Skip to main content

June

· 14 min read

NG Production Release Update - APIsec_cloud_7.6.3.0 (Jun 24, 2026)​

This release introduces HMAC authentication support, ServiceNow AVR integration, Advanced BOLA testing, Dashboard V2 enhancements, and a new SSL Enforcement detection category. Additional improvements strengthen hosted-agent management, information-detection workflows, and automation capabilities via scan-profile execution APIs.

What's New​

HMAC Authentication​

APIsec now supports HMAC-signed authentication for APIs that require request-level signatures. HMAC profiles support configurable signed components, timestamp validation, nonce support, and multiple encoding formats.

Why this matters​

  • ​ Enables testing of APIs protected by HMAC authentication
  • ​ Supports secure integrations that do not rely on bearer tokens
  • ​ Expands coverage for enterprise authentication models

ServiceNow Application Vulnerability Response (AVR) Integration​

APIsec now integrates with ServiceNow Application Vulnerability Response (AVR), automatically creating and synchronizing Application Vulnerable Items (AVIs) for detected vulnerabilities.

Each vulnerability is tracked independently, while repeat detections are correlated to existing records to prevent duplicate ticket creation. Bidirectional traceability links findings in APIsec with their corresponding records in ServiceNow.

AVIs can also be marked as False Positive or Risk Accepted directly within ServiceNow. These dispositions automatically synchronize back to APIsec, ensuring findings remain consistent across both platforms without manual updates.

Why this matters​

  • ​ Streamlines vulnerability remediation workflows
  • ​ Improves collaboration between security and operations teams
  • ​ Eliminates manual reconciliation between APIsec and ServiceNow
  • ​ Provides end-to-end traceability from detection through remediation

Note: Marketplace availability is pending ServiceNow certification and review. The certified application will be published to the ServiceNow Store once approved.

Scan Profile Initiation via API​

Scans can now be launched through the API using a Scan Profile, enabling CI/CD pipelines and automation workflows to execute scans with predefined scope and configuration.

Why this matters​

  • ​ Simplifies automation and CI/CD integrations
  • ​ Ensures consistent scan execution across environments

Advanced BOLA Scenarios​

A new Advanced BOLA scenario builder enables multi-step Broken Object Level Authorization testing with explicit workflows for the owner and attacker.

Dry-run validation allows teams to verify credential routing before executing a full scan.

Why this matters​

  • ​ Supports more realistic authorization testing scenarios
  • ​ Improves confidence before launching production scans
  • ​ Reduces false positives during BOLA validation

Redesigned Administrator Dashboard​

A redesigned Dashboard experience is now available for tenant administrators. The updated dashboard introduces a dedicated Security Exposure tab for monitoring open vulnerabilities, enhanced application-model visualizations that highlight onboarding blockers across Network, Authentication, and Other categories, and improved discovery-flow rendering for clearer visibility into application setup progress.

Why this matters​

  • ​ Provides better visibility into security exposure and onboarding status
  • ​ Simplifies identification of configuration and reachability blockers
  • ​ Improves consistency and accuracy across dashboard reporting surfaces
  • ​ Delivers a cleaner, more intuitive administrative experience

Informational Detection Actions​

Informational findings now support the same workflow actions as vulnerabilities, including Create Ticket, False Positive, and Risk Accepted.

Why this matters​

  • ​ Provides consistent triage workflows across all findings
  • ​ Improves tracking and disposition management of informational observations

SSL Enforcement Detection​

A new SSL Enforcement category identifies endpoints that accept plaintext HTTP connections when HTTPS enforcement is expected.

Why this matters​

  • ​ Helps identify insecure transport configurations
  • ​ Strengthens API transport-layer security validation

Improvements​

Hosted Agent Management Enhancements​

Administrators can now manage hosted agents deployed by other administrators, including downloading deployment scripts and rotating tokens. User-deployed hosted agents remain private and manageable only by their owners.

In addition, downloading a hosted-agent deployment script no longer impacts a running agent's authentication state. Token rotation now occurs only when explicitly requested.

Why this matters​

  • ​ Improves operational continuity for shared hosted agents
  • ​ Prevents unintended disruption of running agents
  • ​ Simplifies hosted-agent administration

Informational Findings in Issue Trackers​

Informational findings now use dedicated ticket titles when synchronized to external issue trackers, making them easier to distinguish from vulnerability findings.

Why this matters​

  • ​ Improves triage and reporting clarity
  • ​ Reduces confusion when reviewing informational observations in ticketing systems

NG Production Release Update - APIsec_cloud_7.6.2.0 ( Jun 17, 2026 )​

This release introduces the ability to rediscover Business Flows on demand, improving visibility after API specification updates. Additional enhancements improve parameter management, Personal Access Token support, vulnerability reporting accuracy, and Postman collection processing. The release also includes access-control hardening for user and team management endpoints, as well as dependency updates across the platform.

What's New​

Re-Discover Business Flows​

A new Re-Discover Flows action is now available on the Business Flows tab, allowing users to trigger a fresh AI-powered flow discovery against the latest application specification.

