Skip to main content

October 6, 2026

Levo Team
Levo Team
Product & Engineering

Released in 1.2.135.4, 1.2.135.5, 1.2.135.6, 1.2.135.7

This release is about trusting what you see. Duplicate API endpoints can now be merged in bulk, TLS findings from the Satellite are reported again after being silently absent, and scan results no longer render a vulnerable or unrecognised scan as clean. Custom AI-authored tests gain a full authoring lifecycle — create, validate, approve — with every run bound to the exact code a human reviewed. Note the breaking change to the API Surface export below before upgrading any integration that reads it.

Highlights​

  • Breaking: API Surface export column order has changed — The API Surface CSV export now matches the Endpoints report's column order, and a Tags column (one column per tag key, with an optional tag filter) has been added at the end. Integrations that parse this export by column position must be updated; those reading by header name are unaffected.
  • Merge duplicate API endpoints in bulk — Select up to 100 endpoints and collapse them into a single destination. Test cases, findings and traces attached to the merged endpoints follow the surviving endpoint, and the published specification is rebuilt to match. Enabled via feature control.
  • Custom AI-authored tests, end to end — Create a custom test from an endpoint, its categories and the test code; validate it before saving; and have approval bound to the exact code revision a human reviewed. Changing a plan's files revokes its approval, and runs or exports of changed code are refused.
  • TLS findings from the Satellite are reported again — The Satellite's TLS scanner could not run, so every TLS scan silently returned nothing. Expired certificates, weak ciphers, POODLE and Heartbleed are detected once more.
  • Scan results no longer under-report — Informational findings appear alongside other severities, counts above 99 display correctly, a scan Levo cannot interpret is shown as "Unknown" rather than appearing successful, and errored scans are counted as failed.
  • Kong imports accept far more — Upload many Kong files at once under a single gateway name, import files that carry no tags with a preview of what will be added or skipped, and supply your own Kong configuration file rather than only the Levo export.
  • Audit-format Vulnerabilities PDF — Export the Vulnerabilities report in an audit format that adds document control, scope, methodology, an OWASP API Top 10 (2023) mapping, root-cause observations and prioritised recommendations — suitable for sharing with an auditor or a customer's security team.
  • Viewing an auth key no longer re-prompts for a password — Satellite, CLI and test-runner auth keys can be viewed without being sent back through your identity provider to re-authenticate.
  • HTTP Basic and Bearer authentication are now distinguished — The API catalog, API Surface and endpoint reports identify and filter endpoints by authentication scheme, showing "HTTP Auth (Basic)" separately from "HTTP Auth (Bearer)".
  • Framework detection from the live page — Frontend frameworks such as Angular are detected from the running page's JavaScript and DOM, so single-page applications are no longer missed in tech-aware scan decisions or in the reported tech stack.
  • Verified stored XSS from file uploads — Uploaded SVG and HTML files are re-fetched to confirm they are served inline with the injected script intact, and reported as a CWE-79 finding rather than a generic upload warning.
  • Optional OSV.dev coverage for component vulnerabilities — Software composition analysis can augment its findings with live OSV.dev lookups, covering known components with no match in the bundled dataset. Off by default.
  • More reliable authenticated crawls of single-page applications — Logins that require consent checkboxes, and applications that keep their session only in memory, are now handled correctly, so crawls no longer dead-end immediately after login.
  • Breaking: license expiry is now an epoch-millis field — The licenseExpirationDate string has been removed from the Workspace and Organization APIs and from GET /organizations. License dates are now returned as epoch-millisecond fields such as licenseExpirationDateMillis. Integrations that read the old string field must be updated.
  • License status, expiry warnings and lockout — Organizations show their license status, users are warned before a license expires and see a grace-period notice after it does, and access to an organization ends once its license period is over. New organizations start with a 14-day proof-of-concept period.
  • Web application scans finish within their time budget — Crawls stop before the scan deadline, no longer stall on pop-up menus or slow API endpoints, and keep the pages they discovered, so scans reach their testing phases in time.
  • Every distinct DAST finding is recorded — A second vulnerability of the same category on the same endpoint in one scan is no longer silently dropped.
  • Complete SIEM exports — Splunk and Google SecOps (Chronicle) exports now include every affected endpoint of each finding and are no longer capped at 10,000 findings.

