Skip to main content
​
June 2026

​
Vision Agent: Multi-Tab and SPA Deep Crawl

The Vision Agent now handles complex single-page applications with client-side routing significantly better. It tracks route changes triggered by JavaScript navigation (not just <a> tag clicks), enabling full coverage of React, Next.js, Vue, and Angular applications that use hash-based or history-based routing.What changed:
  • SPA route detection: Vision Agent now observes pushState and replaceState events to discover routes that never produce a network navigation
  • Multi-tab session support: workflows that open resources in a new browser tab are now correctly traced end-to-end
  • Improved form interaction: Vision Agent can now complete multi-step forms including file upload inputs, rich text editors, and custom date pickers
  • Crawl depth increased from 4 to 6 levels for apps with deeply nested navigation hierarchies
Security Agent improvements:
  • Mass assignment detection: the Security Agent now probes request bodies for writable fields beyond what the UI exposes, identifying cases where a lower-privileged role can set fields (e.g., is_admin, role, org_id) that should be immutable
  • BFLA (Broken Function Level Authorization): improved detection for admin-only batch and export endpoints that share URL structure with standard CRUD endpoints
​
May 2026

​
Role Matrix Visualization

A major dashboard upgrade focused on helping teams understand and act on their permission coverage.Dashboard:
  • Role Matrix View: a new visualization in the Issues tab shows your full role × endpoint permission grid, color-coded by finding severity. Instantly see where your access control boundaries are being violated and which role combinations are highest risk
  • Workflow Timeline: replay the exact sequence of UI interactions the Vision Agent recorded for any workflow, step by step, with network requests shown alongside
  • Bulk triage: select multiple issues and update status, assign to team members, or push to your issue tracker in one action
Integrations:
  • GitHub Issues integration: Perfai findings can now be exported directly as GitHub Issues with appropriate labels (security, critical, perfai) and a standardized body template
  • Jira integration (beta): connect Perfai to a Jira project and push findings as Jira tickets. Supports custom field mapping for severity and component
Security Agent:
  • Horizontal access bypass detection improved: the Security Agent now correctly distinguishes between “User A can access User B’s resource” (finding) and “all users can access a shared public resource” (expected behavior), dramatically reducing false positives on public-read endpoints
  • Added detection for JWT alg: none and weak secret exploits when the Vision Agent observes JWT tokens in API responses
​
April 2026

​
Public API Launch and CI/CD Integration

Perfai’s public REST API is now generally available, enabling teams to integrate security testing directly into their development and deployment pipelines.Public API (GA):
  • POST /v1/apps — register an application
  • POST /v1/apps/{appId}/security-agent — trigger a security test
  • GET /v1/apps/{appId}/vulnerabilities — retrieve findings
  • Authenticate with your dashboard token — see the API overview for the current endpoint set
CI/CD:
  • Published official GitHub Actions example for triggering security tests on push to main
Platform:
  • Multi-app dashboard: improved navigation for accounts with many registered apps, including search, filtering by last-tested date, and a security score overview across all apps
  • Scan history: full scan run history per app, with the ability to diff findings between two runs to see what was introduced or fixed
  • PDF report export: generate a compliance-ready PDF from any completed scan, formatted for OWASP Top 10 audit evidence packages
Vision Agent:
  • Support for apps that use WebSocket connections: the Vision Agent now records WS message payloads as part of workflow traces, and the Security Agent can replay modified WS frames to test server-side authorization on real-time channels
  • Login flow improvements: better handling of MFA-protected accounts using TOTP (configure a TOTP seed per role) and SSO flows via SAML and OAuth