This release introduces centralized API credential management, reusable global authentication profiles, OAuth PKCE support using Custom Authentication Chains, enhanced authentication validation for API-driven scans, and new Scan-and-Gate capabilities for CI/CD pipelines. Additional fixes improve BOLA scenario generation and polish SSRF detection reporting.
This release introduces HMAC authentication support, ServiceNow AVR integration, Advanced BOLA testing, Dashboard V2 enhancements, and a new SSL Enforcement detection category. Additional improvements strengthen hosted-agent management, information-detection workflows, and automation capabilities via scan-profile execution APIs.
This release expands Postman-based onboarding and scan workflows with support for spec reloads via Postman URL and Gateway integrations, Postman Environment variable resolution, and new OAuth-focused security test categories for authorization code replay and open redirect detection.
The release also improves hosted agent resiliency, API token-based scan execution, and Postman variable resolution during endpoint discovery and parameter hydration. Additional fixes improve MySQL injection category accuracy, strengthen the reliability of OAuth parameter hydration, and include platform-wide security hardening updates.
This release focuses on improving visibility, usability, and scan accuracy across the platform. Key updates include enhanced Developer Reports with full endpoint coverage, and a redesigned Hosted Agent dashboard for better operational visibility. Security testing has been expanded with new detection categories for SSL/TLS vulnerabilities and JWT header injection, helping teams identify critical risks earlier. Additionally, improvements to parameter hydration and UI consistency streamline workflows and reduce manual effort. Several fixes address issues in authentication handling, Postman imports, performance for large APIs, and reporting accuracy—resulting in a more stable and reliable testing experience.
If you've received a message like "I never got the temporary password - what do I do now?", this update is for you.
What was happening before
When a new user signed up but didn’t log in right away:
Their account remained in a "force change password" state.
Azure API Management Integration: Improved Support for Granular Azure RBAC Scopes
We resolved an issue that could prevent APIs discovered through the Azure API Management (APIM) integration from being displayed when using granular resource-scoped credentials.
This release delivers a set of enhancements and fixes focused on secure onboarding, access governance, and testing accuracy. Authentication handling has been improved with automatic extraction of authentication credentials from Postman Collections, greater control over authentication selection during Dry Runs, and clearer validation outcomes to prevent misleading test results.
Access management has been strengthened through multi-user application access controls, enabling administrators to manage permissions at scale with better visibility and flexibility. RBAC-related improvements enhance both the accuracy of access validation and the clarity of security findings.
Security Categories Improvements
We are excited to share the latest updates designed to make the APIsec customers' experience smoother, safer, and more powerful. Here’s what’s new: