Skip to main content

SaaS Platform Services -- 1.2.135.4

Levo Team
Levo Team
Product & Engineering

Release period: v1.2.135.3 → v1.2.135.4

This release is about trusting what you see. Duplicate API endpoints can now be merged in bulk, TLS findings from the Satellite are reported again after being silently absent, and scan results no longer render a vulnerable or unrecognised scan as clean. Custom AI-authored tests gain a full authoring lifecycle — create, validate, approve — with every run bound to the exact code a human reviewed. Note the breaking change to the API Surface export below before upgrading any integration that reads it.

Highlights​

  • Breaking: API Surface export column order has changed — The API Surface CSV export now matches the Endpoints report's column order, and a Tags column (one column per tag key, with an optional tag filter) has been added at the end. Integrations that parse this export by column position must be updated; those reading by header name are unaffected.
  • Merge duplicate API endpoints in bulk — Select up to 100 endpoints and collapse them into a single destination. Test cases, findings and traces attached to the merged endpoints follow the surviving endpoint, and the published specification is rebuilt to match. Enabled via feature control.
  • Custom AI-authored tests, end to end — Create a custom test from an endpoint, its categories and the test code; validate it before saving; and have approval bound to the exact code revision a human reviewed. Changing a plan's files revokes its approval, and runs or exports of changed code are refused.
  • TLS findings from the Satellite are reported again — The Satellite's TLS scanner could not run, so every TLS scan silently returned nothing. Expired certificates, weak ciphers, POODLE and Heartbleed are detected once more.
  • Scan results no longer under-report — Informational findings appear alongside other severities, counts above 99 display correctly, a scan Levo cannot interpret is shown as "Unknown" rather than appearing successful, and errored scans are counted as failed.
  • Kong imports accept far more — Upload many Kong files at once under a single gateway name, import files that carry no tags with a preview of what will be added or skipped, and supply your own Kong configuration file rather than only the Levo export.

API Discovery & Cataloging​

New Features​

  • Merge duplicate API endpoints — Duplicate endpoints discovered from different sources can be collapsed into one. Test cases, findings and traces follow the surviving endpoint and the published specification is rebuilt. Bulk merge supports up to 100 selected endpoints and is opt-in via feature control.
  • Import an endpoint from a pasted curl command — Paste a curl command to add an API endpoint, alongside the existing Postman and Bruno import paths.
  • Kong import accepts multiple files, untagged files, and your own config — Upload many Kong files in one go and import them together under one gateway name; import files that carry no tags, with the import page previewing which paths will be added and which skipped; and supply your own Kong configuration file in YAML or JSON, not only the file written by the Levo export tool.

Resolved Issues​

  • Path segments containing PascalCase words were misdetected as identifiers, so imported curl and Postman endpoints received a duplicate placeholder endpoint instead of their traces. They are now recognised correctly.
  • Endpoints whose specification or metadata carried an over-long tag name were dropped from the catalog entirely. The offending tag, or an over-long parameter name, is now skipped and the rest of the endpoint is saved.
  • An endpoint a service genuinely serves could be permanently reclassified as outgoing when a caller-side observation of the same endpoint arrived. The server-side observation is now preserved.
  • Two concurrent traces for the same brand-new endpoint could cause it to be dropped rather than cataloged.
  • Merging applications failed on applications with large trace volumes, and when the service graph had already dropped a merged application's node. Both now succeed.
  • The Save button on the New Application import page did not respond.

API Security Testing​

New Features​

  • Create a custom test from an endpoint, its categories and the code — The application, manifest and environment are derived on the server. An optional idempotency key makes retried creates safe; with a key, a plan name already in use receives a numeric suffix.
  • Validate a custom test before saving it — Validation now takes exactly the same input the save would, so what is checked is what would be stored. Validation also reports common Levo SDK authoring mistakes — inverted assertions, decoding a base64 body as JSON, a missing yield from, and dangerous calls — with a suggested fix for each.
  • Custom plan approval is bound to the reviewed code — Changing a plan's files revokes its approval, approval is checked against the reviewed code revision, and runs or exports of code that has changed since approval are refused. Each run records its source, author and code revision, and the test runner exports a plan at the exact revision its run was launched with.
  • Custom plans are validated on creation — Newly created custom plans are checked before being marked valid. The check starts in log-only mode and can be switched to reject invalid plans.

Resolved Issues​

  • Unapproved custom test plans could be exported and executed by the test runner. They are now refused.
  • The author recorded on a custom test plan is now always the signed-in caller; a client-supplied author field is ignored.
  • Form-urlencoded endpoints were excluded from OS command, SQL and NoSQL injection test generation, which previously covered JSON bodies only. They are now included, and injection probes keep every form field so the target no longer rejects them for a missing field.
  • Form-urlencoded endpoints had their real request fields silently dropped from mass assignment probes.
  • Zero-Config test plans reported that a test case was missing a baseline request the run never made. Checks needing the endpoint's default request now skip with a clear reason naming the plan mode, and point to Data-Driven mode.
  • Test plan generation for applications with many endpoints could exhaust service memory. Concurrent test-case packaging is now bounded.

