aikido-zen 1.7.2.beta.2 → 1.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aedfb64ca08c10194c0483138460f984e086ad2ac95250d3ce570b4c08b48263
-  data.tar.gz: 6332c4155469c35483394a76683169e973feea9ba417fb4c4f434f8df3231b2e
+  metadata.gz: c01eda1d0ea486bf41d00d6efc05f064ad13b3ae71e112af02b1c01e3d164592
+  data.tar.gz: 222be5ac12985a6f855335a3433d32632704d6ebb1c0f7249fe9bb85492554f2
 SHA512:
-  metadata.gz: 97a1b03ca7b5b92d944793c650f11791f7a36794e5ebcc85c6c41e6a93f71c1fbab3a5e32f0beeae6254c89ea06f23535275f20cc3732f18c8db722e4b6ec482
-  data.tar.gz: 35ba0d4afe57aba7dac30c89294a875779fba9f36413c1c335d97efb62a47b5d3beaa8c5b96d31a9dda491d89b2dd0a78851a4d5ca83dd34071732c981d92b56
+  metadata.gz: 4645441dc4301bccc6c09347f864149b071f9cdcd16811309dd7a7e9650848ff90a559ebc576338e7bc8bc41fc3f4d4c2deaa096112628da02bf71619e69ad77
+  data.tar.gz: 8e7e3717a0a38dcb0d0c38abaf2142569404917f0fff5da720fcd4d180eebb27799d7b836a5222389a33a1a963e431f2459fe2299ab1d6e0c85234b615ce997d

data/docs/request-bypassing.md

@@ -0,0 +1,50 @@
+# Bypass Zen for a specific request
+
+Call `Aikido::Zen.request_bypassed!` from a Rack middleware to bypass Zen for this request. A bypassed request is fully excluded from Zen inspection and enforcement: Zen will not analyze the request, generate findings, or apply blocking rules for that traffic. Your application handles the request normally.
+
+> [!NOTE]
+> Zen's built-in [Bypassed IPs](https://help.aikido.dev/zen-firewall/zen-features/bypassed-ips) feature uses request bypassing internally, triggered by a matching IP/CIDR. `Aikido::Zen.request_bypassed!` lets you bypass requests using your custom logic.
+
+## What gets bypassed
+
+* **Attack protection** — SQL injection, path traversal, command injection, and SSRF attacks are not blocked or reported
+* **Rate limiting** — never triggered.
+* **IP blocking** — Known Threat Actors, Tor traffic blocking/monitoring, country blocking, and custom IP allow/block lists are not checked.
+* **Bot traffic blocking** — not checked.
+* **User blocking** — blocked users are not blocked.
+* **Statistics** — the request isn't counted, and doesn't count against your monitored request quota.
+* **Attack wave protection** — the request doesn't count towards wave detection.
+
+## Usage
+
+Insert your middleware directly after `Aikido::Zen::Middleware::ContextSetter`, so it runs after the request context is set up but before Zen's other middleware:
+
+```ruby
+# config/application.rb
+class RequestBypasser
+  def initialize(app)
+    @app = app
+  end
+
+  def call(env)
+    if your_custom_logic?(env)
+      Aikido::Zen.request_bypassed! # Bypasses Zen for this request
+    end
+
+    @app.call(env)
+  end
+end
+
+module YourApp
+  class Application < Rails::Application
+    # ...
+
+    initializer "your_app.insert_request_bypasser", after: "aikido.add_middleware" do |app|
+      app.middleware.insert_after Aikido::Zen::Middleware::ContextSetter, RequestBypasser
+    end
+  end
+end
+```
+
+> [!WARNING]
+> A bypassed request gets zero protection from Zen — no attack detection, no rate limiting, no blocking, no tracking. Ensure that your custom logic only bypasses requests that you fully trust.

data/lib/aikido/zen/agent.rb

@@ -220,6 +220,8 @@ module Aikido::Zen
       updated_at = Time.at(event[:data]["configUpdatedAt"].to_i)
 
       if should_fetch_settings?(updated_at)
+        return if realtime_settings_updates_too_fast?
+
         if update_settings_from_runtime_config!(@api_client.fetch_runtime_config, reason: "after server-sent event")
           updated_settings!
 
