aikido-zen 1.7.2 → 1.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 41f1982e134a806c513cc166247059c3f290f6bbc88ff32dcf4bdc65da9f377d
-  data.tar.gz: d97dac2f830555239836a143b815ca3c85c4993776183ce73bc5dc392fed9618
+  metadata.gz: c01eda1d0ea486bf41d00d6efc05f064ad13b3ae71e112af02b1c01e3d164592
+  data.tar.gz: 222be5ac12985a6f855335a3433d32632704d6ebb1c0f7249fe9bb85492554f2
 SHA512:
-  metadata.gz: 526140c45a47c29f4f36e1508bc3305bafe535e92479c877deeb92a1f74c618fa19d7c46a7d67183310fbc414f05912b93c88f2cdb109730d04c0b4b6a54b301
-  data.tar.gz: 6c43bc7461a52ded8331b6ba2188afd9d273e1b012f5912b2d9786c439e2890380003779925bd3f37fdd4422f4b34aefe13af6d29d0a6a7f3b4e351c5019dca1
+  metadata.gz: 4645441dc4301bccc6c09347f864149b071f9cdcd16811309dd7a7e9650848ff90a559ebc576338e7bc8bc41fc3f4d4c2deaa096112628da02bf71619e69ad77
+  data.tar.gz: 8e7e3717a0a38dcb0d0c38abaf2142569404917f0fff5da720fcd4d180eebb27799d7b836a5222389a33a1a963e431f2459fe2299ab1d6e0c85234b615ce997d

data/docs/request-bypassing.md

@@ -1,11 +1,23 @@
 # Bypass Zen for a specific request
 
-To disable Zen for a specific request, call `Aikido::Zen.request_bypassed!` from a Rack middleware. This bypasses Zen's security checks and stats collection for that request.
+Call `Aikido::Zen.request_bypassed!` from a Rack middleware to bypass Zen for this request. A bypassed request is fully excluded from Zen inspection and enforcement: Zen will not analyze the request, generate findings, or apply blocking rules for that traffic. Your application handles the request normally.
 
 > [!NOTE]
-> Zen already has a built-in feature for bypassing specific IP addresses. This feature offers more flexibility, letting you bypass Zen for a request based on any criteria you choose.
+> Zen's built-in [Bypassed IPs](https://help.aikido.dev/zen-firewall/zen-features/bypassed-ips) feature uses request bypassing internally, triggered by a matching IP/CIDR. `Aikido::Zen.request_bypassed!` lets you bypass requests using your custom logic.
 
-`Aikido::Zen.request_bypassed!` needs the request's context to already be set up, so your middleware must run after Zen's `ContextSetter` middleware. The following example shows how to bypass a specific request in a Rails application:
+## What gets bypassed
+
+* **Attack protection** — SQL injection, path traversal, command injection, and SSRF attacks are not blocked or reported
+* **Rate limiting** — never triggered.
+* **IP blocking** — Known Threat Actors, Tor traffic blocking/monitoring, country blocking, and custom IP allow/block lists are not checked.
+* **Bot traffic blocking** — not checked.
+* **User blocking** — blocked users are not blocked.
+* **Statistics** — the request isn't counted, and doesn't count against your monitored request quota.
+* **Attack wave protection** — the request doesn't count towards wave detection.
+
+## Usage
+
+Insert your middleware directly after `Aikido::Zen::Middleware::ContextSetter`, so it runs after the request context is set up but before Zen's other middleware:
 
 ```ruby
 # config/application.rb
@@ -35,4 +47,4 @@ end
 ```
 
 > [!WARNING]
-> Use this feature with caution, as it can potentially expose your application to security risks if not used properly.
+> A bypassed request gets zero protection from Zen — no attack detection, no rate limiting, no blocking, no tracking. Ensure that your custom logic only bypasses requests that you fully trust.

data/lib/aikido/zen/agent.rb

@@ -220,6 +220,8 @@ module Aikido::Zen
       updated_at = Time.at(event[:data]["configUpdatedAt"].to_i)
 
       if should_fetch_settings?(updated_at)
+        return if realtime_settings_updates_too_fast?
+
         if update_settings_from_runtime_config!(@api_client.fetch_runtime_config, reason: "after server-sent event")
           updated_settings!
 
