Skip to main content

Release Notes — August 2026

Levo Team
Levo Team
Product & Engineering

Release period: August 1 – August 31, 2026

August was a big month for coverage and visibility: a major expansion of web application scan checks, sharper AI Firewall detection, and a redesigned view into every on-prem component's health.

Highlights​

  • Redesigned Component Health monitoring — snooze, retire, or filter on-prem components by sensor type, with alerts routed to Slack, email, and Teams.
  • Dozens of new web application (DAST) checks — TLS posture, SAML/SSO attacks, session security, injection rules, and more, alongside smarter AI-driven crawling of modern single-page apps.
  • Sharper AI Firewall detection — indirect prompt-injection detection accuracy jumped substantially, with new scanning of MCP tool results and configurable fail-open/fail-closed policies.
  • Business Applications (early access) — group related endpoints and services into a single application view.
  • Google Workspace Enterprise SSO — sign in with Google Workspace as an enterprise identity provider.
  • Expanded reporting — new API Inventory PDF, API Surface CSV, and Component Status exports, plus more accurate environment scoping across reports.

API Discovery & Cataloging​

New Features​

  • Business Applications (early access) — Group related endpoints and services into a single application view, with CSV import support.
  • Discovering APIs from source code is now faster and more reliable, with full support for Ruby repositories and clearer scan-status reporting.
  • OpenAPI specs generated from captured traffic now include OAuth2 and SCRAM authentication scheme details, and refresh automatically whenever auth configuration changes.
  • Endpoint labels now carry across gateway tags (including Kong) and OpenAPI operation tags when endpoints are imported.

API Security Testing​

New Features​

  • Run tests from the CLI — With a dedicated source column so CLI, scheduled, and on-prem runs are always clearly distinguished.
  • The active test runner group is now shown on the Test Run configuration tab, and on-prem runner lists now surface every group, not just the default.
  • Clearer messaging when a test case is skipped, a test plan fails to export, or the underlying test framework is missing or out of date, instead of a silent failure.
  • More accurate, better-evidenced test verdicts across JWT, authorization (BFLA), CORS, and remote-code-execution test cases.
  • The CLI test runner image is smaller and now runs headless.

Resolved Issues​

  • Test plans are silently renamed when created.
  • CLI runs are mislabeled as on-prem runs.
  • The CLI test runner gives unclear errors when it can't reach its backend service, including proxy and private certificate authority issues.

Web Application Scanning (DAST)​

New Features​

  • Multi-step login in the scan wizard — Multi-step login and additional login fields are now supported end to end, with a workspace-specific LLM key you choose for AI-driven scanning.
  • Major expansion of scan coverage — TLS transport-posture testing (protocols, cipher suites, key exchange, certificates), SAML/SSO assertion attacks, CAPTCHA bypass detection, CSV/export formula injection, CSS/SSI/XSLT/ORM injection, web cache deception, JSONP/JSON hijacking, blind XPath/LDAP injection, predictable session identifiers, WAF/CDN fingerprinting, IP-restriction bypass detection, and third-party component (SCA/SBOM) inventory.
  • AI-driven crawling now recovers routes from micro-frontend bundles and hash-router single-page apps, with better safety guardrails (logout and re-auth pacing) and more accurate crawl telemetry.

Resolved Issues​

  • AI-assisted crawling aborts when the initial page load stalls, and recovers poorly from a degraded crawl session.

AI Security​

New Features​

  • Indirect prompt injection scanning for MCP — The AI Gateway now scans MCP tool results, resource reads, and prompt listings for indirect prompt injection, with improved alert correlation and tool-output attribution.
  • Configurable prompt-injection detection threshold — With a fail-open/fail-closed mode, now available across every ML-based scanner in the AI Gateway and AI Firewall.
  • Indirect prompt-injection detection accuracy jumped substantially, powered by a new provenance-aware scanner.
  • Streaming responses are now inspected incrementally as they arrive.

Resolved Issues​

  • Governance policies do not apply to previously unregistered MCP hosts.
  • Oversized request bodies bypass inspection.
  • Certificate validation in the AI Firewall's data path is not strict enough.

Sensitive Data​

New Features​

  • Credentials are now masked inside base64-encoded interaction bodies and redacted from vulnerability report artifacts, with an exemption available for Levo support and org owners.

Resolved Issues​

  • Disabled PII types are included in sensitive-data reports.
  • PII findings are silently dropped when a report run hits a conflict.

Sensors & Deployment​

New Features​

  • Redesigned Components page — Snooze a component, mark it ephemeral or fixed, decommission it permanently, and filter by sensor type (eBPF/PCAP/IIS/Unknown) — all backed by a unified on-prem component registry with full audit-log coverage.
  • Component-health alerts to Slack, email, and Teams — With configurable per-environment alerting rules, snooze windows, and a 30-minute minimum alert interval.
  • Native Linux/macOS CLI test-runner installer — No Docker required.
  • On-prem sensor identity, IP address, and Last Activity reporting are now more accurate.

Resolved Issues​

  • Traffic spans are dropped on configuration-refresh timeouts.
  • Out-of-memory crashes from unbounded endpoint-mapping responses.
  • Transient message-broker disruptions cause failed traffic ingestion.
  • Sensor health reporting leaks connections.

Integrations​

New Features​

  • Google Workspace Enterprise SSO — Now supported end to end, including the sign-in flow and backend handling for enterprise edge cases.

Reporting & Compliance​

New Features​

  • API Inventory PDF and API Surface CSV exports — Available as manual or scheduled reports.
  • Scheduled Component Status report — Plus a dedicated Component Status view in the Reports UI.
  • Inventory and Dormant API reports now track last API call and are scoped correctly per environment; Applications and Findings/Vulnerabilities reports now carry accurate environment context.

Resolved Issues​

  • The API Inventory PDF report splits cards across page breaks.

MCP Server​

Resolved Issues​

  • One job's expired session can make an unrelated test-results lookup fail.
  • Duplicate suite names cause a test-case finding to disappear from results.

Platform, Administration & Access​

New Features​

  • Roles list management — The roles list now supports sorting, search, filtering, and pagination, and SSO-provisioned roles can be created and assigned directly from role management in the UI.
  • Redesigned user management — New user management modals and an Effective Access drawer for clearer permission visibility.
  • Support requests now accept CSV attachments.

Resolved Issues​

  • The permission catalog goes out of sync between the UI and backend.
  • The support page pairs the wrong organization with a workspace.