@@ -239,6 +241,19 @@ module Aikido::Zen
       updated_at > last_updated_at
     end
 
+    def realtime_settings_updates_too_fast?
+      now = Process.clock_gettime(Process::CLOCK_MONOTONIC, :millisecond)
+
+      last_updated_at = @realtime_settings_updates_last_updated_at
+      if last_updated_at && now - last_updated_at < @config.realtime_settings_updates_min_time_between_events
+        return true
+      end
+
+      @realtime_settings_updates_last_updated_at = now
+
+      false
+    end
+
     def heartbeats
       @heartbeats ||= Aikido::Zen::Agent::HeartbeatsManager.new(
         config: @config,

data/lib/aikido/zen/collector/event.rb

@@ -157,14 +157,16 @@ module Aikido::Zen
         def self.from_json(data)
           new(
             data["sink_name"],
+            data["sink_kind"],
             data["duration"],
             has_errors: data["has_errors"]
           )
         end
 
-        def initialize(sink_name, duration, has_errors:)
+        def initialize(sink_name, sink_kind, duration, has_errors:)
           super()
           @sink_name = sink_name
+          @sink_kind = sink_kind
           @duration = duration
           @has_errors = has_errors
         end
@@ -172,17 +174,18 @@ module Aikido::Zen
         def as_json
           super.update({
             "sink_name" => @sink_name,
+            "sink_kind" => @sink_kind,
             "duration" => @duration,
             "has_errors" => @has_errors
           })
         end
 
         def handle(collector)
-          collector.handle_track_scan(@sink_name, @duration, has_errors: @has_errors)
+          collector.handle_track_scan(@sink_name, @sink_kind, @duration, has_errors: @has_errors)
         end
 
         def inspect
-          "#<#{self.class.name} #{@sink_name} #{format "%0.6f", @duration} #{@has_errors}>"
+          "#<#{self.class.name} #{@sink_name} #{@sink_kind} #{format "%0.6f", @duration} #{@has_errors}>"
         end
       end
 
@@ -192,29 +195,32 @@ module Aikido::Zen
         def self.from_json(data)
           new(
             data["sink_name"],
+            data["sink_kind"],
             being_blocked: data["being_blocked"]
           )
         end
 
-        def initialize(sink_name, being_blocked:)
+        def initialize(sink_name, sink_kind, being_blocked:)
           super()
           @sink_name = sink_name
+          @sink_kind = sink_kind
           @being_blocked = being_blocked
         end
 
         def as_json
           super.update({
             "sink_name" => @sink_name,
+            "sink_kind" => @sink_kind,
             "being_blocked" => @being_blocked
           })
         end
 
         def handle(collector)
-          collector.handle_track_attack(@sink_name, being_blocked: @being_blocked)
+          collector.handle_track_attack(@sink_name, @sink_kind, being_blocked: @being_blocked)
         end
 
         def inspect
-          "#<#{self.class.name} #{@sink_name} #{@being_blocked}>"
+          "#<#{self.class.name} #{@sink_name} #{@sink_kind} #{@being_blocked}>"
         end
       end
 

data/lib/aikido/zen/collector/sink_stats.rb

@@ -7,6 +7,9 @@ module Aikido::Zen
   #
   # Tracks data specific to a single Sink.
   class Collector::SinkStats
+    # @return [String] category of operation this sink represents.
+    attr_accessor :kind
+
     # @return [Integer] number of total calls to Sink#scan.
     attr_accessor :scans
 
@@ -62,6 +65,7 @@ module Aikido::Zen
 
     def as_json
       {
+        "kind" => @kind,
         "total" => @scans,
         "interceptorThrewError" => @errors,
         "withoutContext" => 0,

data/lib/aikido/zen/collector/stats.rb

@@ -94,21 +94,25 @@ module Aikido::Zen
     end
 
     # @param sink_name [String] the name of the sink
+    # @param sink_kind [String] the category of operation the sink represents
     # @param duration [Float] the length the scan in seconds
     # @param has_errors [Boolean] whether errors occurred during the scan
     # @return [void]
-    def add_scan(sink_name, duration, has_errors:)
+    def add_scan(sink_name, sink_kind, duration, has_errors:)
       stats = @sinks[sink_name]
+      stats.kind = sink_kind
       stats.scans += 1
       stats.errors += 1 if has_errors
       stats.add_timing(duration)
     end
 
     # @param sink_name [String] the name of the sink
+    # @param sink_kind [String] the category of operation the sink represents
     # @param being_blocked [Boolean] whether the Agent blocked the request
     # @return [void]
-    def add_attack(sink_name, being_blocked:)
+    def add_attack(sink_name, sink_kind, being_blocked:)
       stats = @sinks[sink_name]
+      stats.kind = sink_kind
       stats.attacks += 1
       stats.blocked_attacks += 1 if being_blocked
     end

data/lib/aikido/zen/collector.rb

@@ -146,12 +146,12 @@ module Aikido::Zen
     # @param scan [Aikido::Zen::Scan]
     # @return [void]
     def track_scan(scan)
-      add_event(Events::TrackScan.new(scan.sink.name, scan.duration, has_errors: scan.errors?))
+      add_event(Events::TrackScan.new(scan.sink.name, scan.sink.kind, scan.duration, has_errors: scan.errors?))
     end
 