@@ -239,6 +241,19 @@ module Aikido::Zen
       updated_at > last_updated_at
     end
 
+    def realtime_settings_updates_too_fast?
+      now = Process.clock_gettime(Process::CLOCK_MONOTONIC, :millisecond)
+
+      last_updated_at = @realtime_settings_updates_last_updated_at
+      if last_updated_at && now - last_updated_at < @config.realtime_settings_updates_min_time_between_events
+        return true
+      end
+
+      @realtime_settings_updates_last_updated_at = now
+
+      false
+    end
+
     def heartbeats
       @heartbeats ||= Aikido::Zen::Agent::HeartbeatsManager.new(
         config: @config,

data/lib/aikido/zen/collector/event.rb

@@ -157,14 +157,16 @@ module Aikido::Zen
         def self.from_json(data)
           new(
             data["sink_name"],
+            data["sink_kind"],
             data["duration"],
             has_errors: data["has_errors"]
           )
         end
 
-        def initialize(sink_name, duration, has_errors:)
+        def initialize(sink_name, sink_kind, duration, has_errors:)
           super()
           @sink_name = sink_name
+          @sink_kind = sink_kind
           @duration = duration
           @has_errors = has_errors
         end
@@ -172,17 +174,18 @@ module Aikido::Zen
         def as_json
           super.update({
             "sink_name" => @sink_name,
+            "sink_kind" => @sink_kind,
             "duration" => @duration,
             "has_errors" => @has_errors
           })
         end
 
         def handle(collector)
-          collector.handle_track_scan(@sink_name, @duration, has_errors: @has_errors)
+          collector.handle_track_scan(@sink_name, @sink_kind, @duration, has_errors: @has_errors)
         end
 
         def inspect
-          "#<#{self.class.name} #{@sink_name} #{format "%0.6f", @duration} #{@has_errors}>"
+          "#<#{self.class.name} #{@sink_name} #{@sink_kind} #{format "%0.6f", @duration} #{@has_errors}>"
         end
       end
 
@@ -192,29 +195,32 @@ module Aikido::Zen
         def self.from_json(data)
           new(
             data["sink_name"],
+            data["sink_kind"],
             being_blocked: data["being_blocked"]
           )
         end
 
-        def initialize(sink_name, being_blocked:)
+        def initialize(sink_name, sink_kind, being_blocked:)
           super()
           @sink_name = sink_name
+          @sink_kind = sink_kind
           @being_blocked = being_blocked
         end
 
         def as_json
           super.update({
             "sink_name" => @sink_name,
+            "sink_kind" => @sink_kind,
             "being_blocked" => @being_blocked
           })
         end
 
         def handle(collector)
-          collector.handle_track_attack(@sink_name, being_blocked: @being_blocked)
+          collector.handle_track_attack(@sink_name, @sink_kind, being_blocked: @being_blocked)
         end
 
         def inspect
-          "#<#{self.class.name} #{@sink_name} #{@being_blocked}>"
+          "#<#{self.class.name} #{@sink_name} #{@sink_kind} #{@being_blocked}>"
         end
       end
 

data/lib/aikido/zen/collector/sink_stats.rb

@@ -7,6 +7,9 @@ module Aikido::Zen
   #
   # Tracks data specific to a single Sink.
   class Collector::SinkStats
+    # @return [String] category of operation this sink represents.
+    attr_accessor :kind
+
     # @return [Integer] number of total calls to Sink#scan.
     attr_accessor :scans
 
@@ -62,6 +65,7 @@ module Aikido::Zen
 
     def as_json
       {
+        "kind" => @kind,
         "total" => @scans,
         "interceptorThrewError" => @errors,
         "withoutContext" => 0,

data/lib/aikido/zen/collector/stats.rb

@@ -94,21 +94,25 @@ module Aikido::Zen
     end
 
     # @param sink_name [String] the name of the sink
+    # @param sink_kind [String] the category of operation the sink represents
     # @param duration [Float] the length the scan in seconds
     # @param has_errors [Boolean] whether errors occurred during the scan
     # @return [void]
-    def add_scan(sink_name, duration, has_errors:)
+    def add_scan(sink_name, sink_kind, duration, has_errors:)
       stats = @sinks[sink_name]
+      stats.kind = sink_kind
       stats.scans += 1
       stats.errors += 1 if has_errors
       stats.add_timing(duration)
     end
 
