The infected upload never lands on disk

Your product takes user uploads straight into hoody-files. One hook on the files service, matched to PUT on the upload paths: the body runs through a scanner before it's forwarded. Clean files pass untouched. A flagged file gets a 422 and never reaches the write: there's no quarantine folder to sweep, because the malware was rejected in transit.

The app has no scanning code. New upload endpoints inherit the gate by matching the path. When the scanner needs updating, you redeploy one script; the product doesn't ship.

Upload security usually means a background job racing the download link. Here the check sits in front of the filesystem, not behind it.