Skip to main content

August

· 13 min read

NG Production Release Update - APIsec_cloud_7.8.3.0 ( August 31, 2026 )​

This release expands APIsec's platform capabilities across API lifecycle management, security validation, CI/CD automation, and operational visibility. New capabilities include flexible App Model onboarding controls, GitHub App integration, Platform ID-based API registration for CI/CD, Splunk audit-event forwarding, endpoint change visibility during spec reloads, and Personal Access Token expiry notifications. The release also introduces exploit-validation visibility and new security tests for refresh-token replay.

What's New​

Register and Scan APIs Using Platform ID​

CI/CD pipelines can now register and resolve APIs using a customer-defined Platform ID and optional version instead of storing APIsec application IDs between pipeline runs.

Why this matters​

  • Enables stateless CI/CD onboarding without persisting APIsec IDs
  • Re-running a pipeline updates the existing application instead of creating duplicates
  • Existing applications can be looked up or associated using their Platform ID

Audit Event Forwarding to Splunk​

Administrators can now forward APIsec audit events, including sign-ins and application or user changes, to Splunk through a Splunk HTTP Event Collector (HEC) integration. The integration includes connection testing and supports resilient delivery when the Splunk endpoint is slow or temporarily unavailable. Self-signed certificates are supported for on-premises Splunk deployments.

Why this matters​

  • Extends APIsec audit visibility into existing SIEM workflows
  • Helps security teams centralize platform activity and monitoring
  • Provides reliable event delivery without impacting platform operations

App Model — Skip / Undo Skip Onboarding Steps​

You can now skip the Authentication, RBAC, or BOLA onboarding step when it does not apply to an application. Skipped steps are clearly identified in the App Model and can be restored at any time using Undo Skip.

Why this matters​

  • Keeps applications from remaining in Building when an onboarding area is not applicable
  • Provides clear visibility into skipped onboarding steps
  • Skipping is limited to onboarding progress and does not disable scanning or dismiss existing vulnerabilities

GitHub App Integration​

APIsec now supports a GitHub App integration for connecting source repositories. The integration provides repository inventory, lifecycle and coverage synchronization through webhooks, and per-repository coverage visibility.

Why this matters​

  • Simplifies connecting GitHub repositories with APIsec
  • Keeps repository status and coverage information synchronized
  • Provides visibility into API security coverage at the repository level

Endpoint Diff on Spec Reload​

APIsec now displays a clear comparison of added and removed endpoints when an OpenAPI specification is reloaded. The changes are scoped to the reloaded instance and can be reviewed through the activity log.

Why this matters​

  • Makes API changes easier to review after a specification reload
  • Provides clear visibility into endpoint additions and removals
  • Helps teams understand how a reload changes the API inventory

Personal Access Token Expiry Notifications​

Users can now receive notifications when a Personal Access Token is approaching expiration and when it expires. Expiry notification preferences can be configured from Account settings.

Why this matters​

  • Helps prevent automation interruptions caused by expired tokens
  • Gives users advance notice to rotate credentials
  • Provides control over token-expiration notifications

Delete Endpoints Without Reloading the Spec​

Endpoints can now be removed directly from the endpoint inventory without reloading the entire API specification. Endpoint deletions are recorded in the activity log and propagated downstream.

Why this matters​

  • Allows users to remove unwanted endpoints immediately
  • Eliminates the need for a full specification reload
  • Provides an auditable record of endpoint changes

Refresh Token Replay​

A new authentication test identifies refresh tokens that can be redeemed more than once, including cases in which token rotation occurs without detection of reuse.

Improvements​

Clearer Test Credentials and Dry Run Failures​

Test Credentials and Dry Run now display the underlying transport error, such as TLS or certificate failures, instead of a generic error message.

Impact​

  • Makes connectivity and certificate issues easier to diagnose
  • Provides more actionable information when validation fails

OAuth Tests for Custom Authentication Chains​

OAuth-focused security tests, including authorization-code replay and open redirect testing, now execute for applications configured with OAuth through a Custom Authentication Chain.

More Accurate Numeric Parameter Hydration​

Numeric parameters, including double and float values, now hydrate using their configured global values instead of being sent as null.

Dynamic Parameter Values​

Relative dates, timestamps, and UUIDs now resolve correctly at scan time in the requested format. Interdependent date relationships are preserved, while invalid type or format combinations now return a clear validation error.

Gateway Path-Prefix Reachability​

Scans using a gateway path prefix that does not respond at the bare host now fall back to an endpoint-level reachability check instead of being incorrectly aborted during preflight.

Content-Type on Body-less Requests​

Body-less requests no longer automatically use Content-Type: application/json . APIsec now honors the declared content type and sends an appropriate Accept header where applicable.

More Accurate Injection and Authentication Enforcement Detection​

Detection logic has been refined to reduce time-based injection false positives and correctly identify input-less endpoints that reject unauthenticated requests as authentication-enforced.

Resolution Reasons Flow to Issue Trackers​

Resolution or dismissal reasons are now passed to linked issue-tracker tickets, and the ticket is automatically closed to keep the finding status synchronized.

Coverage and Readiness Reports​

Business Unit and Team filters now correctly update the Readiness Coverage chart, and the Coverage Overview total is now consistent between the UI and generated PDF.

NG Production Release Update - APIsec_cloud_7.8.2.0 ( August 18, 2026 )​

This release introduces email notifications for key scan and Hosted Agent events, automated TOTP authentication for browser-based scans, and additional CI/CD capabilities. It also adds Business Unit and Team-scoped Security Hub exports and improves scan reliability, TLS testing, parameter configuration, and ServiceNow and Azure DevOps integrations.

What's New​

Email Notifications for Key Events​

You can now opt in to email notifications for events that need your attention, including scan failures and Hosted Agent token expiration. Notifications are off by default for each user and can be enabled from Notification Preferences. You have flexible control over both when and what you receive:

  • Choose live, daily, or weekly email delivery based on your preference.
  • Enable notifications across all applications, select only specific applications, or select all and exclude specific applications.
  • Configure each notification type independently to receive only the alerts that are relevant to you.

Why this matters​

  • Gives users control over the volume and frequency of email notifications
  • Helps surface important events without requiring constant dashboard monitoring
  • Reduces notification noise by allowing application-level filtering

Availability: ROLE_ADMIN and ROLE_USER in Enterprise tenants only. PLG users do not currently have access to Notifications.

Note: Notifications for API (Personal Access) Token expiration are coming in an upcoming release.

Automated Two-Factor (TOTP) Authentication During Scans​

Scans can now automatically complete login flows that require a six-digit authenticator-app code, such as Google Authenticator, Authy, or Microsoft Authenticator. The agent generates and submits the time-based code using the configured authenticator secret.

Why this matters​

  • Enables authenticated scanning without disabling two-factor authentication
  • Eliminates manual intervention during scans
  • Supports more realistic security testing of protected applications

Note: Available with the APIsec cloud agent. Private Hosted Agent support is coming in an upcoming release.

Improvements​

List Scans by Status via API Credentials​

The List Scans API now supports Personal Access Tokens and status filtering for scans that are running, completed, failed, or aborted. CI/CD pipelines can use this to identify and retrieve scans without requiring the scan ID.

Why this matters​

  • Simplifies CI/CD scan orchestration
  • Helps prevent unnecessary duplicate scan execution
  • Provides greater flexibility for automated workflows

Simpler CI/CD Setup​

The APIsec host is now built into scan-and-gate and code-bolt, eliminating the need to provide the api-url flag.

Why this matters​

  • Simplifies CI/CD configuration
  • Reduces configuration errors

Security Hub CSV Export by Business Unit and Team​

Security Hub vulnerability data can now be exported to CSV based on the selected Business Unit and Team.

Why this matters​

  • Simplifies reporting for specific organizational groups
  • Provides focused vulnerability data for analysis and reporting

Issue Fixes​

Scans Against WAF-Protected Targets​

Problem​

Scans against WAF-protected targets could fail the reachability check when required custom headers were configured.

Solution​

The pre-scan reachability check now includes the instance's configured custom headers.

Impact​

  • Improves scan reliability for WAF-protected applications
  • Prevents valid targets from being incorrectly marked unreachable

Instances with an Empty Base URL​

Problem​

Instances without a valid base URL could be dispatched to a Hosted Agent, resulting in reachability testing failures.

Solution​

Instances resolving to / are now identified as unreachable before reachability triggers with a clear diagnostic.

Impact​

  • Prevents Hosted Agent crashes caused by invalid instance URLs
  • Provides clearer feedback for incomplete API configurations

SSL Test for TLS 1.1​

Problem​

The SSL security test could skip TLS 1.1 validation.

Solution​

TLS 1.1 is now correctly evaluated during SSL testing.

Impact​

  • Improves coverage of legacy TLS configurations
  • Ensures TLS 1.1 endpoints are properly assessed

Numeric Body Parameter Configuration​

Problem​

Required numeric body parameters could not be cleared to use a global variable.

Solution​

Numeric parameters can now be cleared using the - sentinel to resolve their value from a global variable at scan time.

Impact​

  • Provides greater flexibility for parameter configuration
  • Preserves validation for genuinely invalid numeric values

Endpoint Dry Run Testability​

Problem​

Endpoint Dry Run could use an internal validation request as the displayed test result, leading to an inaccurate testability verdict.

Solution​

The internal validation probe is now handled separately from the actual testability result.

Impact​

  • Provides more accurate endpoint readiness information
  • Improves confidence in Dry Run results

ServiceNow AVR — Risk Accepted Status​

Problem​

Marking a finding as Risk Accepted in APIsec could set the linked ServiceNow AVR item to Closed.

Solution​

Risk Accepted findings now set the ServiceNow item to Deferred, while redetected findings continue to reopen as expected.

Impact​

  • Aligns ServiceNow status with the intended risk disposition
  • Improves synchronization between APIsec and ServiceNow workflows

Azure DevOps Ticket Auto-Creation​

Problem​

Automatic ticket creation could fail for configured Azure DevOps integrations.

Solution​

Azure DevOps ticket creation has been corrected and now works reliably with configured integrations.

Impact​

Restores automated issue creation Improves reliability of Azure DevOps workflows

NG Production Release Update - APIsec_cloud_7.8.1.0 ( August 07, 2026 )​

This release introduces centralized metadata tag management, CSV export for the Security Hub Vulnerability Age Matrix, and deeper ServiceNow Vulnerability Response integration. Additional improvements enhance SSO team synchronization, parameter hydration, issue-tracker configuration, and hosted agent security, while several fixes improve Postman imports, automatic ticketing, and authentication detection accuracy.

What's New​

Application Metadata Tags​

Administrators can now create and manage metadata tag fields, assign tags to applications and instances, and search tags across the platform. Metadata tags are also included when creating tickets in the connected ServiceNow issue tracker.

Why this matters​

  • Simplifies application organization and search
  • Prevents duplicate metadata definitions
  • Provides richer context in issue-tracker workflows

ServiceNow Vulnerability Response Integration​

The ServiceNow integration now aligns with the native Vulnerability Response (VR) workflow. Risk Accepted and False Positive dispositions synchronize between ServiceNow and APIsec, and metadata tags are automatically included on Application Vulnerable Items (AVIs).

Why this matters​

  • Aligns remediation with existing ServiceNow approval workflows
  • Synchronizes vulnerability dispositions across both platforms
  • Improves filtering and routing using metadata tags

Export Vulnerability Age Matrix to CSV​

You can now export the underlying detections from the Security Hub Vulnerability Age Matrix directly to CSV for offline analysis and reporting.

Why this matters​

  • Simplifies reporting and data analysis
  • Exports all matching detections, not just the current page
  • Includes key vulnerability and application details for further processing

Improvements​

Improved Parameter Hydration Coverage​

Problem​

Parameter hydration provided limited coverage for certain request structures and authentication configurations.

Solution​

Parameter hydration has been enhanced to better support array-based request bodies and complex authentication scenarios.

Impact​

  • Improves parameter discovery coverage
  • Produces more complete scan inputs
  • Increases scan accuracy for complex APIs

Automatic Ticket Creation​

Problem​

Automatic ticket creation could fail if the owner of a scheduled scan had been deprovisioned from the tenant.

Solution​

Automatic ticket creation no longer depends on the original schedule owner's account.

Impact​

  • Ensures automatic ticket creation continues uninterrupted
  • Improves reliability across user and ownership changes

Test Connection Click Reliability​

Problem​

Buttons only responded when users clicked directly on the label text. Clicking elsewhere within the button did not trigger the action.

Solution​

Button interactions have been updated so the entire button surface is clickable.

Impact​

  • Improves usability and click responsiveness
  • Provides a more consistent user experience across the application

Postman Import for Array-Based Request Bodies​

Problem​

Importing Postman collections containing arrays of similar objects could result in incomplete request bodies.

Solution​

All array elements are now imported correctly.

Impact​

  • Preserves complete request payloads
  • Improves scan accuracy for bulk operations

Authentication Detection Accuracy​

Problem​

Certain APIs could generate false authentication findings when credentials were supplied in the request body or when authentication failures were returned within HTTP 200 responses.

Solution​

Authentication detection now evaluates both response content and configured authentication rejection indicators instead of relying solely on HTTP status codes.

Impact​

  • Reduces false authentication findings
  • Improves detection accuracy for modern API implementations
  • Provides more reliable authentication validation

Private Hosted Agent Security Updates​

The Private Hosted Agent has been updated with the latest runtime, dependency, and security improvements.

Why this matters​

  • Improves the security posture of hosted agent deployments
  • Incorporates the latest dependency updates
  • No changes are required to existing deployment workflows