Skip to main content

Release Notes — June 2026

Levo Team
Levo Team
Product & Engineering

Release period: June 1 – June 30, 2026

June brought major upgrades to authentication testing and AI Security policy controls, faster performance across the platform, new integrations, and a rebuilt scheduled reporting engine.

Highlights​

  • Pre-flight authentication validation — API tests now validate auth and target reachability before they run, with a one-click Check Auth button and a new replay-trace editor for crafting requests from captured traffic.
  • Smarter web application scanning — Our DAST engine adds SSO tile-click handoff, better OTP and passwordless login handling, and lets you seed a scan with your own OpenAPI spec.
  • Safer, more flexible AI Security policies — Monitor-mode policies no longer block traffic, bad policy updates fail safe, and you can manage multiple AI provider keys per workspace with live model discovery.
  • Faster everywhere — Findings, traces, test runs, and organization pages load dramatically faster across the platform.
  • New integrations: Slack, Microsoft Teams & Google SecOps (Chronicle) — new notification channels and SIEM export, plus one unified page to manage Jira, Checkmarx, and AI provider connections.
  • Scheduled reporting, rebuilt — scheduled reports now run on a more reliable engine with full run history, and async exports can span every environment in a workspace.

API Discovery & Cataloging​

  • New: Applications can now be automatically named based on IP and network-mapping rules, reducing manual cleanup of endpoint inventories.
  • New: Discover APIs directly from source code with expanded language support (including Rust) and a configurable scan timeout so large codebases no longer stall.
  • Improved: One-click refresh of an application's OpenAPI spec, plus cleaner spec exports that omit sample/trace values for easier sharing.
  • Fixed: OpenAPI/Swagger 2.0 imports failing when schemas used a boolean required field.
  • Fixed: Endpoint renames that were incorrectly storing a wildcard path segment as a named parameter.

API Security Testing​

  • New: Pre-flight authentication checks validate credentials and target reachability before a test run starts, with a one-click Check Auth button to confirm auth is working.
  • New: Replay-trace editor lets you craft and re-run a request from any captured trace directly in the UI.
  • New: Validation for pre/post-processor (hooks) scripts now catches undefined names and syntax errors before a test run.
  • Improved: Selected test categories are now preserved between sessions, and empty-category test runs are blocked before they start.
  • Improved: Test runners now distinguish cloud vs. on-prem mode and show the runner group name in the Test Runners table.
  • Fixed: Test-run summaries and re-run status filters reporting incorrect or "unknown" statuses.
  • Fixed: Mass-assignment tests crashing on requests with no body.

Web Application Scanning (DAST)​

  • New: Upload your own OpenAPI/Swagger spec at scan time to seed a web application scan.
  • New: SSO tile-click handoff support for Okta-fronted login pages, plus improved handling of segmented, paste-only OTP entry and passwordless multi-step logins.
  • Improved: Broader ASP.NET WebForms support, including postback handling and session persistence, with fewer false positives on authentication and JWT checks.
  • Improved: Vulnerability and API test-run links now appear directly on scan details for faster triage.
  • Fixed: Scans that could crash with a blank scan ID.
  • Fixed: Reduced false positives on information-disclosure findings for non-standard servers.

AI Security​

  • New: Manage multiple labelled AI provider keys per workspace, with per-scan key selection and live model discovery across LLM providers.
  • Improved: The AI policy engine now keeps the last known-good policy set if it receives a suspicious empty policy update, preventing an unintended fail-open or fail-closed state.
  • Improved: Monitor-mode AI policies no longer block traffic — only enforcing policies do, matching expected behavior.
  • Improved: New governance rule conditions: CIDR-based identity matching, pre-validated JWT claims, and access to caller identity in custom rules.
  • Fixed: AI Firewall (Vigil) findings being suppressed under certain sanitization and naming-drift conditions.

Vulnerabilities & Findings​

  • New: Grouped Findings view is now the default, making related vulnerabilities easier to scan at a glance.
  • Improved: Jira ticketing now defaults to Levo's native integration, with a backfill for existing findings.
  • Improved: Findings, endpoint, and organization pages now load dramatically faster.
  • Fixed: Vulnerability summaries not rendering for API test findings with long names.
  • Fixed: Test-run vulnerability histograms now degrade gracefully instead of hiding findings when a run terminates abnormally.

Sensors & Deployment​

  • New: The on-prem components dashboard now includes dedicated Satellite and Tagger tabs, each showing live heartbeat status.
  • New: Added support for the Tagger on-prem component type during onboarding, plus direct-to-storage file uploads for on-prem setup.
  • Improved: The eBPF Sensor now exposes capture-to-span metrics and detects untraced TLS/non-HTTP traffic for easier troubleshooting.
  • Improved: IIS Filter adds configurable allowlists and per-endpoint rate limiting; installer packages are now code-signed.
  • Fixed: Resolved outstanding CVEs in the PCAP Sensor image and fixed an HTTP/2 session bug that could break long-lived connections.

Integrations​

  • New: Slack and Microsoft Teams notification channels, with a unified management page for Jira, Checkmarx, and AI provider connections.
  • New: Google SecOps (Chronicle) SIEM integration for sending findings and events to Chronicle.
  • Improved: Organizations using LDAP/Keycloak group mapping are now added automatically, without manual approval.

Reporting & Compliance​

  • New: Scheduled reports now run on a more reliable orchestration engine, with a run-history view in the UI.
  • New: Workspace-scoped async report exports let you export across all environments at once.
  • Improved: API changelog reports are now restricted to PDF for consistent formatting, with scheduling fixes.

MCP Server​

  • Fixed: Remote MCP clients (including VS Code) being rejected with an invalid-host error.
  • Fixed: OAuth metadata requests failing under compression.
  • Fixed: MCP server logs are now structured JSON, and custom test-validation bundles are assembled correctly.

Platform, Administration & Access​

  • New: Admins can now activate or disable user accounts with toast confirmations, plus an "All Time" filter on the user list.
  • New: Audit trail and BCC support added to the user-invite flow; disabled users now get a clear error instead of a generic login failure.
  • Improved: Support tickets now accept log files, archives, and text file attachments, plus screenshot uploads via a secure signed URL.
  • Fixed: Several backend memory-related crash loops that could interrupt testing, reporting, and onboarding under load.
  • Fixed: Breadcrumb navigation redirecting to the wrong screen in some flows.