     # @param sink_name [String] the name of the sink
+    # @param sink_kind [String] the category of operation the sink represents
     # @param being_blocked [Boolean] whether the Agent blocked the request
     # @return [void]
-    def add_attack(sink_name, being_blocked:)
+    def add_attack(sink_name, sink_kind, being_blocked:)
       stats = @sinks[sink_name]
+      stats.kind = sink_kind
       stats.attacks += 1
       stats.blocked_attacks += 1 if being_blocked
     end

data/lib/aikido/zen/collector.rb

@@ -146,12 +146,12 @@ module Aikido::Zen
     # @param scan [Aikido::Zen::Scan]
     # @return [void]
     def track_scan(scan)
-      add_event(Events::TrackScan.new(scan.sink.name, scan.duration, has_errors: scan.errors?))
+      add_event(Events::TrackScan.new(scan.sink.name, scan.sink.kind, scan.duration, has_errors: scan.errors?))
     end
 
-    def handle_track_scan(sink_name, duration, has_errors:)
+    def handle_track_scan(sink_name, sink_kind, duration, has_errors:)
       synchronize(@stats) do |stats|
-        stats.add_scan(sink_name, duration, has_errors: has_errors)
+        stats.add_scan(sink_name, sink_kind, duration, has_errors: has_errors)
       end
     end
 
@@ -160,12 +160,12 @@ module Aikido::Zen
     # @param attack [Aikido::Zen::Attack]
     # @return [void]
     def track_attack(attack)
-      add_event(Events::TrackAttack.new(attack.sink.name, being_blocked: attack.blocked?))
+      add_event(Events::TrackAttack.new(attack.sink.name, attack.sink.kind, being_blocked: attack.blocked?))
     end
 
-    def handle_track_attack(sink_name, being_blocked:)
+    def handle_track_attack(sink_name, sink_kind, being_blocked:)
       synchronize(@stats) do |stats|
-        stats.add_attack(sink_name, being_blocked: being_blocked)
+        stats.add_attack(sink_name, sink_kind, being_blocked: being_blocked)
       end
     end
 

data/lib/aikido/zen/config.rb

@@ -42,7 +42,7 @@ module Aikido::Zen
     attr_reader :api_endpoint
 
     # @return [URI] The HTTP host for the Aikido Runtime API. Defaults to
-    #   +https://runtime.aikido.dev+.
+    #   +https://guard.aikido.dev+.
     attr_reader :realtime_endpoint
 
     # @return [Hash] HTTP timeouts for communicating with the API.
@@ -229,6 +229,11 @@ module Aikido::Zen
     attr_accessor :realtime_settings_updates_enabled
     alias_method :realtime_settings_updates_enabled?, :realtime_settings_updates_enabled
 
+    # @return [Integer] the minimum time in milliseconds between realtime
+    #   settings updates.
+    #   Defaults to 9 seconds in milliseconds.
+    attr_accessor :realtime_settings_updates_min_time_between_events
+
     def initialize
       self.insert_middleware_after = ::ActionDispatch::RemoteIp
       self.disabled = read_boolean_from_env(ENV.fetch("AIKIDO_DISABLE", false)) || read_boolean_from_env(ENV.fetch("AIKIDO_DISABLED", false))
@@ -236,7 +241,7 @@ module Aikido::Zen
       self.debugging = read_boolean_from_env(ENV.fetch("AIKIDO_DEBUG", false))
       self.api_token = ENV.fetch("AIKIDO_TOKEN", nil)
       self.api_endpoint = ENV.fetch("AIKIDO_ENDPOINT") { regional_api_endpoint(api_token) }
-      self.realtime_endpoint = ENV.fetch("AIKIDO_REALTIME_ENDPOINT", DEFAULT_RUNTIME_BASE_URL)
+      self.realtime_endpoint = api_endpoint
       self.api_timeouts = 10
       self.polling_interval = 60 # 1 min
       self.initial_heartbeat_delays = [30, 60 * 2] # 30 sec, 2 min
@@ -277,6 +282,7 @@ module Aikido::Zen
       self.idor_excluded_table_names = []
       self.idor_max_cache_entries = 1000
       self.realtime_settings_updates_enabled = false
+      self.realtime_settings_updates_min_time_between_events = 9 * 1000 # 9 sec (ms)
     end
 