-    def handle_track_scan(sink_name, duration, has_errors:)
+    def handle_track_scan(sink_name, sink_kind, duration, has_errors:)
       synchronize(@stats) do |stats|
-        stats.add_scan(sink_name, duration, has_errors: has_errors)
+        stats.add_scan(sink_name, sink_kind, duration, has_errors: has_errors)
       end
     end
 
@@ -160,12 +160,12 @@ module Aikido::Zen
     # @param attack [Aikido::Zen::Attack]
     # @return [void]
     def track_attack(attack)
-      add_event(Events::TrackAttack.new(attack.sink.name, being_blocked: attack.blocked?))
+      add_event(Events::TrackAttack.new(attack.sink.name, attack.sink.kind, being_blocked: attack.blocked?))
     end
 
-    def handle_track_attack(sink_name, being_blocked:)
+    def handle_track_attack(sink_name, sink_kind, being_blocked:)
       synchronize(@stats) do |stats|
-        stats.add_attack(sink_name, being_blocked: being_blocked)
+        stats.add_attack(sink_name, sink_kind, being_blocked: being_blocked)
       end
     end
 

data/lib/aikido/zen/config.rb

@@ -42,7 +42,7 @@ module Aikido::Zen
     attr_reader :api_endpoint
 
     # @return [URI] The HTTP host for the Aikido Runtime API. Defaults to
-    #   +https://runtime.aikido.dev+.
+    #   +https://guard.aikido.dev+.
     attr_reader :realtime_endpoint
 
     # @return [Hash] HTTP timeouts for communicating with the API.
@@ -229,6 +229,11 @@ module Aikido::Zen
     attr_accessor :realtime_settings_updates_enabled
     alias_method :realtime_settings_updates_enabled?, :realtime_settings_updates_enabled
 
+    # @return [Integer] the minimum time in milliseconds between realtime
+    #   settings updates.
+    #   Defaults to 9 seconds in milliseconds.
+    attr_accessor :realtime_settings_updates_min_time_between_events
+
     def initialize
       self.insert_middleware_after = ::ActionDispatch::RemoteIp
       self.disabled = read_boolean_from_env(ENV.fetch("AIKIDO_DISABLE", false)) || read_boolean_from_env(ENV.fetch("AIKIDO_DISABLED", false))
@@ -236,7 +241,7 @@ module Aikido::Zen
       self.debugging = read_boolean_from_env(ENV.fetch("AIKIDO_DEBUG", false))
       self.api_token = ENV.fetch("AIKIDO_TOKEN", nil)
       self.api_endpoint = ENV.fetch("AIKIDO_ENDPOINT") { regional_api_endpoint(api_token) }
-      self.realtime_endpoint = ENV.fetch("AIKIDO_REALTIME_ENDPOINT", DEFAULT_RUNTIME_BASE_URL)
+      self.realtime_endpoint = api_endpoint
       self.api_timeouts = 10
       self.polling_interval = 60 # 1 min
       self.initial_heartbeat_delays = [30, 60 * 2] # 30 sec, 2 min
@@ -277,6 +282,7 @@ module Aikido::Zen
       self.idor_excluded_table_names = []
       self.idor_max_cache_entries = 1000
       self.realtime_settings_updates_enabled = false
+      self.realtime_settings_updates_min_time_between_events = 9 * 1000 # 9 sec (ms)
     end
 
     # Set the base URL for API requests.
@@ -377,9 +383,6 @@ module Aikido::Zen
       "AU" => "https://guard.au.aikido.dev"
     }.freeze
 
-    # @!visibility private
-    DEFAULT_RUNTIME_BASE_URL = "https://runtime.aikido.dev"
-
     # @!visibility private
     DEFAULT_JSON_ENCODER = JSON.method(:dump)
 

data/lib/aikido/zen/context.rb

@@ -24,6 +24,10 @@ module Aikido::Zen
     attr_accessor :scanning
     alias_method :scanning?, :scanning
 
+    # @return [Boolean, nil] whether the request is bypassed.
+    attr_accessor :request_bypassed
+    alias_method :request_bypassed?, :request_bypassed
+
     # @return [Boolean] whether attack protection for the currently requested
     #   endpoint was disabled on the Aikido dashboard, or if the source IP for
     #   this request is in the "Bypass List".
@@ -48,6 +52,7 @@ module Aikido::Zen
 
       @metadata = {}
       @scanning = false
+      @request_bypassed = nil
       @protection_disabled = false
       @idor_protection_enabled = false
     end

data/lib/aikido/zen/middleware/allowed_address_checker.rb

@@ -5,8 +5,9 @@ module Aikido::Zen
     # Middleware that only allows allowed IPs when allowed IPs are configured for
     # any matching route in the Aikido dashboard.
     class AllowedAddressChecker
-      def initialize(app, config: Aikido::Zen.config, settings: Aikido::Zen.runtime_settings)
+      def initialize(app, zen: Aikido::Zen, config: zen.config, settings: zen.runtime_settings)
         @app = app
+        @zen = zen
         @config = config
         @settings = settings
       end
@@ -22,7 +23,7 @@ module Aikido::Zen
       end
 
       private def allowed?(request)
-        return true if @settings.bypassed_ips.include?(request.client_ip)
+        return true if @zen.request_bypassed?
 
         matches = @settings.endpoints.matched_settings(request.route)
 

data/lib/aikido/zen/middleware/attack_protector.rb

@@ -19,7 +19,7 @@ module Aikido::Zen
       end
 
       private def protection_disabled?(request)
-        return true if @settings.bypassed_ips.include?(request.client_ip)
+        return true if @zen.request_bypassed?
 
         !@settings.endpoints.matched_settings(request.route).all?(&:protected?)
       end

data/lib/aikido/zen/middleware/attack_wave_protector.rb

@@ -4,10 +4,9 @@ module Aikido
   module Zen
     module Middleware
       class AttackWaveProtector
-        def initialize(app, zen: Aikido::Zen, settings: Aikido::Zen.runtime_settings)
+        def initialize(app, zen: Aikido::Zen)
           @app = app
           @zen = zen
-          @settings = settings
         end
 
         def call(env)
@@ -30,7 +29,7 @@ module Aikido
           request = context.request
           return nil if request.nil?
 
-          return nil if @settings.bypassed_ips.include?(request.client_ip)
+          return nil if @zen.request_bypassed?
 
           @zen.detect_attack_wave(context, status_code)
         end

data/lib/aikido/zen/middleware/ip_list_checker.rb

@@ -15,7 +15,7 @@ module Aikido::Zen
 
         client_ip = request.client_ip
 
-        return @app.call(env) if bypassed_ip?(client_ip)
+        return @app.call(env) if @zen.request_bypassed?
 
         if !@settings.allowed_ip?(client_ip)
           return @config.blocked_responder.call(request, :ip_allowed_list)
@@ -38,10 +38,6 @@ module Aikido::Zen
 
         @app.call(env)
       end
-
-      def bypassed_ip?(client_ip)
-        @settings.bypassed_ips.include?(client_ip)
-      end
     end
   end
 end

data/lib/aikido/zen/middleware/rack_throttler.rb

@@ -34,7 +34,7 @@ module Aikido::Zen
       private
 
       def should_throttle?(request)
-        return false if @settings.bypassed_ips.include?(request.client_ip)
+        return false if @zen.request_bypassed?
 
         return false if request.actor && @settings.user_excluded_from_rate_limiting?(request.actor.id)
 

data/lib/aikido/zen/middleware/request_tracker.rb

@@ -5,8 +5,9 @@ module Aikido::Zen
     # Rack middleware used to track request
     # It implements the logic under that which is considered worthy of being tracked.
     class RequestTracker
-      def initialize(app, settings: Aikido::Zen.runtime_settings)
+      def initialize(app, zen: Aikido::Zen, settings: zen.runtime_settings)
         @app = app
+        @zen = zen
         @settings = settings
       end
 
@@ -17,13 +18,12 @@ module Aikido::Zen
         if request.route && track?(
           status_code: response[0],
           route: request.route.path,
-          http_method: request.request_method,
-          ip: request.client_ip
+          http_method: request.request_method
         )
-          Aikido::Zen.track_request(request)
+          @zen.track_request(request)
 
-          if Aikido::Zen.config.collect_api_schema?
-            Aikido::Zen.track_discovered_route(request)
+          if @zen.config.collect_api_schema?
+            @zen.track_discovered_route(request)
           end
         end
 
@@ -128,8 +128,8 @@ module Aikido::Zen
       # @param status_code [Integer]
       # @param route [String]
       # @param http_method [String]
-      def track?(status_code:, route:, http_method:, ip: nil)
-        return false if @settings.bypassed_ips.include?(ip)
+      def track?(status_code:, route:, http_method:)
+        return false if @zen.request_bypassed?
 
         # In the UI we want to show only successful (2xx) or redirect (3xx) responses
         # anything else is discarded.

data/lib/aikido/zen/middleware/user_agent_checker.rb

@@ -13,7 +13,7 @@ module Aikido::Zen
       def call(env)
         request = Aikido::Zen::Middleware.request_from(env)
 
-        return @app.call(env) if bypassed?(request)
+        return @app.call(env) if @zen.request_bypassed?
 
         user_agent = request.user_agent
 
@@ -31,10 +31,6 @@ module Aikido::Zen
 
         @app.call(env)
       end
-
-      def bypassed?(request)
-        @settings.bypassed_ips.include?(request.client_ip)
-      end
     end
   end
 end

data/lib/aikido/zen/sink.rb

@@ -15,6 +15,7 @@ module Aikido::Zen
     # @param name [String] name of the library being patched. (This must
     #   match the name of the gem, or we won't report that gem as
     #   supported.)
+    # @param kind [String] category of operation this sink represents.
     # @param scanners [Array<#call>] a list of objects that respond to
     #   #call with a Hash and return an Attack or nil.
     # @param opts [Hash<Symbol, Object>] any other options to pass to
@@ -23,9 +24,9 @@ module Aikido::Zen
     # @return [void]
     # @raise [ArgumentError] if a Sink with this name has already been
     #   registered.
-    def self.add(name, scanners:, **opts)
+    def self.add(name, kind, scanners:, **opts)
       raise ArgumentError, "Sink #{name} already registered" if registry.key?(name.to_s)
-      registry[name.to_s] = Sink.new(name.to_s, scanners: scanners, **opts)
+      registry[name.to_s] = Sink.new(name.to_s, kind, scanners: scanners, **opts)
     end
   end
 
@@ -42,6 +43,9 @@ module Aikido::Zen
     # @return [String] name of the patched library (e.g. "mysql2").
     attr_reader :name
 
+    # @return [String] category of operation this sink represents.
+    attr_reader :kind
+
     # @return [Array<#call>] list of registered scanners for this sink.
     attr_reader :scanners
 
@@ -53,10 +57,11 @@ module Aikido::Zen
 
     DEFAULT_REPORTER = ->(scan) { Aikido::Zen.track_scan(scan) }
 
-    def initialize(name, scanners:, operation: name, reporter: DEFAULT_REPORTER)
+    def initialize(name, kind, scanners:, operation: name, reporter: DEFAULT_REPORTER)
       raise ArgumentError, "scanners cannot be empty" if scanners.empty?
 
       @name = name
+      @kind = kind
       @operation = operation
       @scanners = scanners
       @reporter = reporter

data/lib/aikido/zen/sinks/action_controller.rb

@@ -30,7 +30,7 @@ module Aikido::Zen
 
           request = context.request
 
-          return false if @settings.bypassed_ips.include?(request.client_ip)
+          return false if @zen.request_bypassed?
 
           if should_block_user?(request)
             status, headers, body = @config.blocked_responder.call(request, :user)

data/lib/aikido/zen/sinks/async_http.rb

@@ -6,7 +6,7 @@ module Aikido::Zen
   module Sinks
     module Async
       module HTTP
-        SINK = Sinks.add("async-http", scanners: [
+        SINK = Sinks.add("async-http", "outgoing_http_op", scanners: [
           Scanners::SSRFScanner
         ])
 
@@ -50,14 +50,10 @@ module Aikido::Zen
 
                 connection = OutboundConnection.from_uri(uri)
 
-                settings = Aikido::Zen.runtime_settings
-
-                client_ip = context&.request&.client_ip
-
-                unless settings.bypassed_ip?(client_ip)
+                unless Aikido::Zen.request_bypassed?
                   Aikido::Zen.track_outbound(connection)
 
-                  if settings.block_outbound?(connection)
+                  if Aikido::Zen.block_outbound?(connection)
                     Sinks::DSL.presafe do
                       raise OutboundConnectionBlockedError.new(connection)
                     end

data/lib/aikido/zen/sinks/curb.rb

@@ -5,7 +5,7 @@ require_relative "../scanners/ssrf_scanner"
 module Aikido::Zen
   module Sinks
     module Curl
-      SINK = Sinks.add("curb", scanners: [
+      SINK = Sinks.add("curb", "outgoing_http_op", scanners: [
         Scanners::SSRFScanner
       ])
 
@@ -62,14 +62,10 @@ module Aikido::Zen
 
               connection = OutboundConnection.from_uri(URI(url))
 
-              settings = Aikido::Zen.runtime_settings
-
-              client_ip = context&.request&.client_ip
-
-              unless settings.bypassed_ip?(client_ip)
+              unless Aikido::Zen.request_bypassed?
                 Aikido::Zen.track_outbound(connection)
 
