Release notes — 21 September to 15 October 2026

Summary

Release 20261015.1. Two new add-ons arrive in this release. API security testing checks that your API refuses what it should and says nothing it should not, using the tests, packs and environments you already have. Performance testing runs load, stress, spike, soak and other load tests built from your existing tests, and its reports say why a run failed in plain words. Shift-Left API also gains more ways to sign in to the APIs you test, file uploads and form bodies, import by pasting a cURL command, background import of very large specifications, per-project AI generation settings, and an assistant that is available on every screen. A long list of fixes from customer and tester reports is included.

Improvements

API security testing (paid add-on; Trial includes it)

• Security checks are generated beside your functional tests and run in your packs, on your schedules and from your CI. A request without credentials, an expired or tampered token, another user's record, injection in input, an oversized body, a missing security header, a secret in a response: each is checked, and each failure becomes one finding with a severity, the evidence, the standards it maps to and how to fix it.
• Access checks between users. Add test users in place and Shift-Left API proposes who should be able to reach what from your roles and scopes, then checks that one user cannot read or change another's data, including across tenants and in GraphQL.
• Deeper checks: injection families for SQL, NoSQL, templates, directory and XPath queries; blind SSRF and XXE confirmed out of band; JWT algorithm confusion and refresh token replay; replay and race checks on one-time steps; business-flow abuse (skipped, reordered or tampered steps); rate-limit bypass; and personal data recognised in responses.
• Test an MCP server before it ships: anonymous access, tool descriptions that read like instructions, unbounded results, credentials in results, and destructive tools that a read-only user can call.
• Your gateway as a second source. Import API Management, Kong, AWS, MuleSoft, Cloudflare or NGINX configuration, or access logs, and see operations that are reachable but not in your specification, which versions are actually called, and a suggested gateway policy for each fix.
• Every report starts with what it could not check and why, and never claims coverage it does not have. A gateway or WAF answering for the API makes the result "partial", not "clean".
• One Security screen with tabs for Overview, Findings, Categories, Checks, Inventory, Attack surface, Compliance and Scans, a project portfolio sorted worst first, CVSS base scores, owners and due dates, compliance framework mapping, and a plain-language explanation of every check and finding.
• Work where your team works: findings as Jira or Azure DevOps tickets kept in step both ways, one security comment per pull request, the action list sent to Slack or Teams, security events sent to a SIEM (syslog/CEF, Splunk, Sentinel, Elastic), a CI policy that can warn before it blocks, scheduled environment scans, and a PDF report made offline.
• Checks that change data are gated per environment, and a retest of one finding confirms whether a fix shipped and names the build.

Performance testing (paid add-on; Trial includes it)

• Load, stress, spike, soak, breakpoint, concurrency and rate-limit tests built from the tests you already have, for REST, SOAP, GraphQL and JSON-RPC (WebSocket-RPC calls and MCP server endpoints cannot be load-tested).
• Reports give percentiles, a judged window and verdicts in words, with targets you set and a "verified under load" column in the traceability matrix. The same report is available on screen, as HTML, JSON and JUnit, and as a share link.
• When a run fails, the report says why: every cause, in the server's own words, with a run log and run history grouped by cause. Run history also appears under Reports.
• Distributed load agents, and any computer can be offered as a load agent with no terminal; an administrator approves it.
• Run validity: credentials are confirmed on the requests actually sent, status and body checks are evaluated under load, request counts reconcile (planned, sent, completed, never sent), and a run whose credentials would not be sent is refused rather than sent unauthenticated.
• "Run a controlled diagnostic" builds the rerun a report recommends when load was never sent, ready for you to review; it does not start a run on its own.
• The assistant explains a performance run so a non-engineer can act on it.

Signing in to the APIs you test

• OAuth 2.0 sign-in in a browser (authorization code with PKCE) or with a device code, with refresh-token rotation. Your own callback URL and all five grant types are supported.
• Sign in with steps: for APIs that sign in with several calls of their own, such as a login, a one-time code and a token, with a custom refresh. The code is typed once per sign-in.
• More methods: JWT Bearer signing, NTLM, Hawk and OAuth 1.0 options, and Postman auth (including inherited auth) imported with the collection.
• The assistant can set up a project's authentication from chat. It never takes a secret in the conversation; it opens the Authentication screen for that instead.

Building and importing tests

• File uploads and form bodies: URL-encoded forms, multipart with file parts, and whole-file bodies. Uploaded files are de-duplicated and the editor shows how much storage a project uses.
• Import by pasting: paste a cURL command and it becomes an endpoint plus a test that sends exactly what the command sends, or paste a specification as text.
• Very large specifications (for example Microsoft Graph) import as a background job that survives a restart, one import per project at a time.
• Re-importing an unchanged file asks "No changes found — update anyway?" instead of creating a new version.
• Fill a project's existing tests from a data set (CSV, Excel, JSON, YAML or XML), by button or through the assistant, with a preview before and an undo after.
• Follow redirects can be set per test, and certificate checking or a custom CA per environment.
• AI test generation settings are now per project (Project Settings > AI Generation), and the AI's test types follow the project's enabled strategies.

