Skip to main content

July

· 15 min read

NG Production Release Update - APIsec_cloud_7.7.4.0 ( July 31, 2026 )​

This release improves scan reliability for hosted-agent deployments, introduces SSO group-to-team mapping, enhances CI/CD automation by preventing duplicate scans, and expands Dashboard V2 with clearer application health and policy visibility. Additional improvements strengthen SSL/TLS and PII detection accuracy, while several workflow enhancements improve the overall user experience.

What's New​

Resilient Handling of Unreachable Hosted Agents​

Scans now verify that the configured hosted agent is reachable before execution and continue monitoring connectivity throughout the scan. If the hosted agent or target becomes unreachable, the scan stops immediately and reports a clear failure reason instead of continuing with unsuccessful test execution.

Why this matters​

  • Detects connectivity issues before lengthy scan failures occur
  • Provides clear diagnostics when hosted agents become unreachable
  • Ensures scans always execute using the configured scan environment

Note: Additional hosted-agent health monitoring and scheduled scan notifications are planned for a future release.

Prevent Duplicate Scans in CI/CD Pipelines​

The Scans API now supports querying for running scans, allowing CI/CD pipelines to determine whether a scan is already in progress before starting another.

Why this matters​

  • Prevents duplicate scan execution
  • Optimizes CI/CD pipeline efficiency
  • Reduces unnecessary scan activity

Dashboard V2 Enhancements​

Dashboard V2 now provides a more accurate view of application readiness, policy compliance, and recommended next steps directly from the Overview page.

Why this matters​

  • Improves visibility into application health
  • Surfaces policy compliance more clearly
  • Reduces navigation during application onboarding and review

Improvements​

SSL/TLS Enforcement Detection​

Problem​

SSL/TLS enforcement testing could report a vulnerability when an endpoint responded to an HTTP request with an error status, even though it was not serving content over unencrypted HTTP.

Solution​

Detection logic now reports an SSL/TLS enforcement vulnerability only when the endpoint successfully serves content over HTTP. Non-success HTTP responses are surfaced as Informational detections instead.

Impact​

  • Reduces false positives for non-success HTTP responses
  • Preserves visibility through Informational detections
  • Improves confidence that SSL/TLS findings represent actual unencrypted traffic
  • Existing findings may be reclassified as Informational after the next scan as part of this refinement

Improved PII Detection​

Problem​

PII detection could miss certain sensitive data patterns.

Solution​

Detection logic has been enhanced to identify previously missed cases.

Impact​

  • Improves detection coverage
  • Produces more reliable PII findings

Guided Actions Status Updates​

Problem​

The Guided Actions authentication step did not immediately reflect completed authentication until the page was refreshed.

Solution​

Authentication status now updates automatically after successful configuration.

Impact​

  • Provides real-time onboarding progress
  • Eliminates unnecessary page refreshes

Auto-Reload Schedule Updates​

Problem​

Changes to an Auto-Reload schedule were not reflected immediately after saving.

Solution​

The next scheduled reload time now updates as soon as the configuration is saved.

Impact​

  • Displays accurate scheduling information immediately
  • Improves configuration visibility

Security Hub Notification Recipients​

Problem​

SSO-provisioned users could not be selected as Security Hub notification recipients.

Solution​

SSO users can now be added as Security Hub recipients.

Impact​

  • Improves notification management for SSO-enabled organizations
  • Supports Security Hub workflows using federated identities

NG Production Release Update - APIsec_cloud_7.7.3.0 ( July 21, 2026 )​

This release expands authentication capabilities with headless browser-based authentication for Custom Auth Chains. Additional improvements strengthen CI/CD automation, scheduled scan reliability, detection accuracy, and API credential security, while numerous fixes improve usability and platform reliability.

What's New​

Browser-Based Authentication for Custom Auth Chains​

Custom Auth Chains now support browser-based authentication for login flows that require JavaScript execution, such as OAuth 2.0 Authorization Code with PKCE. A browser-enabled hosted agent can execute browser-dependent authentication steps while preserving the existing authentication workflow for the remainder of the chain.

Why this matters​

  • Enables authenticated scanning of applications that require browser-based login flows
  • Supports modern identity providers using OAuth 2.0 with PKCE
  • Expands authentication coverage for enterprise applications

Note: A browser-enabled Hosted Agent image is available for deployments requiring browser-based authentication. Standard Hosted Agent deployments remain unchanged.

Expanded API Token Scopes for Automation​

API Credentials now support additional fine-grained scopes for CI/CD automation, including Scan Profiles, Scheduled Scans, Integration Connections, and Issue Tracker management.

Why this matters​

  • Enables more granular access control for automation
  • Supports least-privilege security practices
  • Improves flexibility for CI/CD integrations

Improvements​

Improved Scheduled Scan Reliability​

Scheduled scans now execute more reliably for applications configured with multiple authentication profiles.

Why this matters​

  • Improves scan reliability for complex authentication configurations
  • Reduces unexpected scan failures during scheduled execution

Enhanced Detection Accuracy​

Detection improvements have been made for time-based MySQL injection and credential-enforcement validation, reducing false positives and improving scan accuracy.

Why this matters​

  • Improves confidence in security findings
  • Reduces false positives during automated testing

One-Time Display of API Tokens​

Newly created Personal Access Tokens are now displayed only once during creation, matching the existing behavior for Client Credential secrets.

Why this matters​

  • Improves protection of sensitive credentials
  • Encourages secure token management practices

Parameter Discovery Authentication​

Problem​

Parameter Discovery could ignore the selected authentication profile and execute under a different credential.

Solution​

Parameter Discovery now consistently uses the selected authentication profile.

Impact​

  • Improves parameter discovery accuracy
  • Produces more complete results for multi-role applications

Multi-Team Application Visibility​

Problem​

Users belonging to multiple teams could see applications from only one team.

Solution​

Applications from all assigned teams are now displayed correctly.

Impact​

  • Improves application visibility for multi-team users
  • Ensures access matches assigned team memberships

Large Header Values​

Problem​

Very large numeric header values could prevent Environment headers from being saved.

Solution​

Large numeric values are now handled correctly during header configuration.

Impact​

  • Improves compatibility with applications using large numeric identifiers
  • Prevents configuration save failures

Ticket Creation from Scan Details​

Problem​

Creating tickets directly from the Scan Details page did not consistently create issues in connected trackers.

Solution​

Ticket creation now functions correctly, with ticket IDs reflected in Vulnerabilities and Threat Detection views.

Impact​

  • Improves issue management workflows
  • Provides better visibility into linked tickets

Specification Reload Resiliency​

Problem​

Specification reloads could fail when previously imported specifications contained unresolved references.

Solution​

Reloads now tolerate unresolved references, and failures provide clearer diagnostic information.

Impact​

  • Improves specification reload reliability
  • Simplifies troubleshooting when reloads fail

Guided Actions Scan Status​

Problem​

Guided Actions could incorrectly report an authenticated scan after an unauthenticated scan completed.

Solution​

Scan status now accurately reflects the type of scan that was executed.

Impact​

  • Improves scan reporting accuracy
  • Reduces confusion during remediation workflows

Scan Profile Validation​

Problem​

Scan Profiles could be saved without any selected endpoints, resulting in validation errors.

Solution​

At least one endpoint must now be selected before saving.

Impact​

  • Prevents invalid Scan Profile configurations
  • Improves user experience during profile creation

Duplicate Application Prevention​

Problem​

Concurrent uploads of the same API specification could create duplicate applications.

Solution​

Duplicate application creation is now prevented.

Impact​

  • Improves application inventory consistency
  • Prevents duplicate onboarding

Auto-Onboard Activity Logging​

Problem​

Auto-onboarding activities were difficult to identify in Activity Logs.

Solution​

Activity Logs now include improved logging and a dedicated Auto Onboard filter.

Impact​

  • Improves visibility into automated onboarding activities
  • Simplifies operational troubleshooting

NG Production Release Update - APIsec_cloud_7.7.2.0 ( July 09, 2026 )​

This release introduces centralized API credential management, reusable global authentication profiles, OAuth PKCE support using Custom Authentication Chains, enhanced authentication validation for API-driven scans, and new Scan-and-Gate capabilities for CI/CD pipelines. Additional fixes improve BOLA scenario generation and polish SSRF detection reporting.

What's New​

API Credentials Management​

A new API Credentials page provides self-service management for both Personal Access Tokens (PATs) and OAuth Client Credentials. Users can create, manage, and revoke their own credentials, while administrators can manage credentials across the tenant.

Why this matters​

  • Centralizes credential management in a single location
  • Simplifies API automation and integrations
  • Improves security through scoped, expiring credentials

Global Credentials​

Global Credentials allow a single authentication profile to be shared across multiple application environments. Updating a global credential automatically applies the change wherever it is linked.

Why this matters​

  • Simplifies credential rotation across applications
  • Reduces administrative effort and configuration drift
  • Maintains secure access through application-aware RBAC

OAuth PKCE Support​

Custom Authentication Chains now support OAuth 2.0 Authorization Code flows with Proof Key for Code Exchange (PKCE). APIsec automatically manages PKCE parameters during authentication, simplifying configuration for supported identity providers.

Why this matters​

  • Enables authenticated scanning of APIs protected by PKCE
  • Simplifies OAuth configuration for modern identity providers
  • Expands support for secure authentication workflows

Pre-Scan Authentication Validation​

API-driven scans can now optionally validate authentication credentials before scan execution. When enabled, the platform performs a lightweight authentication check against the endpoint used during the most recent Test Authentication execution. If the credentials are rejected, the scan is terminated instead of proceeding with unauthenticated requests.

API callers can control this behavior using the ignoreAuthFailure flag in the scan request:

  • ignoreAuthFailure: false (default) — The scan is aborted if authentication validation fails.
  • ignoreAuthFailure: true — The scan continues even if authentication validation fails, allowing unauthenticated portions of the scan to proceed.

Why this matters​

  • Detects authentication issues before scan execution
  • Prevents unnecessary scans caused by invalid credentials
  • Gives API integrations the flexibility to either fail fast or continue with partial coverage based on automation requirements

Note: This capability is currently opt-in for API-triggered scans. Existing UI, scheduled, and API scan behavior remains unchanged unless explicitly enabled.

Scan-and-Gate Enhancements​

The Scan-and-Gate container now supports evaluating existing scan results without triggering a new scan and provides direct links from CI/CD failures to the corresponding findings in APIsec.

Why this matters​

  • Accelerates CI/CD pipelines
  • Simplifies investigation of failed security gates
  • Improves developer productivity during remediation

Issue Fixes​

BOLA Scenario Generation​

Problem​

Automatically generated BOLA scenarios could include duplicate entries for the same endpoint.

Solution​

Scenario generation now removes duplicate endpoints based on HTTP method and path.

Impact​

  • Produces cleaner BOLA scenario lists
  • Prevents duplicate test execution during BOLA scans

SSRF Detection Messaging​

Problem​

SSRF detection findings contained a typographical error in the assertion text.

Solution​

The finding message has been corrected across all SSRF detection variants.

Impact​

  • Improves the quality and professionalism of customer-facing reports

NG Production Release Update - APIsec_cloud_7.7.1.0 ( July 03, 2026 )​

This release introduces Dark Mode, removes the 30-day access limit for PLG users, strengthens Hosted Agent security, and enhances authentication failure handling across supported authentication schemes. Additional fixes improve hosted-agent scheduling, protect sensitive data, enhance diagnostics for authentication failures, and improve the accuracy of Security Hub reporting.

What's New​

Dark Mode​

Dark Mode is now available across the platform. Users can switch between light and dark themes at any time from User Preferences. Currently, their preference isn't preserved across different browser sessions.

Why this matters​

  • Improves readability in low-light environments
  • Reduces eye strain during extended sessions
  • Let users personalize their experience without administrator involvement

Partial Credential Enforcement​

A new detection category identifies APIs that advertise multiple authentication requirements—such as Authorization headers, API keys, session cookies, or XSRF tokens—but enforce only a subset during request validation. Endpoints that accept requests with one or more required credential elements missing are flagged for review.

Why this matters​

  • Detects authentication gaps that may be overlooked by traditional authentication tests
  • Helps ensure every required credential element is actively validated
  • Identifies weaknesses in composite authentication schemes involving multiple headers or cookies
  • Improves detection accuracy by validating both HTTP responses and application response content to minimize false positives

Improvements​

Extended Access for PLG Users​

The 30-day access restriction for PLG users has been removed. Existing users who were previously locked out automatically regain access without requiring any action from users, administrators, or support.

Why this matters​

  • Enables uninterrupted product exploration
  • Eliminates unnecessary access interruptions
  • Provides a smoother onboarding experience

New Hosted Agent Release​

A new Hosted Agent version introduces improved startup validation for mutual TLS (mTLS) certificate configuration. Certificate configuration issues are now detected during startup with clear, actionable error messages.

Why this matters​

  • Detects certificate configuration issues earlier
  • Reduces scan failures caused by invalid mTLS configuration
  • Improves deployment reliability for private Hosted Agents

Note: Customers running Private Hosted Agents are encouraged to deploy the latest agent version to receive these improvements.

Enhanced Authentication Failure Handling​

Authentication failure detection has been expanded to support Basic Authentication, API Key, and HMAC authentication schemes. A new option also allows scans to continue after authentication failures while clearly identifying unauthenticated requests.

Why this matters​

  • Improves visibility into authentication configuration issues
  • Produces more reliable scan results across supported authentication methods
  • Allows teams to troubleshoot authentication failures while still collecting partial scan results

Issue Fixes​

Scheduled Scans for Hosted Agent Applications​

Problem​

Scheduled scans for applications configured to use Hosted Agents could fail without appearing in Scan History.

Solution​

Scheduled scans and Test Credentials now consistently use the configured Hosted Agent for scan execution.

Impact​

  • Improves the reliability of scheduled scans
  • Ensures failures are visible in Scan History
  • Supports environments accessible only through Hosted Agents

Protected Header Values During Test Reachability​

Problem​

Confidential header values could be displayed in clear text during Test Reachability.

Solution​

Sensitive header values remain masked across all application views, including Test Reachability.

Impact​

  • Protects confidential authentication data
  • Improves the security of environment configuration workflows

Improved Test Credentials Diagnostics​

Problem​

Authentication and connectivity failures often returned a generic "Internal Server Error," making troubleshooting difficult.

Solution​

Test Credentials now surfaces the target system's HTTP status code, response body, and diagnostic information when available.

Impact​

  • Simplifies troubleshooting of authentication and connectivity issues
  • Provides clearer diagnostics for WAF, OAuth, networking, and access configuration problems

Security Hub Summary Accuracy​

Problem​

Security Hub summary metrics may display inaccurate counts of scans, endpoints, and vulnerabilities.

Solution​

Security Hub now calculates summary metrics correctly and excludes informational findings from vulnerability totals.

Impact​

  • Improves reporting accuracy
  • Aligns dashboard metrics with application-level reporting

Security Hub Timezone Reporting​

Problem​

Security Hub summary metrics displayed zero values for users in certain time zones.

Solution​

Date calculations have been updated to ensure consistent reporting regardless of the timezone.

Impact​

  • Provides accurate Security Hub metrics across all supported time zones
  • Ensures consistent reporting for global teams