Skip to main content

Release Notes — March 2026

Levo Team
Levo Team
Product & Engineering

Release period: 2026-03-01 → 2026-03-31

March is a big month for web application scanning: our DAST engine matures with smarter crawling, scheduled and on-demand scans, AI/LLM-driven authentication, and a large round of false-positive reduction. We also unified AI Gateway policies with live guardrail enforcement, moved reporting to a faster async pipeline with a new application comparison report, and added configurable session management, sensor health notifications, and grouped threats.

Highlights​

  • DAST matures — Web application scans gain smart crawl depth, scheduled and re-runnable scans, deployable on-prem runners, OpenAPI spec parsing, and broad coverage of missing vulnerability categories — with a major false-positive cleanup across active and passive scanners.
  • Unified AI Gateway policies — A consolidated, gateway-level policy architecture with hot-reloaded policies from SaaS, a forward-proxy AI traffic governance pipeline, and live guardrail scanners now enabled in the AI Firewall.
  • Faster reporting with application comparison — Reports moved to an async pipeline for reliability at scale, plus a new application comparison report you can run and view in the dashboard.
  • Configurable session management — Set inactivity and absolute session timeouts, with a clear banner explaining why a session ended.
  • Sensor health notifications — Get notified when a sensor goes inactive, with configuration support so you know your traffic capture is healthy.
  • Grouped threats and richer findings — Threats are now grouped for easier triage, with evidence surfaced in the Threat Feed, severity sorting, more filters, and saved views across findings and scans.

What's new at a glance. A one-page map of where March's additions land across the Levo API and AI security platform.

March 2026 — What's new

API Discovery & Cataloging​

New Features​

  • Configurable ignored HTTP methods — API discovery can be configured to skip specific HTTP methods, keeping catalogs focused on the traffic that matters.
  • Endpoint exports now include the created date and last-trace-received date, and you can sort endpoints by when their last trace arrived.
  • Header parameters such as Content-Type and Accept are now parsed and populated automatically, and endpoint parameters are returned sorted by required status and name.
  • A new "Recently Discovered" filter at the application level, and a tooltip on Owned Domains in the API Discovery configuration.

Resolved Issues​

  • Request parameters wrap incorrectly in API specifications.
  • Masked parameters are handled incorrectly in captured request paths.

API Security Testing​

New Features​

  • Live UI log streaming per test suite for better visibility into running tests, and quieter CLI output in non-interactive mode.

Resolved Issues​

  • User-set parameter values are overwritten by newly derived values, and custom values are not preserved in raw parameters.
  • Test-run counts do not match between Insights and the API Scans page.
  • Author selection does not use organization users.

Web Application Scanning (DAST)​

New Features​

  • Scheduled and re-runnable web app scans — Schedule web app scans to run automatically, re-run a previous scan, and trigger scans from CI/CD with a new DAST scan action.
  • Smart scan depth and crawl-only mode — Scans default to a "smart" depth mode, with a crawl-only option for discovery and configurable scan depth per scan.
  • AI/LLM-driven authentication — Provide cookies, local storage keys, and headers for authenticated scans, including AI-assisted login that handles SPA re-login and CAPTCHA flows.
  • OpenAPI spec parsing and broader coverage — The scanner parses OpenAPI specs and adds support for the remaining DAST vulnerability categories, plus soft-404 detection, tech-stack detection, and stored-XSS detection.
  • Deployable on-prem scan runners — Run web app scans from deployable runners with scheduled, org-isolated execution for on-prem deployments.
  • A redesigned create-scan flow, a search bar for URLs and endpoints in the scan details view, HTTP-method support and filtering, live crawl metrics, persistent filters, saved filter state, and the ability to switch off DAST scanning selectively.
  • Endpoint URL is now captured on DAST findings and vulnerabilities, with a finding "Kind" filter (Web App Scans / Traffic / All).

Resolved Issues​

  • Large numbers of false positives across active and passive scanners, including auth-bypass, JWT, GraphQL introspection, and JSON-reflected XSS.
  • Crawling is unreliable, static assets are not filtered, soft-404s are mishandled, and scan cancellation does not work correctly.
  • The CLI fails to start.

