Skip to main content

SaaS Platform Services -- 1.2.135.6

Release period: v1.2.135.5 → v1.2.135.6

This release deepens web application scanning: frameworks are now detected from the running page, stored XSS from file uploads is verified rather than inferred, and software composition analysis can optionally check findings against OSV.dev. Authenticated crawls of single-page applications are substantially more reliable, several classes of false positive are gone, and the API catalog now tells HTTP Basic authentication apart from Bearer.

Highlights​

  • HTTP Basic and Bearer authentication are now distinguished — The API catalog, API Surface and endpoint reports identify and filter endpoints by authentication scheme, showing "HTTP Auth (Basic)" separately from "HTTP Auth (Bearer)".
  • Framework detection from the live page — Frontend frameworks such as Angular are detected from the running page's JavaScript and DOM, so single-page applications are no longer missed in tech-aware scan decisions or in the reported tech stack.
  • Verified stored XSS from file uploads — Uploaded SVG and HTML files are re-fetched to confirm they are served inline with the injected script intact, and reported as a CWE-79 finding rather than a generic upload warning.
  • Optional OSV.dev coverage for component vulnerabilities — Software composition analysis can augment its findings with live OSV.dev lookups, covering known components with no match in the bundled dataset. Off by default.
  • More reliable authenticated crawls of single-page applications — Logins that require consent checkboxes, and applications that keep their session only in memory, are now handled correctly, so crawls no longer dead-end immediately after login.

API Discovery & Cataloging​

New Features​

  • Identify and filter APIs by authentication scheme — The API catalog and API Surface can identify endpoints that use HTTP Basic authentication separately from Bearer, and filter on it.
  • Basic and Bearer shown separately in reports — Endpoint and API Surface reports distinguish "HTTP Auth (Basic)" from "HTTP Auth (Bearer)" instead of reporting both as generic HTTP authentication.

Resolved Issues​

  • Spec ingestion could stall on database lock timeouts in busy environments. Shared authentication-scheme records are no longer rewritten on every ingest.
  • Some traces covering several endpoints, including MCP traces, failed to open in the trace detail view.

API Security Testing​

Resolved Issues​

  • Static build assets such as ES-module import maps were reported as Broken User Authentication findings. They are now excluded.

Web Application Scanning (DAST)​

New Features​

  • Framework detection from live-page signatures — Frontend frameworks are detected from the running page's JavaScript and DOM, so single-page applications are correctly identified both for tech-aware scan decisions and in the reported tech stack.
  • Stored XSS verification for file uploads — Uploaded SVG and HTML files are re-fetched and confirmed to be served inline with the injected script intact, producing a CWE-79 finding instead of a generic upload warning.
  • Opt-in OSV.dev augmentation — Software composition analysis can optionally check components against live OSV.dev data, covering known components absent from the bundled dataset. Disabled by default.

Resolved Issues​

  • AI-driven crawls skipped links the AI agent had discovered but not opened, and could stall after crawling in a way that cancelled security testing. They also no longer explore a login page as though it were the authenticated application.
  • Authenticated crawls of single-page applications with no persisted session could be silently logged out mid-crawl by a redundant page reload, collapsing discovery to a handful of pages.
  • Form-based login now ticks required consent and acknowledgment checkboxes, and correctly verifies logins on single-page applications that hold their session only in memory.
  • Token-based authentication no longer sends the injected bearer header to third-party requests or across redirects, and now matches the target's full origin rather than only its hostname.
  • WebSocket Cross-Site Hijacking was reported as high severity on origin acceptance alone. It is now confirmed through a cookie-only authentication differential and capped at medium pending SameSite verification, removing a class of false positives.
  • An AWS access key ID with no matching secret key was reported as critical. It is now reported as low severity for verification, removing a common false positive.

Platform, Administration & Access​

Resolved Issues​

  • Logging out of Levo now ends the corresponding identity-provider session instead of leaving it active. Long-lived satellite, CLI and test-runner keys issued as offline tokens are unaffected.
  • Opening a page right after a Levo update could show a "Something went wrong" screen. The application now reloads itself onto the latest version.
  • Switching organizations could briefly show the previous organization's data and environment list.
  • Clicking the Access Management breadcrumb landed on a blank page.