July 2025 Summaries

The text explores the evolution and complexity of Traffic Policy rules, emphasizing how they have developed to handle intricate business logic by leveraging gateways for tasks such as authentication and security, thus expediting deployment processes. It discusses the importance of understanding phases in the request lifecycle—tcp_connection, on_http_request, and on_http_response—and how rules, expressions, and actions are orchestrated to manage traffic effectively. The document highlights three key patterns for creating robust policies: chaining rules in the correct order, grouping related actions to maintain clarity and predictability, and implementing failovers and catch-all rules to ensure all possible scenarios are addressed. It provides insights into the strategic use of ngrok's Traffic Policy, suggesting ways to optimize policy creation, such as using whitespace and comments for readability, and invites contributions to an example gallery to further illustrate the potential of Traffic Policy in practical applications.

A new feature called "http-request" has been added to the Traffic Policy engine, enabling users to make HTTP calls to internal services directly from their traffic policies. This enhancement allows for request validation, dynamic traffic routing, and triggering side chain events without needing additional middleware or gateways. The http-request action can be used for various purposes, such as authentication, logging, and internal routing, by integrating calls to internal or external services, like Slack and OpenAI, via ngrok's internal endpoints. This feature offers full control over traffic handling by supporting actions both before and after service requests, and includes resilience mechanisms like retry logic for handling temporary service failures. The http-request action empowers users to create sophisticated service interactions with enhanced flexibility and reliability, inviting feedback and suggestions for further improvements.

The major upgrade introduced in the developer preview of Secrets for Traffic Policy enhances the security and manageability of sensitive data, such as passwords and API keys, by allowing these values to be stored in secure, encrypted vaults rather than embedded directly in Traffic Policy configurations. This approach eliminates the risk of exposing sensitive information in cleartext, as secrets are dynamically referenced at runtime using macros and are encrypted at rest with AES-256 and in-transit with HTTPS and TLS 1.2. The centralized vault system not only improves security but also streamlines the reuse and rotation of secrets across multiple policies, ensuring consistent updates and reducing errors. However, during the developer preview phase, users should be aware of certain limitations, such as API-only configuration and potential cleartext exposure in Traffic Inspector under full capture mode. Participants in the developer preview have the opportunity to provide feedback and explore new features with early access, helping to shape the future development of this security enhancement.

Founded in 2023 by Varun Uppal, Shinobi leverages an autonomous swarm of AI agents to emulate a red-team mindset, enabling them to collaborate, escalate privileges, chain vulnerabilities, and think like real attackers. Once developers provide contextual information about a new app version, these agents autonomously seek out vulnerabilities, offering actionable insights rather than overwhelming alerts. While customers were hesitant to allow testing on production apps, Shinobi adapted by using ngrok to create public endpoints for local machines, significantly reducing setup time for penetration tests to just 15 minutes. Despite occasional challenges like internal DNS names or redirect flows, Shinobi developed unique traffic policies to maintain agent functionality and user experience. The integration of ngrok streamlined customer access, enhancing Shinobi's ability to deliver intelligent vulnerability testing efficiently, positioning its AI agents as indispensable security testers within development workflows.