     # Set the base URL for API requests.
@@ -377,9 +383,6 @@ module Aikido::Zen
       "AU" => "https://guard.au.aikido.dev"
     }.freeze
 
-    # @!visibility private
-    DEFAULT_RUNTIME_BASE_URL = "https://runtime.aikido.dev"
-
     # @!visibility private
     DEFAULT_JSON_ENCODER = JSON.method(:dump)
 

data/lib/aikido/zen/sink.rb

@@ -15,6 +15,7 @@ module Aikido::Zen
     # @param name [String] name of the library being patched. (This must
     #   match the name of the gem, or we won't report that gem as
     #   supported.)
+    # @param kind [String] category of operation this sink represents.
     # @param scanners [Array<#call>] a list of objects that respond to
     #   #call with a Hash and return an Attack or nil.
     # @param opts [Hash<Symbol, Object>] any other options to pass to
@@ -23,9 +24,9 @@ module Aikido::Zen
     # @return [void]
     # @raise [ArgumentError] if a Sink with this name has already been
     #   registered.
-    def self.add(name, scanners:, **opts)
+    def self.add(name, kind, scanners:, **opts)
       raise ArgumentError, "Sink #{name} already registered" if registry.key?(name.to_s)
-      registry[name.to_s] = Sink.new(name.to_s, scanners: scanners, **opts)
+      registry[name.to_s] = Sink.new(name.to_s, kind, scanners: scanners, **opts)
     end
   end
 
@@ -42,6 +43,9 @@ module Aikido::Zen
     # @return [String] name of the patched library (e.g. "mysql2").
     attr_reader :name
 
+    # @return [String] category of operation this sink represents.
+    attr_reader :kind
+
     # @return [Array<#call>] list of registered scanners for this sink.
     attr_reader :scanners
 
@@ -53,10 +57,11 @@ module Aikido::Zen
 
     DEFAULT_REPORTER = ->(scan) { Aikido::Zen.track_scan(scan) }
 
-    def initialize(name, scanners:, operation: name, reporter: DEFAULT_REPORTER)
+    def initialize(name, kind, scanners:, operation: name, reporter: DEFAULT_REPORTER)
       raise ArgumentError, "scanners cannot be empty" if scanners.empty?
 
       @name = name
+      @kind = kind
       @operation = operation
       @scanners = scanners
       @reporter = reporter

data/lib/aikido/zen/sinks/async_http.rb

@@ -6,7 +6,7 @@ module Aikido::Zen
   module Sinks
     module Async
       module HTTP
-        SINK = Sinks.add("async-http", scanners: [
+        SINK = Sinks.add("async-http", "outgoing_http_op", scanners: [
           Scanners::SSRFScanner
         ])
 
@@ -50,12 +50,10 @@ module Aikido::Zen
 
                 connection = OutboundConnection.from_uri(uri)
 
-                settings = Aikido::Zen.runtime_settings
-
                 unless Aikido::Zen.request_bypassed?
                   Aikido::Zen.track_outbound(connection)
 
-                  if settings.block_outbound?(connection)
+                  if Aikido::Zen.block_outbound?(connection)
                     Sinks::DSL.presafe do
                       raise OutboundConnectionBlockedError.new(connection)
                     end

data/lib/aikido/zen/sinks/curb.rb

@@ -5,7 +5,7 @@ require_relative "../scanners/ssrf_scanner"
 module Aikido::Zen
   module Sinks
     module Curl
-      SINK = Sinks.add("curb", scanners: [
+      SINK = Sinks.add("curb", "outgoing_http_op", scanners: [
         Scanners::SSRFScanner
       ])
 
