Skip to main content

October 13, 2026

Levo Team
Levo Team
Product & Engineering

Released in 1.3.0, 1.3.1, 1.3.2

This release connects multiple GitHub accounts to one organization, brings AI-assisted triage to bulk vulnerability selections, and adds an authentication-bypass test for gateway path handling. Endpoint trace listings load quickly on large workspaces, AI-driven crawls spend their budget on real pages instead of filter variants, and AI-guided login now proves it actually signed in before a scan continues.

Highlights​

  • Connect several GitHub accounts to one organization — An organization can link more than one GitHub account to the Levo GitHub App, confirm each account by name before connecting, and disconnect an installation from the dashboard. The GitHub App is now listed under Integrations on both US and India SaaS.
  • Triage several vulnerabilities at once with AI — Select multiple vulnerabilities and triage them together from the bulk action bar.
  • Authentication bypass via path mutation — A new test probes gateway path-normalization and auth-ordering weaknesses using decorated paths and trusted rewrite headers. Behind a feature flag.
  • AI-guided login proves it worked — Authenticated scans only continue when the application shows a genuine signed-in session, so a scan can no longer crawl the login page while reporting itself as authenticated.
  • Endpoint trace listings stay fast on large workspaces — Filtering endpoint traces by user, status or environment now loads quickly instead of timing out where trace history is long.
  • Author, update and version custom tests — The authoring context lists an application's test users by name and role, returns only the endpoint's slice of the OpenAPI spec, and explains when no test category applies. Custom test plans can be listed by source, have their code updated under re-approval, and be read back at any earlier version.
  • Trace a passive finding back to the traffic that raised it — The Levo MCP server exposes GetFindingTraceIds and GetTracesByIds, so an AI agent can fetch the exact captured requests a passive finding came from.
  • Custom test results read as verdicts, not pass/fail — CustomTestResults and TestRunStatus report each case as "vulnerability detected" or "OK" with the supporting proof, and large runs can be paged.
  • Fewer false JWT bypass findings — JWT attack findings are no longer raised when the request was actually authorized by a different valid credential, such as a session cookie, while genuine bypasses on multi-credential endpoints are still reported.
  • Per-organization license grace periods and a named account manager — A license grace period can be set per organization, and each organization can be assigned an account manager who receives its renewal emails.
  • Custom security tests in the dashboard — Test Plans has a new Custom tests tab. Each test has a read-only page showing its code by version, with history and compare, and the approved revision runs from the same Run menu as any other plan.
  • DAST behind corporate proxies — Web application scans now work end to end through authenticated and TLS-inspecting corporate proxies, with a dedicated proxy-ready scanner image and automatic target routing.
  • Authentication you can correct — Manually set the authentication type of any endpoint with a recorded reason, define your own API key and session cookie parameter names, and see auth declared in imported OpenAPI specs reflected in the catalog.
  • Triage findings with AI — Hand a finding, or a whole set of them, to your AI coding assistant to check against the traffic it was raised from and report it as confirmed, false positive, or unproven.
  • More honest test results — Injection and fuzz checks now say when they could not test anything instead of reporting a clean pass, and single-page apps no longer trigger a cluster of false positives in DAST.
  • Safer SSO sign-in and sign-out — Levo now notices when your identity provider signs you in as a different account, and logging out ends your session everywhere, including on the identity provider.

API Discovery & Cataloging​

New Features​

  • Endpoints and Applications can be filtered by Source Type "Kong", listing the APIs that reach Levo through Kong.
  • Manual authentication type override — Security teams can set the authentication type of selected endpoints by hand, with a recorded reason, and revoke the override later to return to what observed traffic shows. Every override is written to the audit log.
  • Custom authentication parameter names — Add your own API key and session cookie parameter names for the whole workspace so Levo recognises your authentication scheme in traffic.
  • Authentication types declared in imported OpenAPI specs now appear in each endpoint's resolved authentication and in exported specs.

Resolved Issues​

  • On-Prem Deployments and the component status report no longer list Levo's own hosted satellites and taggers inside a customer's organization.
  • The On-Prem Deployments Satellites tab no longer shows Levo-hosted or legacy satellites, and its counts match the rows displayed.