The action is available to users with edit permissions and is especially useful after reloading an API specification or adding new endpoints.

Why this matters​

  • Keeps business flow mappings aligned with API changes
  • Simplifies the discovery of newly added endpoints
  • Prevents duplicate discovery requests while processing is in progress

Improvements​

Parameter Configuration CSV Re-Upload​

Re-uploading a parameter configuration CSV now correctly applies updated parameter values.

Why this matters​

  • Simplifies bulk parameter maintenance
  • Ensures configuration updates are reflected without manual re-entry
  • Improves the reliability of CSV-based parameter management

Personal Access Token Support for Team Operations​

Problem

Certain team-related operations failed when using Personal Access Tokens (PATs) generated by USER-role accounts.

Solution

Team filtering, team listing, and application-sharing workflows now consistently support USER-role PATs.

Impact

  • Improves API automation using PAT authentication
  • Aligns PAT behavior with standard authenticated user workflows

Vulnerability Count Consistency​

Problem

 Vulnerability counts could differ between the Overview and Detail pages when switching between application instances.

Solution

 Instance-specific data now refreshes correctly when navigating between instances.

Impact

  • Provides consistent vulnerability counts across views
  • Improves reporting accuracy for severity and triage metrics

Postman Parameters with Dotted Names​

Problem

Postman parameters containing dotted names ( for example, user.profile.id) were not always applied correctly during scans.

Solution

Dotted-name parameters are now resolved and applied correctly across headers and query parameter variables.

Impact

  • Improves scan accuracy for Postman-based applications
  • Supports more complex parameter structures during onboarding and reloads

Enhanced Access Controls for User and Team Operations​

Access controls have been tightened for ROLE_USER accounts across selected user, team, and application endpoints.

Why this matters

  • Reduces unnecessary visibility into users, teams, and team-scoped applications
  • Strengthens tenant isolation and least-privilege access controls
  • Addresses findings identified during external security testing

NG Hotfix Release Update - APIsec_cloud_7.6.1.1 (Jun 05, 2026)​

This hotfix resolves OAuth2-authenticated scans and request body handling, as well as a scan-time display correction and a BOLA configuration enhancement. Affected scans recover automatically on the next run after the deploy.

OAuth2 Scan Failures​

Issue

  • Scans configured with OAuth2 authentication failed to start. Customers attempting to run scheduled or on-demand scans against existing OAuth2 credentials saw token resolution errors.

Fix

  • Token resolution now correctly handles OAuth2 credentials saved before the recent response-key enhancement. Customers with explicitly-configured response keys are unaffected.

Impact

  • Scheduled and on-demand scans on existing OAuth2 credentials resume automatically.
  • No customer action is required. Recovery is automatic on the next scan after deployment.

Request Body Placeholder Handling​

Issue

  • Request bodies referencing variables that could not be resolved at scan time were being sent to target APIs as literal placeholder text, causing the target API to reject the request with a 400 error.

Fix

  • Unresolved placeholders are now emitted as JSON null, matching the expected field type.

Impact

  • Scans no longer fail on endpoints whose bodies reference unresolved variables.
  • Test execution coverage is restored on the affected endpoints.

Scan Time Display​

Issue

  • Scan timestamps on the Scan History and Scan Details pages display UTC time alongside the local timezone label, resulting in inconsistent and confusing scan times.

Fix

  • Timestamps are now converted to the user's local browser timezone, with a clear offset label appended (for example, GMT+3). Scan duration also benefits from the same fix.

Impact

  • Scan start time and duration reflect the user's actual local time.
  • Time formatting is consistent across Scan History and Scan Details.

BOLA Endpoint Selector — Show All Endpoints​

Improvement

  • Added a "Show all endpoints" toggle to the BOLA Add Scenario configuration step. The default filtered view is unchanged.

Impact

  • Customers configuring BOLA on APIs with non-standard endpoint naming conventions can now select directly from the full list of endpoints.
  • No change to the default flow.

NG Production Release Update - APIsec_cloud_7.6.1.0 (Jun 03, 2026)​

This release focuses on improving API onboarding, compliance reporting, and automation. Key highlights include Postman Environments, MITM Proxy onboarding, ISO 27001 and PCI DSS 4.0 reports, short-lived OAuth credentials for CI/CD integrations, and usability improvements across vulnerability investigation, parameter discovery, and hosted agent management.

What's New​

Expanded Visibility for Informational Detections​

Informational findings are now tracked separately from vulnerabilities while supporting the same triage workflows, including ticket creation, False Positive, and Risk Accepted actions.

Why this matters

  • Improves visibility into security observations beyond direct vulnerabilities
  • Provides richer context in Pentest Reports

MITM Proxy Application Onboarding​

Applications can now be onboarded using MITM proxy capture files (.mitm and .flows ). APIsec automatically extracts endpoints and generates an OpenAPI Specification (OAS).

