Skip to main content

Release Notes — September 1–8, 2026

Levo Team
Levo Team
Product & Engineering

Release period: September 1, 2026 – September 8, 2026 (partial month)

A short but active stretch: a new API discovery source, two new integrations, and an overhauled component health monitoring experience, alongside a batch of accuracy and reliability fixes across security testing and web application scanning.

Highlights​

  • Kong Gateway discovery source — import API routes directly from Kong, export Kong metadata, and publish specs to Levo from CI.
  • New WSO2 connector — push discovered APIs straight to a WSO2 gateway.
  • New Linear integration — create and track Linear tickets directly from vulnerability findings.
  • Component health monitoring, overhauled — clearer Down vs. Stale status, environment-scoped alerting, bulk actions, and restored snooze.
  • Deeper form-encoded test coverage — security tests now fully parameterize form-encoded request bodies instead of dropping values.
  • Custom report columns — choose exactly which columns appear in generated and scheduled reports.

API Discovery & Cataloging​

New Features​

  • Kong Gateway integration — Import API routes directly from Kong as a discovery source, export Kong metadata, and publish specs to Levo from CI.
  • Source-code API discovery now supports Go, in addition to existing languages.
  • GraphQL endpoint discovery now works when your API is served from a custom base path.

Resolved Issues​

  • Authentication settings on manually pushed API specs can be discarded.
  • Duplicate entries appear in the tag filter dropdown.
  • Tagging endpoints in bulk fails occasionally.
  • Stray characters in captured endpoint parameters can corrupt discovery data.

API Security Testing​

New Features​

  • Hooks on authentication requests — Test plans support pre- and post-processor hooks on authentication requests, and a fill-in table for headers fetched at test time.
  • Security tests now fully parameterize form-encoded request bodies instead of dropping producer values, for deeper mutation coverage.

Resolved Issues​

  • JWT security tests skip attacks when a conditional-GET baseline returns a 304.
  • JWT security tests flag a front-end single-page-app shell as a JWT bypass.
  • CORS test results report duplicate findings per probe. They are now collapsed into a single finding.
  • A CLI import crash affecting some environments, and unnecessary CLI access-token refreshes.
  • The security-test rate-limit label does not show requests per minute.
  • A memory issue can crash the test-run results page under heavy load.
  • Duplicate ticket attachments when a test run's finalization step runs more than once.

Web Application Scanning (DAST)​

New Features​

  • Form-based login detection now recognizes identifier-first (mobile/phone) logins, and honors a custom login URL.

Resolved Issues​

  • Scan reliability and accuracy issues — scan-budget starvation, false positives on single-page-app .env files, weak identity-provider fuzzing, and poor AI-crawl steering.

Vulnerabilities & Findings​

Resolved Issues​

  • Findings are incorrectly closed when a test case exists but was not actually executed.
  • A finding's evidence/proof bundle includes assertions other than the one that produced it, making the evidence misleading.

Sensors & Deployment​

New Features​

  • Overhauled component health monitoring — Clearer Down vs. Stale status, environment-scoped alerting with sensible defaults and renotify intervals, single and bulk delete for retired components, and restored the ability to snooze alerts.
  • Hosted satellite assignment can now be overridden at the organization level.

Resolved Issues​

  • Sensors do not keep running on their last-known-good configuration if they briefly lose contact with the control plane.
  • Component health status shown in alerts does not match the UI.
  • The wrong environments display for taggers vs. satellites.

Integrations​

New Features​

  • WSO2 push-to-gateway connector.
  • Linear integration — Create and track Linear tickets directly from vulnerability findings.
  • Added support for Google Workspace SSO login.

Resolved Issues​

  • SIEM export to Google Chronicle uses an incorrect Asia region hostname. It now correctly resolves to the Mumbai region.
  • Jira ticket descriptions lose formatting. They are now rendered correctly as rich text.
  • SSO login fails when a user's email casing differs between the identity provider and Levo.
  • The Burp extension prints logs to the Event log instead of the Output panel, plus stability issues with async publish and a race condition on the legacy API.

Reporting & Compliance​

New Features​

  • Custom report columns — Choose exactly which columns appear in generated and scheduled reports.
  • Streamlined the Reports page by removing the Component Status Report card and requiring explicit column selection.

Platform, Administration & Access​

Resolved Issues​

  • Application deletion leaves an app partially removed from the service graph.
  • Notification destinations are not validated as proper URLs at save time, allowing broken alert configs.