Skip to main content

Release Notes — July 2026

Levo Team
Levo Team
Product & Engineering

Release period: July 1 – July 31, 2026

This month's release focuses on making your API inventory easier to trust and act on — clearer endpoint activity data, safer parameter editing, broader DAST framework coverage, and a more reliable test-run experience.

Highlights​

  • Smarter test-run cancellation — Canceling a test run now cleanly stops in-flight test cases and suites, and cancelled runs stay reliably marked as cancelled instead of drifting back to a stale status.
  • See exactly when an API was last called — New "Last API Call Time" tracking, surfaced on Applications and Endpoints, plus an API Surface view that rolls up related endpoints so you can spot inactive or unused APIs at a glance.
  • Rename path parameters without breaking your inventory — Rename a path parameter directly from the endpoint detail page; the change is versioned and propagates to specs, exports, and test plans.
  • DAST coverage for legacy web frameworks — Web app scans now recognize and test legacy stacks (Classic ASP, ColdFusion, Struts/JSP, CGI/Perl), with fewer false positives along the way.
  • Validate rules before they go live — New live-test tooling lets you confirm a passive-scan test rule or auto-tagging rule behaves as expected against real traffic before enabling it broadly.
  • Self-service PCAP Sensor configuration — A new Administration page lets you manage PCAP Sensor settings directly, with sensors polling for and applying configuration changes automatically.

API Discovery & Cataloging​

New Features​

  • API Surface view — Rolls up related endpoints into a single logical entry, with per-instance environment links.
  • Last API Call Time — Track when every endpoint and application was last called, surfaced in the Applications and Endpoints tables, so you can identify inactive APIs.
  • Path parameter rename — Rename path parameters directly from the endpoint detail page; the rename is versioned and reflected in specs, exports, and test plans.
  • Add, edit, and manage request parameters (query, header, path) inline on API Specifications, sourced from Levo's own parameter inventory.
  • Validate and live-test auto-tagging rules against real traffic before rolling them out.
  • Endpoint CSV export now splits key:value tags into separate columns, and all-environments exports include full per-environment detail.
  • Source-code scanning (used to discover APIs from your repositories) adds a targeted spec-import option and smarter, language-aware file discovery for large codebases.
  • General tag management and table polish: column aliases, resizable and pinned columns, and clearer tag UX.

Resolved Issues​

  • Dark-mode contrast issues.
  • API Surface and endpoint tables render empty or stale data in several cases.
  • Large Postman collection imports produce mismatched endpoint counts.

API Security Testing​

New Features​

  • Cooperative test-run cancellation — Canceling a run now stops in-flight suites and cases and keeps the run reliably marked as cancelled.
  • Whole-request parameterization — Drive every field of a test request from your parameter inventory, with a one-click reset-to-baseline.
  • Two-phase cross-user (BOLA) testing — Cross-user testing now supports two-phase correlation and substitute-attack flows for broader coverage.
  • Validate and live-test passive scan rules against real traffic before enabling them.
  • Test Run Configuration now shows the full set of testing categories, evidence, and skip reasons instead of truncating them.
  • On-prem test runner selection is now available directly from the on-prem installation setup.

Resolved Issues​

  • Test runs get stuck or roll up to the wrong final status after cancellation, errors, or partial completion.
  • Test run summary counts show "unknown" instead of real per-case statuses.
  • Several test categories (CORS, Fuzz, OS Command Injection, Server Version Disclosure) produce misleading or garbled evidence.

Web Application Scanning (DAST)​

New Features​

  • Legacy web framework support — Added scanning support for Classic ASP, ColdFusion, Struts/JSP, and CGI/Perl.

Resolved Issues​

  • False positives and cross-page noise in scan results, including multi-step SSO login and anti-bot detection handling.
  • Broken breadcrumb and header navigation in the DAST scan details pages.

AI Security​

New Features​

  • Conversational assistant (early access) — An assistant for exploring your API security posture is rolling out to select workspaces.

AI Discovery​

Resolved Issues​

  • Malformed AI-model import requests return unclear errors during AI asset discovery.

Vulnerabilities & Findings​

New Features​

  • Vulnerability solution and remediation doc links now resolve correctly for your specific deployment.

Resolved Issues​

  • Exporting vulnerability findings crashes when the environment filter is empty on a workspace-wide report.

Sensors & Deployment​

New Features​

  • PCAP Sensor configuration page — A dedicated configuration page (with a starter template) in Administration, plus remote config polling and self-seeding so sensors pick up new settings automatically.
  • Sensor health reporting now includes host and pod IP details, and the eBPF Sensor ships an aarch64 (ARM) package for Amazon Linux.
  • The eBPF Sensor automatically restarts its background service if it stops unexpectedly, and PCAP Sensor CPU/memory usage is now capped on Windows.

Resolved Issues​

  • On-prem component (Satellite/Tagger) heartbeats and inventory are unreliable, and each component's upstream IP is missing from the Sensors page.

Integrations​

New Features​

  • Jira integration adds a Validate button, multi-domain support, and clearer error messages when a connection or ticket action fails.

Reporting & Compliance​

New Features​

  • Scheduled reports now support "all environments" and include Environment, API Type, and Authentication details for each covered application.

MCP Server​

Resolved Issues​

  • The Levo MCP server serves responses from the wrong backend environment in production and India (ganga) deployments.
  • A test-suite-details tool silently caps results at 10 items while reporting only one page was available.

Platform, Administration & Access​

New Features​

  • Redesigned notification preferences — Enable or disable per event type, set category defaults, and mute globally, with a clearer notifications UI.
  • Audit logs are more complete and readable, including administrative actions and clearer endpoint-delete summaries.
  • Support attachment upload limit raised from 10MB to 100MB.

Resolved Issues​

  • DAST Runners and AI Gateway pages are gated by unrelated feature flags instead of their own.
  • Deleting an environment does not surface the underlying error message.
  • A failure loading the permission tree can block access instead of failing safely closed.