blocked across parties without the malware or your file ever changing hands. And a changed variant is still caught where an exact-copy blocklist would miss it.

What's here

feeds/     published signature feeds — signatures only, signed   ← this is what you share
.github/workflows/validate-feeds.yml   CI: verifies every feed is signatures-only + signed

Feed format (feeds/*.json)

{
  "feed_id": "community-acme-labs",
  "publisher": "Acme Threat Labs",
  "title": "Acme community feed",
  "version": "2026.07.28",
  "format": "validiti-signature-feed/1",
  "families": [
    { "name": "Banking trojan", "family": "banker", "severity": "critical", "sig": [ /* opaque signature */ ] }
  ],
  "feed_sig": "…"
}

• sig is an opaque, one-way signature — you cannot reconstruct the sample from it.
• No sample or payload ever ships in a feed. Only signatures are published.
• feed_sig lets a subscriber verify the feed is intact and from the stated publisher.

Publish a feed

Build your feed with the Validiti feed tool (sealed), which derives the signatures from your samples and signs the result. Commit only feeds/ — never samples. Tag a release, or share the raw feed URL. CI verifies every feed is signatures-only.

Subscribe (from Janus)

Point Janus at a feed's raw URL, or drop the file in its feeds directory. Janus verifies the feed signature, adds its families, and immediately starts matching arrivals against them — the payload never moves.

Safety

• Feeds are signatures only — safe to host publicly; they contain no malware.
• The example feeds here are derived from synthetic, inert samples (harmless stand-ins).
• This is threat-intelligence sharing done safely: the dangerous file never changes hands.

→ Built on Validiti Janus · validiti.com