AI Security​

New Features​

  • Unified AI Gateway policy architecture — A consolidated, gateway-level policy framework with a single policy engine, policy versioning, and policies hot-reloaded from SaaS so changes take effect without redeploying.
  • Forward-proxy AI traffic governance — A new forward-proxy mode runs AI traffic through a multi-stage governance pipeline for inline inspection.
  • Live guardrail scanners in the AI Firewall — Guardrail scanners are now implemented and enabled, with the AI Firewall and AI Gateway pages out of "coming soon."
  • Chrome extension AI Guardrails — The browser extension (now "Levo Live") adds AI Guardrails integration with LLM interception and enforce or observe modes.
  • The AI Gateway can now send its traffic to the Levo Satellite for full API observability alongside your other APIs, and ships latency benchmarks with inspection optimizations.

AI Discovery​

New Features​

  • AI traffic to the Satellite — The collector adds a Levo AI receiver and AI-proxy span processing, and full LLM request bodies are forwarded so AI agents and MCP entities are discovered accurately.

Vulnerabilities & Findings​

New Features​

  • Grouped threats and evidence — Threats are now grouped for easier triage, with evidence returned by the findings API and surfaced in the Threat Feed.
  • Bulk tag actions — Apply tag actions to findings in bulk, and sort findings by severity.
  • More filters on the Findings and Applications pages, saved filters and views on API Scans, application stats that update as you apply filters, and a stats API for consistent counts.

Resolved Issues​

  • Open-vulnerability counts do not match between Insights and the global level.
  • Bulk actions on the vulnerability pages do not work correctly.

Sensitive Data​

New Features​

  • Inline sample traces for PII — The PII tab now shows inline sample traces with row selection, pagination by type, and a refreshed view that updates as new sensitive data is discovered.

Runtime Protection​

New Features​

  • Findings and evidence from protection rules — Protection now creates findings (including for Lua-based rules) with evidence, and deduplicates rate-limit findings to one per key per window.
  • Bulk rule exclusions and header-injection rules — Add bulk rule exclusions and custom header-injection rules, with configurable content types and active WAF protection.
  • Improved rate-limit rule configuration in the dashboard, and GraphQL protection handling.
  • Blocking is now disabled by default for safer rollout, with smarter routing of rule overrides and hardened Kubernetes deployment.

Sensors & Deployment​

New Features​

  • Sensor health notifications — Get notified when a sensor becomes inactive, with configuration support so you always know your traffic capture is healthy.
  • The Java agent now logs to file with additional diagnostics for easier troubleshooting.

Resolved Issues​

  • A customer-reported Sensor Helm chart deployment issue.

Integrations​

New Features​

  • CI/CD DAST scan action — A new action to run web app scans directly from your CI/CD pipeline.

Resolved Issues​

  • Auth0 tokens are not routed by subject claim.
  • SSO-only users get a 401 on password reset.

Reporting & Compliance​

New Features​

  • Application comparison report — A new report that compares applications side by side, available to run and view in the dashboard.
  • Async reporting pipeline — Existing reports were migrated to an async architecture for reliability at scale, with additional report types added and a new Reports page in the UI.
  • Reports support multiple CSV previews, and DAST scan report findings now include a solution field and detected AI endpoints.

Resolved Issues​

  • PDFs render incorrectly in generated reports.

MCP Server​

New Features​

  • Reliability improvements to the MCP Server deployment.

Platform, Administration & Access​

New Features​

  • Configurable session management — Set inactivity and absolute session timeouts, with sensible defaults and a banner that explains why a session ended after inactivity or expiry.
  • Default "staging" environment — New organizations are created with a default "staging" environment so you can start capturing traffic immediately.
  • Redesigned admin portal login — A modernized admin portal sign-in, with consolidated frontend and backend deployment.
  • Sidebar UX improvements (peek, pin, and toggle), clicking the Levo logo returns you home, an announcements unread count, and organization list sorting with consolidated copy buttons.

Resolved Issues​

  • Cross-organization data leaks on organization switch because cached state is not cleared.
  • Pagination and filter state are lost across navigation.
  • Dark-mode rendering issues.
  • Several login and auto-logout bugs.