Skip to main content

Release Notes — August 2026

Levo Team
Levo Team
Product & Engineering

Release period: August 1 – August 31, 2026

August was a big month for coverage and visibility: a major expansion of web application scan checks, sharper AI Firewall detection, and a redesigned view into every on-prem component's health.

Highlights​

  • Redesigned Component Health monitoring — snooze, retire, or filter on-prem components by sensor type, with alerts routed to Slack, email, and Teams.
  • Dozens of new web application (DAST) checks — TLS posture, SAML/SSO attacks, session security, injection rules, and more, alongside smarter AI-driven crawling of modern single-page apps.
  • Sharper AI Firewall detection — indirect prompt-injection detection accuracy jumped substantially, with new scanning of MCP tool results and configurable fail-open/fail-closed policies.
  • Business Applications (early access) — group related endpoints and services into a single application view.
  • Google Workspace Enterprise SSO — sign in with Google Workspace as an enterprise identity provider.
  • Expanded reporting — new API Inventory PDF, API Surface CSV, and Component Status exports, plus more accurate environment scoping across reports.

API Discovery & Cataloging​

  • New: Business Applications (early access) — group related endpoints and services into a single application view, with CSV import support.
  • Improved: Discovering APIs from source code is now faster and more reliable, with full support for Ruby repositories and clearer scan-status reporting.
  • Improved: OpenAPI specs generated from captured traffic now include OAuth2 and SCRAM authentication scheme details, and refresh automatically whenever auth configuration changes.
  • Improved: Endpoint labels now carry across gateway tags (including Kong) and OpenAPI operation tags when endpoints are imported.

API Security Testing​

  • New: Run tests directly from the CLI, with a dedicated source column so CLI, scheduled, and on-prem runs are always clearly distinguished.
  • Improved: The active test runner group is now shown on the Test Run configuration tab, and on-prem runner lists now surface every group, not just the default.
  • Improved: Clearer messaging when a test case is skipped, a test plan fails to export, or the underlying test framework is missing or out of date, instead of a silent failure.
  • Improved: More accurate, better-evidenced test verdicts across JWT, authorization (BFLA), CORS, and remote-code-execution test cases.
  • Fixed: Test plans being silently renamed when created, and CLI runs being mislabeled as on-prem runs.
  • Fixed: The CLI test runner image is smaller and now runs headless, with clearer errors when it can't reach its backend service (including proxy and private certificate authority issues).

Web Application Scanning (DAST)​

  • New: Multi-step login and additional login fields are now supported end-to-end in the scan wizard, with a workspace-specific LLM key you choose for AI-driven scanning.
  • New: Major expansion of scan coverage: TLS transport-posture testing (protocols, cipher suites, key exchange, certificates), SAML/SSO assertion attacks, CAPTCHA bypass detection, CSV/export formula injection, CSS/SSI/XSLT/ORM injection, web cache deception, JSONP/JSON hijacking, blind XPath/LDAP injection, predictable session identifiers, WAF/CDN fingerprinting, IP-restriction bypass detection, and third-party component (SCA/SBOM) inventory.
  • Improved: AI-driven crawling now recovers routes from micro-frontend bundles and hash-router single-page apps, with better safety guardrails (logout and re-auth pacing) and more accurate crawl telemetry.
  • Fixed: AI-assisted crawling aborting when the initial page load stalled, and improved recovery from a degraded crawl session.

AI Security​

  • New: The AI Gateway now scans MCP tool results, resource reads, and prompt listings for indirect prompt injection, with improved alert correlation and tool-output attribution.
  • New: Configurable prompt-injection detection threshold with a fail-open/fail-closed mode, now available across every ML-based scanner in the AI Gateway and AI Firewall.
  • Improved: Indirect prompt-injection detection accuracy jumped substantially, powered by a new provenance-aware scanner.
  • Improved: Streaming responses are now inspected incrementally as they arrive, and governance policies now apply correctly to previously unregistered MCP hosts.
  • Fixed: Oversized request bodies bypassing inspection, and hardened certificate validation in the AI Firewall's data path.

Sensitive Data​

  • Improved: Credentials are now masked inside base64-encoded interaction bodies and redacted from vulnerability report artifacts, with an exemption available for Levo support and org owners.
  • Fixed: Disabled PII types are now excluded from sensitive-data reports, and PII findings are no longer silently dropped when a report run hits a conflict.

Sensors & Deployment​

  • New: Redesigned Components page: snooze a component, mark it ephemeral or fixed, decommission it permanently, and filter by sensor type (eBPF/PCAP/IIS/Unknown) — all backed by a unified on-prem component registry with full audit-log coverage.
  • New: Component-health alerts now route to Slack, email, and Teams, with configurable per-environment alerting rules, snooze windows, and a 30-minute minimum alert interval.
  • New: Native Linux/macOS CLI test-runner installer that doesn't require Docker.
  • Improved: On-prem sensor identity, IP address, and Last Activity reporting are now more accurate, and sensor health reporting no longer leaks connections.
  • Fixed: Dropped traffic spans on configuration-refresh timeouts, out-of-memory crashes from unbounded endpoint-mapping responses, and transient message-broker disruptions that were causing failed traffic ingestion.

Integrations​

  • New: Google Workspace Enterprise SSO is now supported end-to-end, including the sign-in flow and backend handling for enterprise edge cases.

Reporting & Compliance​

  • New: API Inventory PDF export and API Surface CSV export, available as manual or scheduled reports.
  • New: Scheduled Component Status report, plus a dedicated Component Status view in the Reports UI.
  • Improved: Inventory and Dormant API reports now track last API call and are scoped correctly per environment; Applications and Findings/Vulnerabilities reports now carry accurate environment context.
  • Fixed: The API Inventory PDF report splitting cards across page breaks.

MCP Server​

  • Fixed: A case where one job's expired session could make an unrelated test-results lookup fail, and fixed duplicate suite names causing a test-case finding to disappear from results.

Platform, Administration & Access​

  • New: The roles list now supports sorting, search, filtering, and pagination, and SSO-provisioned roles can be created and assigned directly from role management in the UI.
  • New: Redesigned user management modals and Effective Access drawer for clearer permission visibility.
  • Improved: Support requests now accept CSV attachments.
  • Fixed: The permission catalog going out of sync between the UI and backend, and fixed a support-page issue that paired the wrong organization with a workspace.