API Security Testing​

New Features​

  • Authentication bypass via path mutation — Probes gateway path-normalization and auth-ordering weaknesses through decorated paths and trusted rewrite headers, with case-insensitive credential stripping and safe finding summaries. Enabled by feature flag.
  • Custom test authoring context — Authoring a custom test now lists the application's candidate test users by name and role, returns only the part of the OpenAPI specification belonging to the endpoint under test, and states when no test category applies.
  • Custom test management — Custom test plans can be listed by source, have their code updated (which sends them back for re-approval), and be read back at any earlier revision.
  • Passive finding triage and custom test authoring can be enabled for an organization as skill entitlements.
  • Custom tests tab — Test Plans has a new Custom tests tab for AI-authored custom security tests. Each test has a read-only page showing its code by version, with history and side-by-side compare, plus its setup details. Once approved, a custom test runs from the same Run menu as any other plan, and API Scans can be filtered by test type (Generated or Custom). The run page routes on-premises custom test runs to a runner group of your choice.
  • Approval is tied to the code you reviewed — Approving a custom test now requires the code revision you reviewed, so a test can never run code you did not see. The Levo dashboard, the Levo MCP tool, and the custom-test authoring skill already send it. If you call the approve API directly, send the code revision returned by the custom test code, create, or plan-details responses. On-premises deployments can temporarily restore the previous behaviour by setting CUSTOM_PLAN_REQUIRE_CODE_REVISION=false on the test-plans service.
  • Path-mutation authentication probes are on by default — AUTHN tests now include gateway path-mutation auth-bypass probes. Set LEVOAI_ENABLE_AUTHN_PATH_MUTATION=false on the runner to disable them.
  • Running a test plan with a missing or unknown plan identifier now returns a clear validation or not-found error instead of a generic failure.

Resolved Issues​

  • Remediation guidance on findings now links to documentation pages that exist.
  • Custom test validation now requires authentication, and validates an authored test by reading its code rather than executing it.
  • Security tests run from traces replay the trace that was just fetched, or the one explicitly selected, instead of the first trace ever recorded for that endpoint.
  • JWT attack findings — alg:none, embedded JWK, tampered claims and key-id injection — are no longer reported when another valid credential on the request authorized it. Unrelated credentials are stripped before replay, and endpoints that genuinely require several credentials together still report real bypasses.
  • The custom test plan list no longer omits plans that have no test mode set, and reading custom plan code no longer scans the full revision history.
  • Injection and fuzz checks are reported as skipped, with the rejecting status and count, when almost every probe was turned away with 401, 403, 404, or 405, instead of a clean "no vulnerability detected".
  • Command injection and SQL injection checks now state which parameters they tested, and skip with a specific reason when an endpoint has nothing they can inject into, instead of reporting a pass.
  • SQL injection findings are no longer raised when a server merely repeats the tested value or a database error back in a not-found or error response.
  • Cancelled test cases are reported in their own bucket instead of being counted as failures, so cancelled runs no longer show phantom failed tests.
  • Unexpected Server Error findings now use an error-handling weakness category (CWE-248), name the affected endpoint, status, and credential, and give concrete remediation steps.
  • Broken User Authentication findings now name the credential headers that were removed and the response fields that were exposed, instead of an empty or unrelated parameter list.
  • Fuzz testing reports a single finding, with its evidence attached, when an endpoint returns a server error, instead of the same error twice.
  • Scaffolded custom tests no longer get a hardcoded-URL warning for their own documentation links, and the scaffold preview shows the correct auth location (for example HEADER for a bearer token).

Web Application Scanning (DAST)​

New Features​

  • Scan through corporate proxies — DAST scans behind a corporate proxy now capture the application's API traffic, run TLS and WebSocket checks through the proxy, and work with proxies that require authentication. A new LEVOAI_CA_CERT setting trusts a TLS-inspecting proxy's root certificate, scoped to the running scan.
  • Proxy-ready scanner image — A new levoai/levoai-shadownet:<version>-proxy image routes the scanner through a bundled proxy chained to your corporate proxy (UPSTREAM_HTTP_PROXY or HTTPS_PROXY), matching the test runner's proxy image.
  • Automatic target routing — Scanners behind a proxy now route each scan's target automatically, directly when reachable and otherwise through the proxy, so targets no longer need adding to NO_PROXY by hand. A target the scanner cannot reach fails the scan immediately with a clear reason instead of producing a silent empty scan.
  • Deeper single-page app crawling — AI crawls now recover the routes an app declares in its JavaScript bundles and walk them after the agent, keep going after the agent finishes or gets stuck, and no longer stop on password-reset links, discovering several times more of large single-page apps. The crawler's built-in telemetry is disabled so no scan details leave the scanner.

