Skip to main content

SaaS Platform Services -- 1.2.135.7

Levo Team
Levo Team
Product & Engineering

Release period: v1.2.135.6 → v1.2.135.7

This release brings license status into the product, with expiry warnings, a grace period and a clean end of access, and makes web application scans finish their testing within budget while recording every distinct finding. Note the breaking change to the license fields in the Workspace and Organization APIs before upgrading any integration that reads them.

Highlights​

  • Breaking: license expiry is now an epoch-millis field — The licenseExpirationDate string has been removed from the Workspace and Organization APIs and from GET /organizations. License dates are now returned as epoch-millisecond fields such as licenseExpirationDateMillis. Integrations that read the old string field must be updated.
  • License status, expiry warnings and lockout — Organizations show their license status, users are warned before a license expires and see a grace-period notice after it does, and access to an organization ends once its license period is over. New organizations start with a 14-day proof-of-concept period.
  • Web application scans finish within their time budget — Crawls stop before the scan deadline, no longer stall on pop-up menus or slow API endpoints, and keep the pages they discovered, so scans reach their testing phases in time.
  • Every distinct DAST finding is recorded — A second vulnerability of the same category on the same endpoint in one scan is no longer silently dropped.
  • Complete SIEM exports — Splunk and Google SecOps (Chronicle) exports now include every affected endpoint of each finding and are no longer capped at 10,000 findings.

API Discovery & Cataloging​

New Features​

  • Basic and Bearer authentication shown in the catalog — Endpoints and API Surface show whether an API uses HTTP Basic or Bearer authentication, with a Basic Auth quick filter and an HTTP Auth Scheme filter.

Resolved Issues​

  • Refreshing an API endpoint's parameters could fail when parameter names differed only by letter case.
  • Endpoints with user-renamed path parameters failed to refresh when their API specification was re-ingested.

API Security Testing​

Resolved Issues​

  • API scans queued for a test runner showed the status "Unknown" instead of "Submitted".
  • Application-scoped security-test overrides can now be saved from the application's Configuration tab.
  • Clicking an API scan, endpoint suite or test case opens it in the same tab again. Ctrl/Cmd-click and middle-click still open it in a new tab.

Web Application Scanning (DAST)​

Resolved Issues​

  • Scans that reached their timeout reported an empty list of discovered URLs. Crawls now stop before the scan deadline and keep the pages found so far, even on a hard cancel.
  • Scans could stall on pop-up menus, which were filled in as though they were forms, and on slow API endpoints during post-crawl probing. They now reach the testing phases within their time budget.

Vulnerabilities & Findings​

Resolved Issues​

  • DAST scans now record every distinct vulnerability found on an endpoint. Previously, a second vulnerability of the same category on the same endpoint in one scan was silently dropped.
  • Findings with the same title on a test case run shared one panel state.
  • Large vulnerability exports and endpoint-filtered findings statistics no longer time out on workspaces with many findings.

Sensors & Deployment​

Resolved Issues​

  • Satellite and sensor metrics reported from several hosts at once could be rejected, so span counts and sensor statistics went missing. Each host now reports separately, and when metrics collection is slow, skipped reports are spread across hosts and reported.

Integrations​

Resolved Issues​

  • Splunk and Google SecOps (Chronicle) findings exports now include every affected endpoint of each finding and no longer stop at 10,000 findings, so each export run sends more events than before.

MCP Server​

Resolved Issues​

  • MCP returned only proof-of-concept-tier applications and endpoints. It now returns the full application and endpoint catalog.
  • AI Apps summaries and policy listing now return correct results or a clear error, and tag listing accepts scope names in any letter case.

Platform, Administration & Access​

New Features​

  • License status and lifecycle — Organizations show their license status. Users are warned before a license expires, see a grace-period notice after expiry, and are locked out of an organization once access ends. New organizations start with a 14-day proof-of-concept period.
  • Refreshed User Settings — User Settings has a new layout matching the rest of the application.
  • Breaking: the licenseExpirationDate string field has been removed from the Workspace and Organization APIs and from GET /organizations. License dates are now returned as epoch-millisecond fields such as licenseExpirationDateMillis. Integrations reading the old field must be updated.