API Discovery & Cataloging​

New Features​

  • Merge duplicate API endpoints — Duplicate endpoints discovered from different sources can be collapsed into one. Test cases, findings and traces follow the surviving endpoint and the published specification is rebuilt. Bulk merge supports up to 100 selected endpoints and is opt-in via feature control.
  • Import an endpoint from a pasted curl command — Paste a curl command to add an API endpoint, alongside the existing Postman and Bruno import paths.
  • Kong import accepts multiple files, untagged files, and your own config — Upload many Kong files in one go and import them together under one gateway name; import files that carry no tags, with the import page previewing which paths will be added and which skipped; and supply your own Kong configuration file in YAML or JSON, not only the file written by the Levo export tool.
  • Identify and filter APIs by authentication scheme — The API catalog and API Surface can identify endpoints that use HTTP Basic authentication separately from Bearer, and filter on it.
  • Basic and Bearer shown separately in reports — Endpoint and API Surface reports distinguish "HTTP Auth (Basic)" from "HTTP Auth (Bearer)" instead of reporting both as generic HTTP authentication.
  • Basic and Bearer authentication shown in the catalog — Endpoints and API Surface show whether an API uses HTTP Basic or Bearer authentication, with a Basic Auth quick filter and an HTTP Auth Scheme filter.

Resolved Issues​

  • Path segments containing PascalCase words were misdetected as identifiers, so imported curl and Postman endpoints received a duplicate placeholder endpoint instead of their traces. They are now recognised correctly.
  • Endpoints whose specification or metadata carried an over-long tag name were dropped from the catalog entirely. The offending tag, or an over-long parameter name, is now skipped and the rest of the endpoint is saved.
  • An endpoint a service genuinely serves could be permanently reclassified as outgoing when a caller-side observation of the same endpoint arrived. The server-side observation is now preserved.
  • Two concurrent traces for the same brand-new endpoint could cause it to be dropped rather than cataloged.
  • Merging applications failed on applications with large trace volumes, and when the service graph had already dropped a merged application's node. Both now succeed.
  • The Save button on the New Application import page did not respond.
  • Spec ingestion could stall on database lock timeouts in busy environments. Shared authentication-scheme records are no longer rewritten on every ingest.
  • Some traces covering several endpoints, including MCP traces, failed to open in the trace detail view.
  • Refreshing an API endpoint's parameters could fail when parameter names differed only by letter case.
  • Endpoints with user-renamed path parameters failed to refresh when their API specification was re-ingested.

API Security Testing​

New Features​

  • Create a custom test from an endpoint, its categories and the code — The application, manifest and environment are derived on the server. An optional idempotency key makes retried creates safe; with a key, a plan name already in use receives a numeric suffix.
  • Validate a custom test before saving it — Validation now takes exactly the same input the save would, so what is checked is what would be stored. Validation also reports common Levo SDK authoring mistakes — inverted assertions, decoding a base64 body as JSON, a missing yield from, and dangerous calls — with a suggested fix for each.
  • Custom plan approval is bound to the reviewed code — Changing a plan's files revokes its approval, approval is checked against the reviewed code revision, and runs or exports of code that has changed since approval are refused. Each run records its source, author and code revision, and the test runner exports a plan at the exact revision its run was launched with.
  • Custom plans are validated on creation — Newly created custom plans are checked before being marked valid. The check starts in log-only mode and can be switched to reject invalid plans.

Resolved Issues​

  • Unapproved custom test plans could be exported and executed by the test runner. They are now refused.
  • The author recorded on a custom test plan is now always the signed-in caller; a client-supplied author field is ignored.
  • Form-urlencoded endpoints were excluded from OS command, SQL and NoSQL injection test generation, which previously covered JSON bodies only. They are now included, and injection probes keep every form field so the target no longer rejects them for a missing field.
  • Form-urlencoded endpoints had their real request fields silently dropped from mass assignment probes.
  • Zero-Config test plans reported that a test case was missing a baseline request the run never made. Checks needing the endpoint's default request now skip with a clear reason naming the plan mode, and point to Data-Driven mode.
  • Test plan generation for applications with many endpoints could exhaust service memory. Concurrent test-case packaging is now bounded.
  • Static build assets such as ES-module import maps were reported as Broken User Authentication findings. They are now excluded.
  • API scans queued for a test runner showed the status "Unknown" instead of "Submitted".
  • Application-scoped security-test overrides can now be saved from the application's Configuration tab.
  • Clicking an API scan, endpoint suite or test case opens it in the same tab again. Ctrl/Cmd-click and middle-click still open it in a new tab.