-                if settings.block_outbound?(connection)
+                if Aikido::Zen.block_outbound?(connection)
                   Sinks::DSL.presafe do
                     raise OutboundConnectionBlockedError.new(connection)
                   end

data/lib/aikido/zen/sinks/em_http.rb

@@ -6,7 +6,7 @@ module Aikido::Zen
   module Sinks
     module EventMachine
       module HttpRequest
-        SINK = Sinks.add("em-http-request", scanners: [
+        SINK = Sinks.add("em-http-request", "outgoing_http_op", scanners: [
           Scanners::SSRFScanner
         ])
 
@@ -48,14 +48,10 @@ module Aikido::Zen
                   port: req.port
                 )
 
-                settings = Aikido::Zen.runtime_settings
-
-                client_ip = context&.request&.client_ip
-
-                unless settings.bypassed_ip?(client_ip)
+                unless Aikido::Zen.request_bypassed?
                   Aikido::Zen.track_outbound(connection)
 
-                  if settings.block_outbound?(connection)
+                  if Aikido::Zen.block_outbound?(connection)
                     Sinks::DSL.presafe do
                       raise OutboundConnectionBlockedError.new(connection)
                     end

data/lib/aikido/zen/sinks/excon.rb

@@ -5,7 +5,7 @@ require_relative "../scanners/ssrf_scanner"
 module Aikido::Zen
   module Sinks
     module Excon
-      SINK = Sinks.add("excon", scanners: [
+      SINK = Sinks.add("excon", "outgoing_http_op", scanners: [
         Scanners::SSRFScanner
       ])
 
@@ -54,14 +54,10 @@ module Aikido::Zen
 
               connection = OutboundConnection.from_uri(request.uri)
 
-              settings = Aikido::Zen.runtime_settings
-
-              client_ip = context&.request&.client_ip
-
-              unless settings.bypassed_ip?(client_ip)
+              unless Aikido::Zen.request_bypassed?
                 Aikido::Zen.track_outbound(connection)
 
-                if settings.block_outbound?(connection)
+                if Aikido::Zen.block_outbound?(connection)
                   Sinks::DSL.presafe do
                     raise OutboundConnectionBlockedError.new(connection)
                   end

data/lib/aikido/zen/sinks/file.rb

@@ -3,7 +3,7 @@
 module Aikido::Zen
   module Sinks
     module File
-      SINK = Sinks.add("File", scanners: [Scanners::PathTraversalScanner])
+      SINK = Sinks.add("File", "fs_op", scanners: [Scanners::PathTraversalScanner])
 
       module Helpers
         def self.scan(filepath, operation)

data/lib/aikido/zen/sinks/http.rb

@@ -5,7 +5,7 @@ require_relative "../scanners/ssrf_scanner"
 module Aikido::Zen
   module Sinks
     module HTTP
-      SINK = Sinks.add("http", scanners: [
+      SINK = Sinks.add("http", "outgoing_http_op", scanners: [
         Scanners::SSRFScanner
       ])
 
@@ -68,14 +68,10 @@ module Aikido::Zen
 
               connection = Helpers.build_outbound(req)
 
-              settings = Aikido::Zen.runtime_settings
-
-              client_ip = context&.request&.client_ip
-
-              unless settings.bypassed_ip?(client_ip)
+              unless Aikido::Zen.request_bypassed?
                 Aikido::Zen.track_outbound(connection)
 
-                if settings.block_outbound?(connection)
+                if Aikido::Zen.block_outbound?(connection)
                   Sinks::DSL.presafe do
                     raise OutboundConnectionBlockedError.new(connection)
                   end

data/lib/aikido/zen/sinks/httpclient.rb

@@ -5,7 +5,7 @@ require_relative "../scanners/ssrf_scanner"
 module Aikido::Zen
   module Sinks
     module HTTPClient
-      SINK = Sinks.add("httpclient", scanners: [
+      SINK = Sinks.add("httpclient", "outgoing_http_op", scanners: [
         Scanners::SSRFScanner
       ])
 
@@ -48,14 +48,10 @@ module Aikido::Zen
             context["ssrf.request"] = wrapped_request
           end
 
-          settings = Aikido::Zen.runtime_settings
-
-          client_ip = context&.request&.client_ip
-
-          unless settings.bypassed_ip?(client_ip)
+          unless Aikido::Zen.request_bypassed?
             Aikido::Zen.track_outbound(connection)
 
