Skip to main content

Release Notes — July 2026

Levo Team
Levo Team
Product & Engineering

Release period: July 1 – July 31, 2026

This month's release focuses on making your API inventory easier to trust and act on — clearer endpoint activity data, safer parameter editing, broader DAST framework coverage, and a more reliable test-run experience.

Highlights​

  • Smarter test-run cancellation — Canceling a test run now cleanly stops in-flight test cases and suites, and cancelled runs stay reliably marked as cancelled instead of drifting back to a stale status.
  • See exactly when an API was last called — New "Last API Call Time" tracking, surfaced on Applications and Endpoints, plus an API Surface view that rolls up related endpoints so you can spot inactive or unused APIs at a glance.
  • Rename path parameters without breaking your inventory — Rename a path parameter directly from the endpoint detail page; the change is versioned and propagates to specs, exports, and test plans.
  • DAST coverage for legacy web frameworks — Web app scans now recognize and test legacy stacks (Classic ASP, ColdFusion, Struts/JSP, CGI/Perl), with fewer false positives along the way.
  • Validate rules before they go live — New live-test tooling lets you confirm a passive-scan test rule or auto-tagging rule behaves as expected against real traffic before enabling it broadly.
  • Self-service PCAP Sensor configuration — A new Administration page lets you manage PCAP Sensor settings directly, with sensors polling for and applying configuration changes automatically.

API Discovery & Cataloging​

  • New: API Surface view rolls up related endpoints into a single logical entry, with per-instance environment links.
  • New: Track "Last API Call Time" for every endpoint and application, surfaced in the Applications and Endpoints tables, so you can identify inactive APIs.
  • New: Rename path parameters directly from the endpoint detail page; the rename is versioned and reflected in specs, exports, and test plans.
  • New: Add, edit, and manage request parameters (query, header, path) inline on API Specifications, sourced from Levo's own parameter inventory.
  • New: Validate and live-test auto-tagging rules against real traffic before rolling them out.
  • Improved: Endpoint CSV export now splits key:value tags into separate columns, and all-environments exports include full per-environment detail.
  • Improved: Source-code scanning (used to discover APIs from your repositories) adds a targeted spec-import option and smarter, language-aware file discovery for large codebases.
  • Improved: General tag management and table polish: column aliases, resizable and pinned columns, and clearer tag UX.
  • Fixed: Dark-mode contrast issues and several cases where API Surface or endpoint tables rendered empty or stale data.
  • Fixed: Large Postman collection imports no longer produce mismatched endpoint counts.

API Security Testing​

  • New: Cooperative test-run cancellation: canceling a run now stops in-flight suites and cases and keeps the run reliably marked as cancelled.
  • New: Whole-request parameterization: drive every field of a test request from your parameter inventory, with a one-click reset-to-baseline.
  • New: Cross-user (BOLA) testing now supports two-phase correlation and substitute-attack flows for broader coverage.
  • New: Validate and live-test passive scan rules against real traffic before enabling them.
  • Improved: Test Run Configuration now shows the full set of testing categories, evidence, and skip reasons instead of truncating them.
  • Improved: On-prem test runner selection is now available directly from the on-prem installation setup.
  • Fixed: Test runs that could get stuck or roll up to the wrong final status after cancellation, errors, or partial completion.
  • Fixed: Test run summary counts now reflect real per-case statuses instead of showing "unknown".
  • Fixed: Corrected several test-category evidence issues (CORS, Fuzz, OS Command Injection, Server Version Disclosure) that produced misleading or garbled results.

Web Application Scanning (DAST)​

  • New: Added scanning support for legacy web frameworks: Classic ASP, ColdFusion, Struts/JSP, and CGI/Perl.
  • Improved: Reduced false positives and cross-page noise in scan results, including improved multi-step SSO login and anti-bot detection handling.
  • Fixed: Broken breadcrumb and header navigation in the DAST scan details pages.

AI Security​

  • New: Early-access conversational assistant for exploring your API security posture is rolling out to select workspaces.

AI Discovery​

  • Fixed: Malformed AI-model import requests that returned unclear errors during AI asset discovery.

Vulnerabilities & Findings​

  • Improved: Vulnerability solution and remediation doc links now resolve correctly for your specific deployment.
  • Fixed: A crash exporting vulnerability findings when the environment filter was empty on a workspace-wide report.

Sensors & Deployment​

  • New: PCAP Sensor gains a dedicated configuration page (with a starter template) in Administration, plus remote config polling and self-seeding so sensors pick up new settings automatically.
  • Improved: Sensor health reporting now includes host and pod IP details, and the eBPF Sensor ships an aarch64 (ARM) package for Amazon Linux.
  • Improved: The eBPF Sensor automatically restarts its background service if it stops unexpectedly, and PCAP Sensor CPU/memory usage is now capped on Windows.
  • Fixed: Improved reliability of on-prem component (Satellite/Tagger) heartbeats and inventory, including surfacing each component's upstream IP on the Sensors page.

Integrations​

  • Improved: Jira integration adds a Validate button, multi-domain support, and clearer error messages when a connection or ticket action fails.

Reporting & Compliance​

  • Improved: Scheduled reports now support "all environments" and include Environment, API Type, and Authentication details for each covered application.

MCP Server​

  • Fixed: The Levo MCP server serving responses from the wrong backend environment in production and India (ganga) deployments.
  • Fixed: A test-suite-details tool that silently capped results at 10 items while reporting only one page was available.

Platform, Administration & Access​

  • New: Notification preferences redesigned: enable or disable per event type, set category defaults, and mute globally, with a clearer notifications UI.
  • Improved: Audit logs are more complete and readable, including administrative actions and clearer endpoint-delete summaries.
  • Improved: Support attachment upload limit raised from 10MB to 100MB.
  • Fixed: Navigation so DAST Runners and AI Gateway pages are gated by their own feature flags instead of unrelated ones.
  • Fixed: An issue where deleting an environment didn't surface the underlying error message.
  • Fixed: Cases where a failure loading the permission tree could block access instead of failing safely closed.