Why this matters

  • Simplifies the onboarding of undocumented APIs
  • Expands support for traffic-capture-based API discovery

Compliance Reports — ISO 27001 & PCI DSS 4.0​

Customer-downloadable compliance reports for ISO 27001 and PCI DSS 4.0 are now available under Application → Reports.

Why this matters

  • Simplifies audit preparation and evidence collection
  • Provides standardized compliance reporting

API Credentials — Short-Lived OAuth Tokens​

You can now create API Clients that issue short-lived OAuth 2.0 access tokens for CI/CD pipelines and integrations, eliminating the need for long-lived credentials.

Why this matters

  • Improves security for automation workflows
  • Provides finer-grained access control for integrations

Postman Environment Support​

You can now attach Postman Environment files to Postman-based applications to automatically resolve {{variable}} placeholders during reloading a spec.

Why this matters

  • Improves scan accuracy by resolving environment-specific values

Originating Scan Context for Vulnerabilities​

Vulnerabilities now include an Originating Scan link that takes you directly to the scan where the finding was first detected, with evidence pre-expanded.

Why this matters

  • Simplifies investigation and validation
  • Preserves historical detection context across rescans

Parameter Hydration — Improved Discovery Experience​

Parameter discovery is now organized by endpoint, with inline editing, confidence indicators, and clearer progress tracking based on endpoint coverage.

Why this matters

  • Improves usability for large APIs
  • Makes parameter validation and discovery easier to manage

Improvements​

OAuth2 Response Key Support​

OAuth2 authentication profiles now support configurable response keys, enabling token extraction from custom fields, such as id_token, or from nested response structures.

Applications without a configured response key continue using access_token by default.

Why this matters

  • Supports a broader range of OAuth implementations
  • Simplifies integration with custom identity providers
  • Reduces authentication configuration workarounds

Improved Hosted Agent Reliability​

Hosted-agent scans now use extended polling timeouts, reducing premature timeouts during large scans and in slower environments.

Agent-side failures that were previously difficult to diagnose are now surfaced directly within scan details.

Why this matters

  • Improves scan reliability for large applications
  • Reduces false scan-stuck scenarios
  • Provides clearer troubleshooting information when failures occur

Explicit Hosted Agent Assignment for New Instances​

New application instances no longer automatically inherit a hosted agent assignment. Users can now explicitly choose whether to associate a hosted agent or use cloud-based scan execution. Existing instances are unaffected.

Why this matters

  • Prevents unintended hosted agent assignments
  • Improves transparency during instance creation

Aborted Scans Show the Correct Status​

Hosted-agent scans that are intentionally stopped now display an Aborted status instead of remaining Active.

Why this matters

  • Improves scan status accuracy
  • Makes it easier to distinguish user-aborted scans from failed executions
  • Provides clearer operational visibility

Security Improvements​

Private Hosted Agent Security Updates​

The Private Hosted Agent image has been updated with the latest dependency and security updates.

Why this matters

  • Keeps hosted agent deployments aligned with the latest security updates
  • Improves the overall security posture of self-managed scan environments

Issue Fixes​

Personal Access Token Error Handling​

Issue: Malformed Personal Access Tokens (PATs) could return a generic 500 Internal Server Error when accessing platform APIs.

Fix: Authentication failures now return clear 401 Unauthorized responses with actionable error details.

Impact

  • Simplifies troubleshooting for API integrations
  • Provides clearer authentication failure feedback

Parameter Discovery Status Accuracy​

Issue: The AppModel dashboard could show Review Discovered Parameters as In Progress even when no user had reviewed or updated any parameters.

Fix: The workflow now moves to In Progress only after a user modifies a discovered parameter.

Impact

  • Progress indicators now reflect actual user activity
  • Reduces confusion during parameter review workflows

Auth Test Results Endpoint Loading​

Issue: The endpoint selector in Auth Test Results intermittently displays No Data.

Fix: Improved endpoint retrieval reliability for large applications.

Impact

  • Improves the stability of Auth Test Results workflows
  • Reduces intermittent endpoint loading failures

Vulnerability Scorecard Counts​

Issue: Instance-level Critical and High vulnerability counts included findings marked as False Positive or Risk Accepted, inflating the totals.

Fix: Scorecards now count only active findings, matching the displayed tooltip and application-level reporting.

Impact

  • Provides more accurate vulnerability counts
  • Aligns scorecards with triage workflows and reporting

MySQL Injection Category Display​

Issue: MySQL Injection scans are displayed as SQL Injection in scan progress and results, and could execute twice during certain batch scans.

Fix: MySQL Injection now runs and is displayed as a dedicated category across the platform.

Impact

  • Improves scan visibility and reporting accuracy
  • Eliminates duplicate execution during batch scans

Postman Reload Error Messaging​

Issue: Postman spec reload failures caused by an invalid Collection ID or API Key displayed a generic error message.

Fix: Error messages now identify which credential is invalid.

Impact

  • Simplifies troubleshooting of Postman reload failures
  • Helps users resolve configuration issues more quickly