Web Application Scanning (DAST)​

New Features​

  • One-time-code prompts are scoped to a running scan — The prompt for an "Ask a person" scan now appears only on the Scans pages, only while such a scan is running, names the scan it belongs to, and accepts codes of any length.
  • Scan drill-downs open in a new tab — Clicking an API scan, an endpoint test suite or a test case opens it in a new tab, so the page you came from stays open.
  • Framework detection from live-page signatures — Frontend frameworks are detected from the running page's JavaScript and DOM, so single-page applications are correctly identified both for tech-aware scan decisions and in the reported tech stack.
  • Stored XSS verification for file uploads — Uploaded SVG and HTML files are re-fetched and confirmed to be served inline with the injected script intact, producing a CWE-79 finding instead of a generic upload warning.
  • Opt-in OSV.dev augmentation — Software composition analysis can optionally check components against live OSV.dev data, covering known components absent from the bundled dataset. Disabled by default.

Resolved Issues​

  • Scan results under-reported vulnerabilities. Informational findings now appear alongside other severities, counts above 99 display correctly, and findings are counted regardless of how the severity is reported. A scan whose status Levo cannot interpret is shown as "Unknown" instead of appearing successful, and errored scans are included in the failed count on the API Scans widget.
  • Crawl-only scans continued sending captured traffic for ingestion when traffic capture was disabled for the run.
  • AI-driven crawls skipped links the AI agent had discovered but not opened, and could stall after crawling in a way that cancelled security testing. They also no longer explore a login page as though it were the authenticated application.
  • Authenticated crawls of single-page applications with no persisted session could be silently logged out mid-crawl by a redundant page reload, collapsing discovery to a handful of pages.
  • Form-based login now ticks required consent and acknowledgment checkboxes, and correctly verifies logins on single-page applications that hold their session only in memory.
  • Token-based authentication no longer sends the injected bearer header to third-party requests or across redirects, and now matches the target's full origin rather than only its hostname.
  • WebSocket Cross-Site Hijacking was reported as high severity on origin acceptance alone. It is now confirmed through a cookie-only authentication differential and capped at medium pending SameSite verification, removing a class of false positives.
  • An AWS access key ID with no matching secret key was reported as critical. It is now reported as low severity for verification, removing a common false positive.
  • Scans that reached their timeout reported an empty list of discovered URLs. Crawls now stop before the scan deadline and keep the pages found so far, even on a hard cancel.
  • Scans could stall on pop-up menus, which were filled in as though they were forms, and on slow API endpoints during post-crawl probing. They now reach the testing phases within their time budget.

Vulnerabilities & Findings​

Resolved Issues​

  • DAST scans now record every distinct vulnerability found on an endpoint. Previously, a second vulnerability of the same category on the same endpoint in one scan was silently dropped.
  • Findings with the same title on a test case run shared one panel state.
  • Large vulnerability exports and endpoint-filtered findings statistics no longer time out on workspaces with many findings.

Sensors & Deployment​

Resolved Issues​

  • The Satellite's TLS scanner could not run on the Satellite image, so every TLS/SSL scan silently returned no findings. Scanning works again, and findings such as expired certificates, weak ciphers, POODLE and Heartbleed are reported.
  • A High-severity denial-of-service pair in a Satellite dependency has been remediated by upgrading it. Message-queue topic creation now gives up on a configurable wall-clock budget and retries in a bounded loop instead of hanging.
  • Components that moved to a different environment without re-registering were reported as down. Their environment now updates automatically from their heartbeats, restoring status, span counts and alert routing.
  • Component heartbeats were dropped when the platform was slow to resolve a tenant. The endpoint now answers promptly and the component retries on its next heartbeat instead of hanging.
  • Component health alerts were dropped after three attempts when the configuration service was unreachable. They are now delivered using the last successfully read routing rules, and every remaining path that cannot deliver an alert now records why.
  • Satellite and sensor metrics reported from several hosts at once could be rejected, so span counts and sensor statistics went missing. Each host now reports separately, and when metrics collection is slow, skipped reports are spread across hosts and reported.

Integrations​

Resolved Issues​

  • Failed Splunk and Google SecOps (Chronicle) exports reported success while sending no data. They are now reported as failures.
  • Splunk and Google SecOps (Chronicle) findings exports now include every affected endpoint of each finding and no longer stop at 10,000 findings, so each export run sends more events than before.