Web Application Scanning (DAST)​

New Features​

  • One-time-code prompts are scoped to a running scan — The prompt for an "Ask a person" scan now appears only on the Scans pages, only while such a scan is running, names the scan it belongs to, and accepts codes of any length.
  • Scan drill-downs open in a new tab — Clicking an API scan, an endpoint test suite or a test case opens it in a new tab, so the page you came from stays open.

Resolved Issues​

  • Scan results under-reported vulnerabilities. Informational findings now appear alongside other severities, counts above 99 display correctly, and findings are counted regardless of how the severity is reported. A scan whose status Levo cannot interpret is shown as "Unknown" instead of appearing successful, and errored scans are included in the failed count on the API Scans widget.
  • Crawl-only scans continued sending captured traffic for ingestion when traffic capture was disabled for the run.

Sensors & Deployment​

Resolved Issues​

  • The Satellite's TLS scanner could not run on the Satellite image, so every TLS/SSL scan silently returned no findings. Scanning works again, and findings such as expired certificates, weak ciphers, POODLE and Heartbleed are reported.
  • A High-severity denial-of-service pair in a Satellite dependency has been remediated by upgrading it. Message-queue topic creation now gives up on a configurable wall-clock budget and retries in a bounded loop instead of hanging.
  • Components that moved to a different environment without re-registering were reported as down. Their environment now updates automatically from their heartbeats, restoring status, span counts and alert routing.
  • Component heartbeats were dropped when the platform was slow to resolve a tenant. The endpoint now answers promptly and the component retries on its next heartbeat instead of hanging.
  • Component health alerts were dropped after three attempts when the configuration service was unreachable. They are now delivered using the last successfully read routing rules, and every remaining path that cannot deliver an alert now records why.

Integrations​

Resolved Issues​

  • Failed Splunk and Google SecOps (Chronicle) exports reported success while sending no data. They are now reported as failures.

Reporting & Compliance​

New Features​

  • Tags column in the API Surface report — The export now includes a Tags column, with one column per tag key, matching the Endpoints report. An optional tag selection filter is available.

Resolved Issues​

  • Breaking: the API Surface CSV export's column order has changed to match the Endpoints report, and the Tags column is appended at the end. Integrations parsing this export by column position must be updated; header-name-based consumers are unaffected.
  • The API Surface report's External/Internal and PII columns did not match the Endpoints view — many internal endpoints were shown as External. They now agree.
  • Applying an environment filter to the API Surface report still produced a column for every environment in the workspace. Only the selected environments' columns now appear.
  • API Surface exports for large workspaces failed or ran slowly. The rollup is now computed once per export and completes reliably, including when the platform database is busy.
  • Asynchronous reports could remain in "Processing" indefinitely and block other reports when a report ran longer than five minutes. On-premises asynchronous reports could never reach a completed or failed state. Both are fixed.

Platform, Administration & Access​

New Features​

  • Access Management replaces separate IAM and Service Accounts pages — Users, Roles and Single Sign-On are grouped under People, and Service Accounts and API Tokens under Machines. Existing links and bookmarks redirect automatically.
  • Assign roles when adding a user to an organization — Administrators can now set roles at the point of adding a user from the admin portal.
  • Long-lived authentication keys for organizations using Keycloak — Satellite and CLI authentication keys are issued as independent long-lived tokens rather than reusing the dashboard login session, so Satellites, test runners and DAST runners keep running. These keys are no longer written to application logs.

Resolved Issues​

  • Single sign-on no longer forces re-authentication at your identity provider on every sign-in; your identity provider's own session and multi-factor policy applies.
  • Single sign-on domain matching is now case-insensitive, so an email address whose domain differs only in capitalisation is routed to the organization's identity provider instead of being offered password login.
  • Service-account credentials reach the data plane without a configuration flag, and service-account token issuance now uses its own dedicated signing key, independent of the password-based authentication path.
  • System users, including Levo support, can read Levo product skills over MCP.
  • Opening an organization could hang on the "Loading workspace…" screen until the browser cache or history was cleared.
  • Switching environments with a saved Custom View open on Applications, Endpoints or API Scans produced a blank page. A saved view that does not exist in the selected environment now falls back to the default tab.
  • Delete confirmation dialogs now show a loading indicator for the full duration of the delete — across endpoints, traces, auth schemes, test runner groups, guardrail alerts, endpoint parameter profiles and vulnerability comments — preventing accidental double-submits.
  • Excessive log noise when a request referenced a user account that no longer resolves has been rate-limited, and authorization is hardened against tokens carrying no subject claim.