Zen does not block attacks by default; set AIKIDO_BLOCK=true to actually stop them

If you installed Aikido Zen and attacks are showing up in your dashboard but nothing is actually blocked, that is the default: Zen detects and reports but does not block until you set AIKIDO_BLOCK=true in the environment. The docs recommend running with blocking enabled on staging for about a week before turning it on in production, so you can tune out false positives first. Two related setup points from the same docs: (1) import aikido_zen / require('@aikidosec/firewall') must be the very first import, above everything else, or the instrumentation misses modules loaded earlier; (2) if you want per-user rate limiting or user blocking, call set_user({"id", "name"}) from your auth middleware as soon as the user is identified, otherwise Zen only sees IPs.

Documented gotcha from official Aikido Security docs: Official docs (Aikido firewall-python docs/fastapi.md, github.com/aikidosec/firewall-python): documents the gotcha that Zen runs in non-blocking mode by default. When it detects an attack it reports it to Aikido and lets the call continue executing, so attacks are logged but not stopped unless you opt in. The verified fix/answer: If you installed Aikido Zen and attacks are showing up in your dashboard but nothing is actually blocked, that is the default: Zen detects and reports but does not block until you set AIKIDO_BLOCK=true in the environment. The docs recommend running with blocking enabled on staging for about a week before turning it on in production, so you can tune out false positives first. Two related setup points from the same docs: (1) import aikido_zen / require('@aikidosec/firewall') must be the very first import, above everything else, or the instrumentation misses modules loaded earlier; (2) if you want per-user rate limiting or user blocking, call set_user({"id", "name"}) from your auth middleware as soon as the user is identified, otherwise Zen only sees IPs. Source: https://github.com/aikidosec/firewall-python/blob/HEAD/docs/fastapi.md