-            if settings.block_outbound?(connection)
+            if Aikido::Zen.block_outbound?(connection)
               Sinks::DSL.presafe do
                 raise OutboundConnectionBlockedError.new(connection)
               end

data/lib/aikido/zen/sinks/httpx.rb

@@ -5,7 +5,7 @@ require_relative "../scanners/ssrf_scanner"
 module Aikido::Zen
   module Sinks
     module HTTPX
-      SINK = Sinks.add("httpx", scanners: [
+      SINK = Sinks.add("httpx", "outgoing_http_op", scanners: [
         Scanners::SSRFScanner
       ])
 
@@ -53,14 +53,10 @@ module Aikido::Zen
 
               connection = OutboundConnection.from_uri(request.uri)
 
-              settings = Aikido::Zen.runtime_settings
-
-              client_ip = context&.request&.client_ip
-
-              unless settings.bypassed_ip?(client_ip)
+              unless Aikido::Zen.request_bypassed?
                 Aikido::Zen.track_outbound(connection)
 
-                if settings.block_outbound?(connection)
+                if Aikido::Zen.block_outbound?(connection)
                   Sinks::DSL.presafe do
                     raise OutboundConnectionBlockedError.new(connection)
                   end

data/lib/aikido/zen/sinks/kernel.rb

@@ -3,7 +3,7 @@
 module Aikido::Zen
   module Sinks
     module Kernel
-      SINK = Sinks.add("Kernel", scanners: [Scanners::ShellInjectionScanner])
+      SINK = Sinks.add("Kernel", "exec_op", scanners: [Scanners::ShellInjectionScanner])
 
       module Helpers
         def self.scan(command, operation)

data/lib/aikido/zen/sinks/mysql2.rb

@@ -3,7 +3,7 @@
 module Aikido::Zen
   module Sinks
     module Mysql2
-      SINK = Sinks.add("mysql2", scanners: [Scanners::SQLInjectionScanner])
+      SINK = Sinks.add("mysql2", "sql_op", scanners: [Scanners::SQLInjectionScanner])
 
       module Helpers
         def self.scan(query, operation)

data/lib/aikido/zen/sinks/net_http.rb

@@ -6,7 +6,7 @@ module Aikido::Zen
   module Sinks
     module Net
       module HTTP
-        SINK = Sinks.add("net-http", scanners: [
+        SINK = Sinks.add("net-http", "outgoing_http_op", scanners: [
           Scanners::SSRFScanner
         ])
 
@@ -84,14 +84,10 @@ module Aikido::Zen
 
               connection = Helpers.build_outbound(self)
 
-              settings = Aikido::Zen.runtime_settings
-
-              client_ip = context&.request&.client_ip
-
-              unless settings.bypassed_ip?(client_ip)
+              unless Aikido::Zen.request_bypassed?
                 Aikido::Zen.track_outbound(connection)
 
-                if settings.block_outbound?(connection)
+                if Aikido::Zen.block_outbound?(connection)
                   Sinks::DSL.presafe do
                     raise OutboundConnectionBlockedError.new(connection)
                   end

data/lib/aikido/zen/sinks/patron.rb

@@ -5,7 +5,7 @@ require_relative "../scanners/ssrf_scanner"
 module Aikido::Zen
   module Sinks
     module Patron
-      SINK = Sinks.add("patron", scanners: [
+      SINK = Sinks.add("patron", "outgoing_http_op", scanners: [
         Scanners::SSRFScanner
       ])
 
@@ -57,14 +57,10 @@ module Aikido::Zen
 
               connection = OutboundConnection.from_uri(URI(request.url))
 
-              settings = Aikido::Zen.runtime_settings
-
-              client_ip = context&.request&.client_ip
-
-              unless settings.bypassed_ip?(client_ip)
+              unless Aikido::Zen.request_bypassed?
                 Aikido::Zen.track_outbound(connection)
 
-                if settings.block_outbound?(connection)
+                if Aikido::Zen.block_outbound?(connection)
                   Sinks::DSL.presafe do
                     raise OutboundConnectionBlockedError.new(connection)
                   end

data/lib/aikido/zen/sinks/pg.rb

@@ -3,7 +3,7 @@
 module Aikido::Zen
   module Sinks
     module PG
-      SINK = Sinks.add("pg", scanners: [Scanners::SQLInjectionScanner])
+      SINK = Sinks.add("pg", "sql_op", scanners: [Scanners::SQLInjectionScanner])
 
       module Helpers
         # For some reason, the ActiveRecord pg adaptor does not wrap exceptions

data/lib/aikido/zen/sinks/resolv.rb

@@ -6,7 +6,7 @@ require_relative "../scanners/ssrf_scanner"
 module Aikido::Zen
   module Sinks
     module Resolv
-      SINK = Sinks.add("resolv", scanners: [
+      SINK = Sinks.add("resolv", "outgoing_http_op", scanners: [
         Scanners::StoredSSRFScanner,
         Scanners::SSRFScanner
       ])