@@ -62,12 +62,10 @@ module Aikido::Zen
 
               connection = OutboundConnection.from_uri(URI(url))
 
-              settings = Aikido::Zen.runtime_settings
-
               unless Aikido::Zen.request_bypassed?
                 Aikido::Zen.track_outbound(connection)
 
-                if settings.block_outbound?(connection)
+                if Aikido::Zen.block_outbound?(connection)
                   Sinks::DSL.presafe do
                     raise OutboundConnectionBlockedError.new(connection)
                   end

data/lib/aikido/zen/sinks/em_http.rb

@@ -6,7 +6,7 @@ module Aikido::Zen
   module Sinks
     module EventMachine
       module HttpRequest
-        SINK = Sinks.add("em-http-request", scanners: [
+        SINK = Sinks.add("em-http-request", "outgoing_http_op", scanners: [
           Scanners::SSRFScanner
         ])
 
@@ -48,12 +48,10 @@ module Aikido::Zen
                   port: req.port
                 )
 
-                settings = Aikido::Zen.runtime_settings
-
                 unless Aikido::Zen.request_bypassed?
                   Aikido::Zen.track_outbound(connection)
 
-                  if settings.block_outbound?(connection)
+                  if Aikido::Zen.block_outbound?(connection)
                     Sinks::DSL.presafe do
                       raise OutboundConnectionBlockedError.new(connection)
                     end

data/lib/aikido/zen/sinks/excon.rb

@@ -5,7 +5,7 @@ require_relative "../scanners/ssrf_scanner"
 module Aikido::Zen
   module Sinks
     module Excon
-      SINK = Sinks.add("excon", scanners: [
+      SINK = Sinks.add("excon", "outgoing_http_op", scanners: [
         Scanners::SSRFScanner
       ])
 
@@ -54,12 +54,10 @@ module Aikido::Zen
 
               connection = OutboundConnection.from_uri(request.uri)
 
-              settings = Aikido::Zen.runtime_settings
-
               unless Aikido::Zen.request_bypassed?
                 Aikido::Zen.track_outbound(connection)
 
-                if settings.block_outbound?(connection)
+                if Aikido::Zen.block_outbound?(connection)
                   Sinks::DSL.presafe do
                     raise OutboundConnectionBlockedError.new(connection)
                   end

data/lib/aikido/zen/sinks/file.rb

@@ -3,7 +3,7 @@
 module Aikido::Zen
   module Sinks
     module File
-      SINK = Sinks.add("File", scanners: [Scanners::PathTraversalScanner])
+      SINK = Sinks.add("File", "fs_op", scanners: [Scanners::PathTraversalScanner])
 
       module Helpers
         def self.scan(filepath, operation)

data/lib/aikido/zen/sinks/http.rb

@@ -5,7 +5,7 @@ require_relative "../scanners/ssrf_scanner"
 module Aikido::Zen
   module Sinks
     module HTTP
-      SINK = Sinks.add("http", scanners: [
+      SINK = Sinks.add("http", "outgoing_http_op", scanners: [
         Scanners::SSRFScanner
       ])
 
@@ -68,12 +68,10 @@ module Aikido::Zen
 
               connection = Helpers.build_outbound(req)
 
-              settings = Aikido::Zen.runtime_settings
-
               unless Aikido::Zen.request_bypassed?
                 Aikido::Zen.track_outbound(connection)
 
-                if settings.block_outbound?(connection)
+                if Aikido::Zen.block_outbound?(connection)
                   Sinks::DSL.presafe do
                     raise OutboundConnectionBlockedError.new(connection)
                   end

data/lib/aikido/zen/sinks/httpclient.rb

@@ -5,7 +5,7 @@ require_relative "../scanners/ssrf_scanner"
 module Aikido::Zen
   module Sinks
     module HTTPClient
-      SINK = Sinks.add("httpclient", scanners: [
+      SINK = Sinks.add("httpclient", "outgoing_http_op", scanners: [
         Scanners::SSRFScanner
       ])
 