MCP Server​

Resolved Issues​

  • MCP returned only proof-of-concept-tier applications and endpoints. It now returns the full application and endpoint catalog.
  • AI Apps summaries and policy listing now return correct results or a clear error, and tag listing accepts scope names in any letter case.

Reporting & Compliance​

New Features​

  • Tags column in the API Surface report — The export now includes a Tags column, with one column per tag key, matching the Endpoints report. An optional tag selection filter is available.
  • Vulnerabilities PDF in audit format — The Vulnerabilities PDF export accepts an audit detail level, producing a report with document control, scope and methodology sections, an OWASP API Top 10 (2023) mapping, root-cause observations and prioritised recommendations alongside the findings themselves.

Resolved Issues​

  • Breaking: the API Surface CSV export's column order has changed to match the Endpoints report, and the Tags column is appended at the end. Integrations parsing this export by column position must be updated; header-name-based consumers are unaffected.
  • The API Surface report's External/Internal and PII columns did not match the Endpoints view — many internal endpoints were shown as External. They now agree.
  • Applying an environment filter to the API Surface report still produced a column for every environment in the workspace. Only the selected environments' columns now appear.
  • API Surface exports for large workspaces failed or ran slowly. The rollup is now computed once per export and completes reliably, including when the platform database is busy.
  • Asynchronous reports could remain in "Processing" indefinitely and block other reports when a report ran longer than five minutes. On-premises asynchronous reports could never reach a completed or failed state. Both are fixed.

Platform, Administration & Access​

New Features​

  • Access Management replaces separate IAM and Service Accounts pages — Users, Roles and Single Sign-On are grouped under People, and Service Accounts and API Tokens under Machines. Existing links and bookmarks redirect automatically.
  • Assign roles when adding a user to an organization — Administrators can now set roles at the point of adding a user from the admin portal.
  • Long-lived authentication keys for organizations using Keycloak — Satellite and CLI authentication keys are issued as independent long-lived tokens rather than reusing the dashboard login session, so Satellites, test runners and DAST runners keep running. These keys are no longer written to application logs.
  • License status and lifecycle — Organizations show their license status. Users are warned before a license expires, see a grace-period notice after expiry, and are locked out of an organization once access ends. New organizations start with a 14-day proof-of-concept period.
  • Refreshed User Settings — User Settings has a new layout matching the rest of the application.
  • Breaking: the licenseExpirationDate string field has been removed from the Workspace and Organization APIs and from GET /organizations. License dates are now returned as epoch-millisecond fields such as licenseExpirationDateMillis. Integrations reading the old field must be updated.

Resolved Issues​

  • Single sign-on no longer forces re-authentication at your identity provider on every sign-in; your identity provider's own session and multi-factor policy applies.
  • Single sign-on domain matching is now case-insensitive, so an email address whose domain differs only in capitalisation is routed to the organization's identity provider instead of being offered password login.
  • Service-account credentials reach the data plane without a configuration flag, and service-account token issuance now uses its own dedicated signing key, independent of the password-based authentication path.
  • System users, including Levo support, can read Levo product skills over MCP.
  • Opening an organization could hang on the "Loading workspace…" screen until the browser cache or history was cleared.
  • Switching environments with a saved Custom View open on Applications, Endpoints or API Scans produced a blank page. A saved view that does not exist in the selected environment now falls back to the default tab.
  • Delete confirmation dialogs now show a loading indicator for the full duration of the delete — across endpoints, traces, auth schemes, test runner groups, guardrail alerts, endpoint parameter profiles and vulnerability comments — preventing accidental double-submits.
  • Excessive log noise when a request referenced a user account that no longer resolves has been rate-limited, and authorization is hardened against tokens carrying no subject claim.
  • Viewing a satellite, CLI or test-runner auth key forced re-authentication at your identity provider. It no longer does.
  • Logging out of Levo now ends the corresponding identity-provider session instead of leaving it active. Long-lived satellite, CLI and test-runner keys issued as offline tokens are unaffected.
  • Opening a page right after a Levo update could show a "Something went wrong" screen. The application now reloads itself onto the latest version.
  • Switching organizations could briefly show the previous organization's data and environment list.
  • Clicking the Access Management breadcrumb landed on a blank page.