Release Notes

Added (in product code)

• OpenAPI request validation — WafOpenApiRequestValidator enforces path/method match, query/path parameters (required, type, min/max, maxLength, enum), and JSON bodies when API Security + uploaded schema are enabled per app.
• Runs in inspection pipeline before OWASP rule engine (API Security step → virtual patches → modules → CRS).
• Virtual directory column in protection logs, application logs, and Geo Traffic Wall.
• Per-app CSP toggle — enforce WAF CSP on proxied apps or pass upstream headers (default: pass upstream).
• Admin portal IP allowlist — dedicated WAF domain + CIDR allowlist for remote management.
• False-positive intelligence — SQL/CRS alerts on static assets (.js, .css, .map) labeled in UI; scoped engine skip on GET/HEAD static paths; API endpoints remain fully inspected.

Limits (honest)

• OpenAPI: manual upload only — no auto-discovery from traffic.
• No full $ref resolution; schema JSON stored in DB with size cap (~5000 characters).
• JSON behavioral anomaly / schema drift (Level 4) — not implemented.

2026.05 — SOC architecture & decision engine

• Two-phase pipeline: signal collector → security decision engine (Allow / Block / Challenge / Log).
• SOC Queue (advisory prioritization — read-only, no state changes).
• Attack campaign correlation by IP; decision explanation layer stored in traffic logs.
• Threat intel feeds (FireHOL, AbuseIPDB, custom JSON) — advisory at import; blocking via policies only.
• RBAC v2 policies: SuperAdmin, SecurityAdmin, SocAnalyst, ReadOnly (+ legacy aliases).