Skip to main content

Release Notes — June 2026

Levo Team
Levo Team
Product & Engineering

Release period: June 1 – June 30, 2026

June brought major upgrades to authentication testing and AI Security policy controls, faster performance across the platform, new integrations, and a rebuilt scheduled reporting engine.

Highlights​

  • Pre-flight authentication validation — API tests now validate auth and target reachability before they run, with a one-click Check Auth button and a new replay-trace editor for crafting requests from captured traffic.
  • Smarter web application scanning — Our DAST engine adds SSO tile-click handoff, better OTP and passwordless login handling, and lets you seed a scan with your own OpenAPI spec.
  • Safer, more flexible AI Security policies — Monitor-mode policies no longer block traffic, bad policy updates fail safe, and you can manage multiple AI provider keys per workspace with live model discovery.
  • Faster everywhere — Findings, traces, test runs, and organization pages load dramatically faster across the platform.
  • New integrations: Slack, Microsoft Teams & Google SecOps (Chronicle) — new notification channels and SIEM export, plus one unified page to manage Jira, Checkmarx, and AI provider connections.
  • Scheduled reporting, rebuilt — scheduled reports now run on a more reliable engine with full run history, and async exports can span every environment in a workspace.

API Discovery & Cataloging​

New Features​

  • Applications can now be automatically named based on IP and network-mapping rules, reducing manual cleanup of endpoint inventories.
  • Discover APIs directly from source code with expanded language support (including Rust) and a configurable scan timeout so large codebases no longer stall.
  • One-click refresh of an application's OpenAPI spec, plus cleaner spec exports that omit sample/trace values for easier sharing.

Resolved Issues​

  • OpenAPI/Swagger 2.0 imports fail when schemas use a boolean required field.
  • Endpoint renames incorrectly store a wildcard path segment as a named parameter.

API Security Testing​

New Features​

  • Pre-flight authentication checks — Credentials and target reachability are validated before a test run starts, with a one-click Check Auth button to confirm auth is working.
  • Replay-trace editor — Craft and re-run a request from any captured trace directly in the UI.
  • Validation for pre/post-processor (hooks) scripts now catches undefined names and syntax errors before a test run.
  • Selected test categories are now preserved between sessions, and empty-category test runs are blocked before they start.
  • Test runners now distinguish cloud vs. on-prem mode and show the runner group name in the Test Runners table.

Resolved Issues​

  • Test-run summaries and re-run status filters report incorrect or "unknown" statuses.
  • Mass-assignment tests crash on requests with no body.

Web Application Scanning (DAST)​

New Features​

  • Upload your own OpenAPI/Swagger spec at scan time to seed a web application scan.
  • SSO tile-click handoff support for Okta-fronted login pages, plus improved handling of segmented, paste-only OTP entry and passwordless multi-step logins.
  • Broader ASP.NET WebForms support, including postback handling and session persistence.
  • Vulnerability and API test-run links now appear directly on scan details for faster triage.

Resolved Issues​

  • Scans can crash with a blank scan ID.
  • False positives on information-disclosure findings for non-standard servers.
  • False positives on authentication and JWT checks.

AI Security​

New Features​

  • Manage multiple labelled AI provider keys per workspace, with per-scan key selection and live model discovery across LLM providers.
  • New governance rule conditions: CIDR-based identity matching, pre-validated JWT claims, and access to caller identity in custom rules.

Resolved Issues​

  • A suspicious empty policy update replaces the policy set, causing an unintended fail-open or fail-closed state. The engine now keeps the last known-good policy set.
  • Monitor-mode AI policies block traffic. Only enforcing policies do now, matching expected behavior.
  • AI Firewall (Vigil) findings are suppressed under certain sanitization and naming-drift conditions.

Vulnerabilities & Findings​

New Features​

  • Grouped Findings by default — The Grouped Findings view is now the default, making related vulnerabilities easier to scan at a glance.
  • Jira ticketing now defaults to Levo's native integration, with a backfill for existing findings.
  • Findings, endpoint, and organization pages now load dramatically faster.

Resolved Issues​

  • Vulnerability summaries do not render for API test findings with long names.
  • Test-run vulnerability histograms hide findings when a run terminates abnormally. They now degrade gracefully.

Sensors & Deployment​

New Features​

  • The on-prem components dashboard now includes dedicated Satellite and Tagger tabs, each showing live heartbeat status.
  • Added support for the Tagger on-prem component type during onboarding, plus direct-to-storage file uploads for on-prem setup.
  • The eBPF Sensor now exposes capture-to-span metrics and detects untraced TLS/non-HTTP traffic for easier troubleshooting.
  • IIS Filter adds configurable allowlists and per-endpoint rate limiting; installer packages are now code-signed.

Resolved Issues​

  • Outstanding CVEs in the PCAP Sensor image.
  • An HTTP/2 session bug that can break long-lived connections.

Integrations​

New Features​

  • Slack and Microsoft Teams notification channels — With a unified management page for Jira, Checkmarx, and AI provider connections.
  • Google SecOps (Chronicle) SIEM integration — Send findings and events to Chronicle.

Resolved Issues​

  • Organizations using LDAP/Keycloak group mapping require manual approval before users are added. They are now added automatically.

Reporting & Compliance​

New Features​

  • Scheduled reports now run on a more reliable orchestration engine, with a run-history view in the UI.
  • Workspace-scoped async report exports let you export across all environments at once.
  • API changelog reports are now restricted to PDF for consistent formatting.

Resolved Issues​

  • Scheduling issues in API changelog reports.

MCP Server​

Resolved Issues​

  • Remote MCP clients (including VS Code) are rejected with an invalid-host error.
  • OAuth metadata requests fail under compression.
  • MCP server logs are not structured JSON.
  • Custom test-validation bundles are assembled incorrectly.

Platform, Administration & Access​

New Features​

  • Admins can now activate or disable user accounts with toast confirmations, plus an "All Time" filter on the user list.
  • Audit trail and BCC support added to the user-invite flow.
  • Support tickets now accept log files, archives, and text file attachments, plus screenshot uploads via a secure signed URL.

Resolved Issues​

  • Disabled users get a generic login failure instead of a clear error.
  • Several backend memory-related crash loops that can interrupt testing, reporting, and onboarding under load.
  • Breadcrumb navigation redirects to the wrong screen in some flows.