Skip to main content

SaaS Platform Services -- 1.2.135.1

Levo Team
Levo Team
Product & Engineering

Release period: v1.2.135.0 → v1.2.135.1

This release lets security teams tune API security testing per application, puts test-run cleanup under role-based control with bulk delete, and introduces a Beta Service Graph in the API catalog. It also broadens test coverage to form-encoded APIs and unauthenticated-access probes, produces cleaner OpenAPI specs for strict gateway imports, and makes on-prem component health alerts far less noisy.

Highlights​

  • Per-application security-test configuration — Override security-test settings for a single application from a new Configuration tab, with every setting clearly marked as inherited from the environment or overridden for that application. Test runs and the Run Test dialog use each application's effective settings.
  • Bulk delete for API scans, governed by roles — Select and delete API scans in bulk. Cancelling or deleting a test run is now permission-controlled, and Admin holds every delete permission across the platform.
  • Service Graph (Beta) in the API catalog — Visualize how your services call one another. Enabled per workspace from admin settings.
  • Broader API test coverage — Endpoints that accept URL-encoded form bodies are now correlated and tested like any other structured body, and Broken User Authentication tests probe for unauthenticated access even when no authenticated baseline is available.
  • Cleaner OpenAPI specs for strict importers — Specs generated from captured traffic no longer contain an invalid field type, so they import cleanly into strict external tools such as WSO2 gateways. Previously generated specs are corrected automatically on export.
  • Quieter, more accurate on-prem health alerts — Component-health alerts for large fleets arrive as one consolidated email, and a new Active / Stale / Down filter on the On-Prem Deployments screen shows component status at a glance.

API Discovery & Cataloging​

New Features​

  • Service Graph (Beta) — The API catalog gains a Service Graph showing call relationships between your services. It is enabled per workspace from admin settings and is marked Beta.

Resolved Issues​

  • OpenAPI specs generated from captured traffic contain an invalid field type, so they fail to import into strict external tools such as WSO2 gateways. Fields observed only as null now default to string, and specs generated before this release are healed automatically on export — no re-scan needed.
  • Discovering a new API endpoint that collides with an existing one discards the other newly discovered endpoints in the same catalog update, causing endpoints to go missing from the API inventory.
  • An endpoint's OpenAPI spec update is silently dropped during ingestion, and a transient read failure reports a spec as changed when it had not.
  • Service Graph node labels are hard to read in dark mode.

API Security Testing​

New Features​

  • Per-application configuration overrides — Security-test settings can now be overridden per application from a new Configuration tab on the application's Security Testing page. Each setting is marked as inherited from the environment or overridden for the application, and test runs and the Run Test dialog use the application's effective settings. The rate-limit setting now shows its unit (requests per minute) with a tooltip explaining the per-second conversion.
  • Bulk delete for API scans — API scans can be selected and deleted in bulk from the API Scans list. Bulk selection is available in workspaces with roles enabled, where the Test Runs delete permission governs it, or with a Levo account.
  • Form-encoded request bodies are now tested — Endpoints that send URL-encoded form bodies are no longer excluded from correlation and security-test generation, so their parameters are tested like any other structured body. Producer bindings that use indexed paths such as $.data[0] match correctly, and required nested fields that cannot be URL-encoded are reported as contract violations instead of failing silently.
  • Unauthenticated probe in Broken User Authentication tests — When no successful authenticated baseline is available, the test now still attempts a credential-stripped request. If the endpoint returns a genuine resource-shaped response, it is reported as a Medium, low-confidence "unconfirmed" finding. Single-page-app shells, public-by-design endpoints and status or error envelopes are suppressed, and harness or setup failures continue to skip rather than probe.

Resolved Issues​

  • A single CORS misconfiguration is reported as one finding per probe origin plus a duplicate preflight finding. It is now reported as one finding with the full probe matrix as evidence, and endpoint finding counts reflect the number of misconfigurations rather than the number of probes.
  • Test runs receive a truncated or empty OpenAPI spec for an endpoint whose specification is being updated at the same time, so tests are generated against the wrong request shape, authentication schemes and tags.
  • Test runs seed authentication from a masked or redacted trace, which causes the run to fail authentication from the first request.
  • The "rows selected" banner is inconsistent across the API, Issues, Traces, Scans and Sensitive Data lists.

Vulnerabilities & Findings​

New Features​

  • The CreateFinding API now supports an opt-in synchronous mode that returns event IDs on completion. The default asynchronous behavior is unchanged.

Resolved Issues​

  • Findings are marked resolved when the test that found them stops running, so a check dropping out of a test suite reads as a fix. A finding now clears only when its own check runs again and passes.

Sensors & Deployment​

New Features​

  • Status filter on On-Prem Deployments — Filter Satellites, Taggers, Sensors, DAST Runners and AI Gateways by Active, Stale or Down status, alongside the existing lifecycle filter.
  • Consolidated component-health alerts — Alerts for a large fleet now arrive as a single consolidated email instead of one per detection wave. The attached CSV lists components oldest-heartbeat first, and the organization name is shown again.
  • The Taggers tab on On-Prem Deployments now offers the Install Satellite action, so you can install from whichever tab you land on.

Resolved Issues​

  • Decommissioning a component sends a false "component recovered" alert.
  • Newly deployed sensors can take far longer than expected to appear on the Components dashboard after their first heartbeat. They now appear within minutes.
  • Sensor and tracer configuration fetches hang when the platform is under load. A configuration read is now bounded by a single overall time limit, so it returns promptly rather than timing out.
  • The permanent-delete confirmation dialog on On-Prem Deployments shows incorrect wording.

Reporting & Compliance​

Resolved Issues​

  • The Sensitive Data report's Endpoint Details section, and the Web App Scan report's vulnerability and finding lists, silently truncate results instead of returning the complete data set.

Integrations​

Resolved Issues​

  • SSO login fails when an identity-provider tenant's domain list is empty.
  • A tenant with no SAML or OIDC connection configured returns a generic server error instead of one naming the missing configuration.
  • Setting up SSO for an organization fails when its identity-provider tenant already exists. When the provider's tenant limit is reached, the error now states clearly that an administrator must raise it.

Platform, Administration & Access​

New Features​

  • Role-based control of test-run cancel and delete — Cancelling and deleting test runs are now governed by explicit Test Runs update and delete permissions. Owner and Admin hold them by default; other roles need them granted explicitly.
  • Expanded delete permissions — Admin now holds every delete permission across the platform, and Security Engineer can delete endpoints.
  • Role changes in the audit log — Role and permission changes now appear under their own Role resource type, with the role's identifier and permission set recorded. Assigning a role to a user is recorded as a distinct action.

Resolved Issues​

These fixes harden account security on Keycloak-backed deployments.

  • Signup bypasses email verification.
  • Email verification links use a guessable identifier instead of a signed, expiring token.
  • Disabling or deleting an account, or changing its password, does not revoke that account's existing sessions.
  • Password-reset responses reveal whether an account exists.