@@ -48,12 +48,10 @@ module Aikido::Zen
             context["ssrf.request"] = wrapped_request
           end
 
-          settings = Aikido::Zen.runtime_settings
-
           unless Aikido::Zen.request_bypassed?
             Aikido::Zen.track_outbound(connection)
 
-            if settings.block_outbound?(connection)
+            if Aikido::Zen.block_outbound?(connection)
               Sinks::DSL.presafe do
                 raise OutboundConnectionBlockedError.new(connection)
               end

data/lib/aikido/zen/sinks/httpx.rb

@@ -5,7 +5,7 @@ require_relative "../scanners/ssrf_scanner"
 module Aikido::Zen
   module Sinks
     module HTTPX
-      SINK = Sinks.add("httpx", scanners: [
+      SINK = Sinks.add("httpx", "outgoing_http_op", scanners: [
         Scanners::SSRFScanner
       ])
 
@@ -53,12 +53,10 @@ module Aikido::Zen
 
               connection = OutboundConnection.from_uri(request.uri)
 
-              settings = Aikido::Zen.runtime_settings
-
               unless Aikido::Zen.request_bypassed?
                 Aikido::Zen.track_outbound(connection)
 
-                if settings.block_outbound?(connection)
+                if Aikido::Zen.block_outbound?(connection)
                   Sinks::DSL.presafe do
                     raise OutboundConnectionBlockedError.new(connection)
                   end

data/lib/aikido/zen/sinks/kernel.rb

@@ -3,7 +3,7 @@
 module Aikido::Zen
   module Sinks
     module Kernel
-      SINK = Sinks.add("Kernel", scanners: [Scanners::ShellInjectionScanner])
+      SINK = Sinks.add("Kernel", "exec_op", scanners: [Scanners::ShellInjectionScanner])
 
       module Helpers
         def self.scan(command, operation)

data/lib/aikido/zen/sinks/mysql2.rb

@@ -3,7 +3,7 @@
 module Aikido::Zen
   module Sinks
     module Mysql2
-      SINK = Sinks.add("mysql2", scanners: [Scanners::SQLInjectionScanner])
+      SINK = Sinks.add("mysql2", "sql_op", scanners: [Scanners::SQLInjectionScanner])
 
       module Helpers
         def self.scan(query, operation)

data/lib/aikido/zen/sinks/net_http.rb

@@ -6,7 +6,7 @@ module Aikido::Zen
   module Sinks
     module Net
       module HTTP
-        SINK = Sinks.add("net-http", scanners: [
+        SINK = Sinks.add("net-http", "outgoing_http_op", scanners: [
           Scanners::SSRFScanner
         ])
 
@@ -84,12 +84,10 @@ module Aikido::Zen
 
               connection = Helpers.build_outbound(self)
 
-              settings = Aikido::Zen.runtime_settings
-
               unless Aikido::Zen.request_bypassed?
                 Aikido::Zen.track_outbound(connection)
 
-                if settings.block_outbound?(connection)
+                if Aikido::Zen.block_outbound?(connection)
                   Sinks::DSL.presafe do
                     raise OutboundConnectionBlockedError.new(connection)
                   end

data/lib/aikido/zen/sinks/patron.rb

@@ -5,7 +5,7 @@ require_relative "../scanners/ssrf_scanner"
 module Aikido::Zen
   module Sinks
     module Patron
-      SINK = Sinks.add("patron", scanners: [
+      SINK = Sinks.add("patron", "outgoing_http_op", scanners: [
         Scanners::SSRFScanner
       ])
 
@@ -57,12 +57,10 @@ module Aikido::Zen
 
               connection = OutboundConnection.from_uri(URI(request.url))
 
-              settings = Aikido::Zen.runtime_settings
-
               unless Aikido::Zen.request_bypassed?
                 Aikido::Zen.track_outbound(connection)
 