Resolved Issues​

  • AI-driven crawls use more of their budget on large applications, stop revisiting filter and sort variants of pages they have already seen, and no longer report endpoints invented from JavaScript variable names.
  • AI-guided login runs its browser agent and reports success only when the application shows a real signed-in session, so scans no longer crawl the login page as though authenticated.
  • Fewer false positives on single-page apps and SSO pages: IDOR is no longer reported when every object ID returns the same app page, sensitive-path findings require evidence the app shell does not already contain, duplicated security headers and the scan's own login email are no longer flagged, postMessage handlers are judged by their actual code, and XXE and cloud-metadata SSRF are reported only on real evidence.
  • Scans behind a TLS-inspecting proxy no longer risk reporting the proxy's TLS configuration as the target's.

Vulnerabilities & Findings​

New Features​

  • Several vulnerabilities can be selected and triaged together with AI from the bulk action bar.
  • Triage with AI — Select findings, open one, expand a grouped row, or use a DAST scan's Findings tab to copy a prompt that has your AI coding assistant check each finding against the traffic it was raised from and report it as confirmed, false positive, or unproven.

Resolved Issues​

  • Requests to the rule findings API that ask for a custom sort order now return a clear "sort is not supported" error instead of silently returning a different order.

Integrations​

New Features​

  • A Levo organization can connect several GitHub accounts to the Levo GitHub App, and the GitHub App is listed under Integrations on US and India SaaS.
  • Connecting GitHub previews the account so it can be confirmed by name before linking, an installation that already exists can be connected directly, and an installation can be disconnected from the dashboard.

MCP Server​

New Features​

  • Traces behind a passive finding — GetFindingTraceIds and GetTracesByIds return the captured traffic a passive finding was raised from.
  • Custom test results and run status — CustomTestResults and TestRunStatus report a custom test run's findings as "vulnerability detected" or "OK" with proof attached. Results can be paged with maxCases (up to 1000) and the returned nextCursor; each response reports unread cases as summary.unclassified and sets complete: false when anything was left out.
  • Custom test plans can be updated and their code read back through the MCP server.

Platform, Administration & Access​

New Features​

  • A license grace period can be set per organization, and each organization can be assigned a dedicated account manager who receives its license-renewal emails.
  • SSO account-mismatch protection — For organizations signing in through Keycloak-backed SSO, Levo now detects when the identity provider signs you in as a different account than the one you asked for, instead of signing you in silently. The screen names the provider so it is clear where to sign out.
  • Full logout — Logging out now ends every active session for your account across all devices and sign-in methods, and ends your session on the identity provider's side too.
  • SSO sign-in failures show a clear, consistent error message instead of raw provider text.
  • License alerts now show your organization's Levo account manager, and Contact Account Manager emails them directly.

Resolved Issues​

  • Signing up with an email that already has a Levo account now reports that the account exists instead of a generic error.
  • Logging out with a very large session token now revokes it successfully instead of failing.
  • License status in organization lists shows the status and remaining time together, for example "Active · 35 days left"; the Choose screen's summary matches the list, and license warnings use one consistent, more readable amber.
  • Clicking a table row opens it in the same tab throughout the product, with Ctrl/Cmd-click or middle-click opening it in a new tab.
  • Generating a Satellite or TestRunner/CLI authorization key after signing in with an email and password no longer sends you to a second sign-in screen; the Keys page asks for your password in place, and the key it returns is long-lived.
  • The Satellite and CLI key pages show their heading, labels and instructions clearly in the light theme, and the "I've Saved My Key" button appears only once a key has been generated.
  • Signing in with SSO as a different account no longer leaves you signed in as that account behind the mismatch screen.