If you installed Aikido Zen and attacks are showing up in your dashboard but nothing is actually blocked, that is the default: Zen detects and reports but does not block until you set `AIKIDO_BLOCK=true` in the environment. The docs recommend running with blocking enabled on staging for about a week before turning it on in production, so you can tune out false positives first. Two related setup points from the same docs: (1) `import aikido_zen` / `require('@aikidosec/firewall')` must be the very first import, above everything else, or the instrumentation misses modules loaded earlier; (2) if you want per-user rate limiting or user blocking, call `set_user({"id", "name"})` from your auth middleware as soon as the user is identified, otherwise Zen only sees IPs.