Skip to main content

Release Notes — September 1–8, 2026

Levo Team
Levo Team
Product & Engineering

Release period: September 1, 2026 – September 8, 2026 (partial month)

A short but active stretch: a new API discovery source, two new integrations, and an overhauled component health monitoring experience, alongside a batch of accuracy and reliability fixes across security testing and web application scanning.

Highlights​

  • Kong Gateway discovery source — import API routes directly from Kong, export Kong metadata, and publish specs to Levo from CI.
  • New WSO2 connector — push discovered APIs straight to a WSO2 gateway.
  • New Linear integration — create and track Linear tickets directly from vulnerability findings.
  • Component health monitoring, overhauled — clearer Down vs. Stale status, environment-scoped alerting, bulk actions, and restored snooze.
  • Deeper form-encoded test coverage — security tests now fully parameterize form-encoded request bodies instead of dropping values.
  • Custom report columns — choose exactly which columns appear in generated and scheduled reports.

API Discovery & Cataloging​

  • New: Kong Gateway integration — import API routes directly from Kong as a discovery source, export Kong metadata, and publish specs to Levo from CI.
  • New: Source-code API discovery now supports Go, in addition to existing languages.
  • Improved: GraphQL endpoint discovery when your API is served from a custom base path.
  • Fixed: An issue where authentication settings on manually pushed API specs could be discarded.
  • Fixed: Duplicate entries appearing in the tag filter dropdown.
  • Fixed: Occasional failures when tagging endpoints in bulk.
  • Fixed: Stray characters in captured endpoint parameters that could corrupt discovery data.

API Security Testing​

  • New: Test plans support pre- and post-processor hooks on authentication requests, and a fill-in table for headers fetched at test time.
  • Improved: Security tests now fully parameterize form-encoded request bodies instead of dropping producer values, for deeper mutation coverage.
  • Fixed: JWT security tests skipping attacks when a conditional-GET baseline returned a 304, and no longer flag a front-end single-page-app shell as a JWT bypass.
  • Fixed: CORS test results no longer report duplicate findings per probe — collapsed into a single finding.
  • Fixed: A CLI import crash affecting some environments, and reduced unnecessary CLI access-token refreshes.
  • Fixed: Corrected the security-test rate-limit label to show requests per minute.
  • Fixed: A memory issue that could crash the test-run results page under heavy load.
  • Fixed: Duplicate ticket attachments when a test run's finalization step ran more than once.

Web Application Scanning (DAST)​

  • Improved: Scan reliability and accuracy: guards against scan-budget starvation, fewer false positives on single-page-app .env files, better identity-provider fuzzing, and smarter AI-crawl steering.
  • New: Form-based login detection now recognizes identifier-first (mobile/phone) logins, and honors a custom login URL.

Vulnerabilities & Findings​

  • Fixed: Findings being incorrectly closed when a test case existed but wasn't actually executed.
  • Fixed: Narrowed a finding's evidence/proof bundle to only the assertion that produced it, avoiding misleading evidence.

Sensors & Deployment​

  • Improved: Overhauled component health monitoring: clearer Down vs. Stale status, environment-scoped alerting with sensible defaults and renotify intervals, single and bulk delete for retired components, and restored the ability to snooze alerts.
  • New: Hosted satellite assignment can now be overridden at the organization level.
  • Fixed: Sensors keep running on their last-known-good configuration if they briefly lose contact with the control plane.
  • Fixed: Component health status shown in alerts not matching the UI, and corrected which environments display for taggers vs. satellites.

Integrations​

  • New: WSO2 push-to-gateway connector.
  • New: Linear integration — create and track Linear tickets directly from vulnerability findings.
  • New: Added support for Google Workspace SSO login.
  • Fixed: SIEM export to Google Chronicle using an incorrect Asia region hostname — now correctly resolves to the Mumbai region.
  • Fixed: Jira ticket descriptions losing formatting — now rendered correctly as rich text.
  • Fixed: SSO login failures when a user's email casing differed between the identity provider and Levo.
  • Fixed: Burp extension: logs now print to the Output panel instead of the Event log, plus stability fixes for async publish and a race condition on the legacy API.

Reporting & Compliance​

  • New: Choose exactly which columns appear in generated and scheduled reports.
  • Improved: Streamlined the Reports page by removing the Component Status Report card and requiring explicit column selection.

Platform, Administration & Access​

  • Fixed: Application deletion leaving an app partially removed from the service graph.
  • Fixed: Notification destinations are now validated as proper URLs at save time, preventing broken alert configs.