Project Assistant

• The assistant is available on every screen, including with no project open, and knows what you are looking at. A question about something else is answered about that thing.
• "Why did this fail?" starts from the product's own verdict on the run, compares with the last green run, and offers only the next steps that verdict allows.
• Reviews of a project, a requirement, a pack, the security posture or performance results; nudges that point out what needs attention; and "Make this better", which proposes up to five changes, each shown with a before and after.
• An optional automatic summary on each pack's report, and "What changed" at the top of scheduled reports.
• The MCP server that Claude, Cursor and other agents use now reads through the same lookups as the assistant, including security and performance results.

Desktop app and platform

• A new home page that walks you through the API-testing journey, one project bar across sections, and compact navigation on narrower screens.
• Share links from the desktop app: set a Public Address in Settings, or share an HTML report and a link that opens the dashboard in Shift-Left Studio.
• One licensed session per user: signing in elsewhere ends the earlier session, and the sign-in screen says why.
• Starting the Agent when Studio opens is now a setting, and only one Agent runs at a time.
• The Engine and Local Runner appear in Windows as "Shift-Left Engine" and "Shift-Left Local Runner", with our name and icon.

Fixes

• Import: importing an OpenAPI, Swagger, WSDL or GraphQL specification now creates endpoints only; generate tests from them when you are ready. A Postman request or a pasted cURL command still becomes a test. A GraphQL schema imports again and its tests send a real operation. Importing the same specification again no longer creates a new version, and re-importing after deleting a version no longer fails.
• Test generation: duplicate success tests are merged into one, severity is no longer "critical" for every check on an authenticated endpoint, unticking Performance means no response-time tests, regeneration keeps edited and AI tests current, JSON-RPC tests expect 200 and send the method's parameters, and a bodiless REST test no longer sends a Content-Type.
• Execution and data: a data-driven step's assertions resolve their row values, sheet columns bind only to fields the request has, the Run button's iteration count reads the bound data, individual test runs are tracked separately, recurring packs run when they are due, and a sub-second run no longer reports 0 ms.
• Sign-in: cookie logins send the CSRF token back, an unfilled {{variable}} is never sent, and cookie login and sign-in steps say why the server refused.
• Mocks: a mock answers only its declared SOAP version, and mocks can be generated in bulk with a reason for each one that could not be.
• Workflows: a test opened from a workflow uses the right authentication profile, the step result appears in the step popup, set-aside suggestions can be brought back, and workflow suggestions stay within the projects you can open.
• Requirements: delete is explained while a document is being read, rules quoted in Markdown tables are kept, and a hand-written requirement appears in the Requirements section.
• Licensing: a new key after an expired one refreshes every screen, an add-on switched on after activation takes effect, and a single-tenant install on a subdomain reads its licence.
• Interface: environment base URLs are no longer cleared when another environment becomes the default, Check for changes saves unsaved monitored URLs first, bulk generation progress survives leaving the screen, deleted features leave the sidebar, and pack runs show their own feature instead of "Unknown Feature". Ten further layout and copy issues across tests, the editor, packs and reports are fixed.
• Desktop: a password-reset link opens in the desktop app, zoom is kept across minimise and restore, Ctrl+= zooms in, and the test view shows the real Agent version.
• Installer and updates: an Engine update no longer fails while the service is still starting or when its folder is in use, a refused stop is retried, a retried update no longer overwrites the previous Engine, and a reinstall after uninstalling no longer says "Updating".
• Security: project generation settings are visible only to people with access to the project, the Gemini API key is no longer sent in a URL, and Agent lookups of authentication profiles are restricted to the project.

Known issues

• API security testing and performance testing are paid add-ons. Trial includes both; after buying or renewing, a licence change is picked up within 4 hours, or at once with Refresh on the License page.
• WebSocket-RPC tests run on the cloud Engine only; the desktop Agent does not yet run them and says so rather than misreporting a result.
• Security testing does not yet include mutual-TLS or session-fixation checks, or deeper per-protocol cases for SOAP, GraphQL, JSON-RPC and WebSocket-RPC beyond the authentication, access and input checks listed above.
• In performance reports, "first byte" includes connection setup; the load generator cannot time the connection separately.
• The desktop Agent must be updated to this release to receive the authentication and execution fixes above.

Related links

• Browse all release notes
• Download the latest build
• Help Center
• Product documentation
• Plans and editions
• API security testing add-on packages
• Performance testing add-on packages