[iacobdaniel]

Count how many requests match each monitored and blocked IP list and each bot list, and send the counts as stats.ipAddresses.breakdown and stats.userAgents.breakdown. The counts are taken in the background process, where the firewall lists are checked.

[aikido-pr-checks]

🟡 Medium - Malformed firewall metadata can fail open the blocking check

A firewall-list response containing an array/object as a list or user-agent detail key can reach the per-request matcher because the refresh accepts those keys without validation. The new breakdown update uses each key as a dictionary key before returning the block result, so the unhashable value raises in the background IPC handler and the request-side failure path treats the check as non-blocking. A remote request matching the affected IP or user-agent therefore proceeds despite an active global block rule.

Show fix

Validate list and user-agent detail keys as strings (and reject or skip malformed entries) before publishing them to the live firewall state; additionally keep statistics collection non-fatal to the block decision so a reporting error cannot suppress a deny result.

_{More info - Reply on this comment to give feedback or ignore the issue.}