-                if settings.block_outbound?(connection)
+                if Aikido::Zen.block_outbound?(connection)
                   Sinks::DSL.presafe do
                     raise OutboundConnectionBlockedError.new(connection)
                   end

data/lib/aikido/zen/sinks/pg.rb

@@ -3,7 +3,7 @@
 module Aikido::Zen
   module Sinks
     module PG
-      SINK = Sinks.add("pg", scanners: [Scanners::SQLInjectionScanner])
+      SINK = Sinks.add("pg", "sql_op", scanners: [Scanners::SQLInjectionScanner])
 
       module Helpers
         # For some reason, the ActiveRecord pg adaptor does not wrap exceptions

data/lib/aikido/zen/sinks/resolv.rb

@@ -6,7 +6,7 @@ require_relative "../scanners/ssrf_scanner"
 module Aikido::Zen
   module Sinks
     module Resolv
-      SINK = Sinks.add("resolv", scanners: [
+      SINK = Sinks.add("resolv", "outgoing_http_op", scanners: [
         Scanners::StoredSSRFScanner,
         Scanners::SSRFScanner
       ])

data/lib/aikido/zen/sinks/socket.rb

@@ -10,7 +10,7 @@ module Aikido::Zen
     # there's no way to access the internal DNS resolution that happens in C
     # when using the socket primitives.
     module Socket
-      SINK = Sinks.add("socket", scanners: [
+      SINK = Sinks.add("socket", "outgoing_http_op", scanners: [
         Scanners::StoredSSRFScanner,
         Scanners::SSRFScanner
       ])

data/lib/aikido/zen/sinks/sqlite3.rb

@@ -3,7 +3,7 @@
 module Aikido::Zen
   module Sinks
     module SQLite3
-      SINK = Sinks.add("sqlite3", scanners: [Scanners::SQLInjectionScanner])
+      SINK = Sinks.add("sqlite3", "sql_op", scanners: [Scanners::SQLInjectionScanner])
 
       module Helpers
         def self.scan(query, operation)

data/lib/aikido/zen/sinks/trilogy.rb

@@ -3,7 +3,7 @@
 module Aikido::Zen
   module Sinks
     module Trilogy
-      SINK = Sinks.add("trilogy", scanners: [Scanners::SQLInjectionScanner])
+      SINK = Sinks.add("trilogy", "sql_op", scanners: [Scanners::SQLInjectionScanner])
 
       module Helpers
         def self.scan(query, operation)

data/lib/aikido/zen/sinks/typhoeus.rb

@@ -5,7 +5,7 @@ require_relative "../sink"
 module Aikido::Zen
   module Sinks
     module Typhoeus
-      SINK = Sinks.add("typhoeus", scanners: [
+      SINK = Sinks.add("typhoeus", "outgoing_http_op", scanners: [
         Aikido::Zen::Scanners::SSRFScanner
       ])
 
@@ -24,12 +24,10 @@ module Aikido::Zen
 
         connection = Aikido::Zen::OutboundConnection.from_uri(URI(request.base_url))
 
-        settings = Aikido::Zen.runtime_settings
-
         unless Aikido::Zen.request_bypassed?
           Aikido::Zen.track_outbound(connection)
 
-          if settings.block_outbound?(connection)
+          if Aikido::Zen.block_outbound?(connection)
             raise OutboundConnectionBlockedError.new(connection)
           end
         end

data/lib/aikido/zen/version.rb

@@ -2,7 +2,7 @@
 
 module Aikido
   module Zen
-    VERSION = "1.7.2"
+    VERSION = "1.8.0"
 
     # The version of libzen_internals that we build against.
     LIBZEN_VERSION = "0.1.61"

data/lib/aikido/zen.rb

@@ -224,6 +224,14 @@ module Aikido
       collector.track_outbound(connection)
     end
 
+    # @param connection [Aikido::Zen::OutboundConnection]
+    # @return [Boolean] whether this outbound connection should be blocked.
+    def self.block_outbound?(connection)
+      return false if current_context&.protection_disabled?
+
+      runtime_settings.block_outbound?(connection)
+    end
+
     # Track statistics about the result of a Sink's scan, and report it as
     # an Attack if one is detected.
     #

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aikido-zen
 version: !ruby/object:Gem::Version
-  version: 1.7.2
+  version: 1.8.0
 platform: ruby
 authors:
 - Aikido Security
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-08-17 00:00:00.000000000 Z
+date: 2026-08-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby