Skip to main content

September

· 8 min read

NG Production Release Update - APIsec_cloud_7.9.1.0 ( September 11, 2026 )​

This release expands APIsec’s security testing and enterprise workflow capabilities with new Numeric Bound Fuzzing and Monetary Integrity tests, automated authentication discovery, enhanced Jira integrations, and new FedRAMP and HIPAA/HITRUST compliance reports. It also adds read-back validation for Mass Assignment findings and improves the accuracy and reliability of authentication, parameter hydration, BOLA testing, reporting, and private Hosted Agent scan improvements.

What's New​

Automated Authentication Discovery​

When you onboard an application, APIsec now automatically determines which identity provider the API uses and builds a login for it — discovery starts automatically as soon as the spec registers, with nothing to click. The Configure Credentials card on the App Model panel drives the flow: while discovery runs, the card shows no action, and once a login is ready, the button reads Provide Credentials. Enter the account and the card moves to Completed, attaching a "Discovered login" auth set as the instance default so your next scan can run authenticated.

APIsec recognizes a provider named in the spec or discovers it by probing when the spec doesn't name one — supporting common identity providers such as Auth0, Okta, PingOne, and IBM, plus browser-based login flows. If a provider is found but no login can be built, or the credentials are wrong, the card falls back to the normal Add Authentication drawer without error — you're never left retrying.

Why this matters

  • Removes most of the manual work of configuring authentication
  • Gets scans running authenticated against common enterprise identity providers
  • Falls back cleanly to manual setup when a login can't be discovered

What to expect

  • No scan starts automatically — discovery only configures the login; running a scan is still a deliberate action.
  • Passwords are masked wherever they're shown.
  • A pending credentials prompt won't expire — respond whenever it's convenient.

New Security Test Categories — Numeric Bound Fuzzing & Monetary Integrity​

APIsec now introduces two new security tests for identifying input-validation and business-logic vulnerabilities in numeric and monetary fields.

Numeric Bound Fuzzing tests numeric fields with values outside expected boundaries to identify missing input validation.

Monetary Integrity extends this approach to financial workflows, testing whether APIs enforce valid monetary amounts and, where possible, confirming that unexpected values do not affect the underlying system.

Why this matters​

  • Identifies vulnerabilities caused by missing numeric and monetary validation
  • Helps uncover business-logic flaws that can lead to financial impact
  • Provides stronger validation of findings by confirming whether unexpected values actually affect system state

Mass Assignment — Read-Back Confirmation​

Mass Assignment testing now confirms whether an unauthorized or unexpected field actually changed system state after the request is submitted.

Why this matters​

  • Increases confidence in Mass Assignment findings
  • Distinguishes exploitable behavior from requests that are merely accepted
  • Provides stronger evidence for remediation

Choose the Jira Issue Type​

Jira connections now support Task in addition to the existing Bug issue type. You can select the issue type to create when reporting vulnerabilities, and APIsec validates the selected type against the target project during connection testing.

Why this matters​

  • Aligns vulnerability tickets with your existing Jira workflow
  • Gives teams flexibility to use Bug or Task based on their process
  • Existing Jira connections continue to use Bug by default

Note: Support for Story is coming in an upcoming release.

Map Vulnerability Metadata to Jira Custom Fields​

Jira connections now support mapping APIsec vulnerability metadata, constants, and labels to your Jira custom fields.

Why this matters​

  • Automatically populates tickets with the information your teams need
  • Aligns APIsec tickets with existing Jira workflows
  • Reduces manual ticket updates

Linking or unlinking an issue tracker from an application instance is now recorded in Activity Logs, including the connection, user, and timestamp.

Why this matters​

  • Provides an audit trail for issue-tracker configuration changes
  • Improves visibility into where and when ticketing integrations were changed

Sign in with Google​

Users can now sign in to APIsec using Google Social Login, including linking a Google account to an existing email/password account.

Availability: Live on cloud.apisecapps.com

FedRAMP & HIPAA/HITRUST Compliance Reports​

FedRAMP and HIPAA/HITRUST compliance reports are now available in production, providing the appropriate control mappings and reporting templates. Generate them alongside your other reports.

Why this matters​

  • Simplifies compliance reporting for regulated organizations
  • Presents security findings in the context of applicable FedRAMP / HIPAA-HITRUST controls

Improvements​

Comments on Jira Bulk Updates​

When APIsec updates multiple Jira issues in a single action — for example, bulk-closing findings that are resolved or bulk-changing their disposition — it now also posts the corresponding comment to each issue (the reason the finding was closed, the disposition applied, and so on).

Why it works this way — a Jira limitation: Jira's bulk update and bulk transition APIs do not allow a comment to be attached as part of the bulk operation. To make sure your issues still get that context, APIsec applies the comments as a follow-up step, adding them to each issue individually after the bulk update completes. For very large batches, this means the comment appears shortly after the status change, not at the exact same instant.

Impact​

  • Keeps Jira issues annotated with the reason behind each APIsec-driven change, even during bulk operations
  • Restores the comment context that Jira's bulk API otherwise omits
  • The earlier warning that bulk updates would not include comments has been removed

Clearer Test Credentials & Dry Run Results​

Test Credentials and Endpoint Dry Run now provide more accurate and actionable results for connectivity, authentication, and path-placeholder scenarios.

Impact​

  • Makes authentication and connectivity issues easier to diagnose
  • Reduces false reports of invalid credentials or unreachable endpoints
  • Provides clearer guidance when rate limiting is encountered

More Accurate Parameter Hydration​

APIsec now handles arrays, JSON-encoded examples, and object-schema path parameters more accurately during specification hydration. Impact

  • Reduces malformed request values
  • Improves endpoint testability and scan coverage
  • Better preserves values defined in API specifications

More Precise BOLA Testing​

Basic BOLA scenarios now use the object ID configured for each individual operation instead of reusing an ID from another operation.

Impact​

  • Improves accuracy of multi-step BOLA testing
  • Ensures each operation is tested against its intended resource

Endpoint Values Are Sent as Configured​

Values configured directly on an endpoint request body now take precedence over an instance-level Global Parameter with the same field name.

Impact​

  • Ensures endpoint-specific configurations are respected during scans
  • Provides more predictable request generation

Penetration Testing Report Downloads​

Penetration Testing Reports now generate and download more reliably for applications with large numbers of findings, with clearer feedback when generation fails.

  • Consistent "No Longer Detected" Terminology
    • Findings that are no longer observed are now consistently labeled No Longer Detected across the Dashboard, Security Hub, Developer Report, and Proof of Test.
  • Compliance reports continue to use Resolved.

Impact​

  • Provides consistent terminology across security workflows
  • Makes finding lifecycle states easier to understand

New Private Hosted Agent — Faster Scans​

A new Private Hosted Agent version is now available that runs scans faster and more reliably. It combines increased scan parallelism with memory and I/O tuning, so large, long-running scans complete substantially faster. Update your Private Hosted Agents to the latest version to benefit.

Impact​

  • Faster scan completion, especially on large or long-running scans
  • Improved reliability under heavy load
  • No configuration change required — simply update the hosted-agent image

External Ticket Closure Reasons​

When APIsec automatically closes an external ticket because a finding is resolved or marked out of scope, the ticket now includes the resolution reason.

Impact​

  • Provides better context in external issue trackers
  • Improves traceability between APIsec findings and ticket lifecycle changes

Azure DevOps — Risk-Accepted Revoke​

Revoking a "Risk Accepted" disposition now adds a comment to the linked Azure DevOps work item identifying the action, without changing the work-item state.

Browser Bolt Onboarding Improvements​

Browser Bolt onboarding now preserves custom application names, correctly identifies path parameters, and retains all endpoints from single-domain captures.

Activity Log — Vulnerability Ticket Filter​

A new Log Vuln Tickets filter is now available in Activity Logs and Task Logs. We also removed a stale Jira bulk-close warning.