data/lib/aikido/zen/sinks/socket.rb

@@ -10,7 +10,7 @@ module Aikido::Zen
     # there's no way to access the internal DNS resolution that happens in C
     # when using the socket primitives.
     module Socket
-      SINK = Sinks.add("socket", scanners: [
+      SINK = Sinks.add("socket", "outgoing_http_op", scanners: [
         Scanners::StoredSSRFScanner,
         Scanners::SSRFScanner
       ])

data/lib/aikido/zen/sinks/sqlite3.rb

@@ -3,7 +3,7 @@
 module Aikido::Zen
   module Sinks
     module SQLite3
-      SINK = Sinks.add("sqlite3", scanners: [Scanners::SQLInjectionScanner])
+      SINK = Sinks.add("sqlite3", "sql_op", scanners: [Scanners::SQLInjectionScanner])
 
       module Helpers
         def self.scan(query, operation)

data/lib/aikido/zen/sinks/trilogy.rb

@@ -3,7 +3,7 @@
 module Aikido::Zen
   module Sinks
     module Trilogy
-      SINK = Sinks.add("trilogy", scanners: [Scanners::SQLInjectionScanner])
+      SINK = Sinks.add("trilogy", "sql_op", scanners: [Scanners::SQLInjectionScanner])
 
       module Helpers
         def self.scan(query, operation)

data/lib/aikido/zen/sinks/typhoeus.rb

@@ -5,7 +5,7 @@ require_relative "../sink"
 module Aikido::Zen
   module Sinks
     module Typhoeus
-      SINK = Sinks.add("typhoeus", scanners: [
+      SINK = Sinks.add("typhoeus", "outgoing_http_op", scanners: [
         Aikido::Zen::Scanners::SSRFScanner
       ])
 
@@ -24,14 +24,10 @@ module Aikido::Zen
 
         connection = Aikido::Zen::OutboundConnection.from_uri(URI(request.base_url))
 
-        settings = Aikido::Zen.runtime_settings
-
-        client_ip = context&.request&.client_ip
-
-        unless settings.bypassed_ip?(client_ip)
+        unless Aikido::Zen.request_bypassed?
           Aikido::Zen.track_outbound(connection)
 
-          if settings.block_outbound?(connection)
+          if Aikido::Zen.block_outbound?(connection)
             raise OutboundConnectionBlockedError.new(connection)
           end
         end

data/lib/aikido/zen/version.rb

@@ -2,7 +2,7 @@
 
 module Aikido
   module Zen
-    VERSION = "1.7.2.beta.2"
+    VERSION = "1.8.0"
 
     # The version of libzen_internals that we build against.
     LIBZEN_VERSION = "0.1.61"

data/lib/aikido/zen.rb

@@ -153,6 +153,23 @@ module Aikido
       Fiber.current.aikido_current_context = context
     end
 
+    # @return [Boolean] whether the current request is bypassed.
+    def self.request_bypassed?
+      context = current_context
+      return unless context
+
+      return context.request_bypassed unless context.request_bypassed.nil?
+
+      context.request_bypassed = runtime_settings.bypassed_ip?(context.request.client_ip)
+    end
+
+    # Marks the current request as bypassed.
+    #
+    # @return [void]
+    def self.request_bypassed!
+      current_context&.request_bypassed = true
+    end
+
     # Track statistics about an HTTP request the app is handling.
     #
     # @param request [Aikido::Zen::Request]
@@ -207,6 +224,14 @@ module Aikido
       collector.track_outbound(connection)
     end
 
+    # @param connection [Aikido::Zen::OutboundConnection]
+    # @return [Boolean] whether this outbound connection should be blocked.
+    def self.block_outbound?(connection)
+      return false if current_context&.protection_disabled?
+
+      runtime_settings.block_outbound?(connection)
+    end
+
     # Track statistics about the result of a Sink's scan, and report it as
     # an Attack if one is detected.
     #

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aikido-zen
 version: !ruby/object:Gem::Version
-  version: 1.7.2.beta.2
+  version: 1.8.0
 platform: ruby
 authors:
 - Aikido Security
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-08-14 00:00:00.000000000 Z
+date: 2026-08-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -93,6 +93,7 @@ files:
 - docs/invalid-sql-queries.md
 - docs/proxy.md
 - docs/rails.md
+- docs/request-bypassing.md
 - docs/troubleshooting.md
 - lib/aikido-zen.rb
 - lib/aikido/zen.rb