Run a scan to find bugs — free on your first run · Download the CLI to scan on disk or CI
Real bugs, fixes, CVEs & GH Advisories in major OSS, with more disclosed privately →
Detect bugs, triage bug reports, and surface candidate vulnerabilities, each one backed by a concrete, reproducible counterexample rather than an LLM guess.
RedMirror models your code as a state machine and exhaustively explores every reachable state. It returns the exact path that triggers a suspected bug. Works on JavaScript, TypeScript, Python, Go, Rust, Java, C#, Ruby, PHP, and C/C++.
$ redmirror estimate ./payments # local, free, no tokens spent estimated cost $0.10 – $0.45 · no scan run, pay only when you're ready $ redmirror scan ./payments > ./payments · 1 subsystem, 4 symbols · checking each for its highest-signal bug > explore reachable states · 9,247 explored, 0 dropped [HIGH 92%] withdraw() can drive balance below zero withdraw.js:41 counterexample: deposit(100) → withdraw(150) [MED 71%] refund() runs before the owner check refund.js:12 [LOW 34%] fee setter reachable on re-entry vault.js:88 3 findings, ranked by confidence billed $0.18 for 41,204 tokens
Or state the rule yourself, in plain English, and RedMirror checks your code against it:
$ redmirror scan ./payments \ --focus "no user can withdraw more than their balance" > lift ./payments · 1 custom angle · 9,247 states explored [HIGH 95%] withdraw() violates the rule withdraw.js:41 counterexample: deposit(100) → withdraw(150)
--provider tresor and every request runs inside a hardware
enclave: the provider cannot read your code even in principle, and each answer carries a signed
receipt proving it. Need it never to leave your network at all? Run the
on-prem harness.redmirror estimate quotes any scan's cost
on your machine, free, before you spend a token. Public prices, no demo, no sales call.Start in a minute with no demo, no sales call and no contract, or run the whole engine inside your own network. RedMirror lets a human or an autonomous agent sign in and pay on its own.
Our hosted scan, metered to the token, with pricing published below: a few cents for a small package, a dollar or two for a mid-size app. Connect your wallet and your account is created on the spot with $1 of free credit, then mint an API key for the CLI and CI. An autonomous agent with its own wallet can pay per scan in USDC over x402, so it onboards itself with no forms and no human.
Sign upA single binary that runs the same engine against a model you already host, inside your network. Your code and your model never leave it, so there is nothing to send anywhere. We tailor the harness to your stack, your languages and the invariants you actually care about. Licensed yearly and priced per parallel agent, so it scales with the throughput you run, not with your head count.
Talk to usFor high-stakes code, hand us the whole job. Our experts help model your code, then reason through the complex, multi-step vulnerabilities that lighter models miss. You get a written report with reproducible findings and a short walkthrough of each one.
Book an auditNew here? Sign up with email or a wallet and start with $1 of free credit, top up with PayPal or crypto, or download the CLI and read the docs first.
A single native binary. Sign up for an account, sign in, and mint an API key to use it from CI.
Install in one line, paste into your terminal, or hand it to your coding agent:
# macOS / Linux curl -fsSL https://redmirror.io/install.sh | sh # Windows (PowerShell) irm https://redmirror.io/install.ps1 | iex
It self-updates from then on, redmirror update replaces the binary in place (no reinstall).
Or grab a binary directly:
Real scans against the source of three open-source projects, billed to the token. The lifter and kernel do the structural half on our engine with no tokens, and every finding you see has been verified against your real code, so you pay the model for judgment that survives scrutiny, not for a wall of noise. A small package runs a few cents; a whole mid-size app, a dollar or two.
| Project | Subsystem scanned | Lines | Tokens | Cost |
|---|---|---|---|---|
| gobreakerGo | whole package · circuit breaker | 313 | 21K | $0.28 |
| auth-systemPython | whole project · auth, sessions, password hashing | 638 | 51K | $0.61 |
| ContosoUniversityC# | whole repo · 48 files, Razor Pages + data access | 3,395 | 161K | $1.70 |
| OWASP Juice ShopTypeScript | server-side routes · 61 API handlers | 4,235 | 169K | $3.12 |
Curious what those dollars buy? Read the OWASP Juice Shop scan finding by finding →
Pay-as-you-go, metered to the token — you pick the model tier: OpenRouter $0.25 / M in · $0.45 / M out (the default for dashboard scans), Tresor $0.50 / M in · $1 / M out, or frontier models (Anthropic) $2.50 / M in · $10 / M out. No subscription, no lock-in. Sign up with email or a wallet, top up with PayPal or crypto, and start with $1 of free credit.
Know your cost before you scan. No subscription, no per-seat, nothing locked behind a higher tier — one metered rate, and you pay only for the scans you actually run.
| RedMirror | Aikido | Snyk | |
|---|---|---|---|
| Model | Pay per scan, metered | Monthly subscription | Per-developer subscription |
| To start | $0, then cents to a few dollars per scan | Free tier, then $300/mo | Free (capped), then $25/dev/mo |
| Priced by | What you scan | User tier (10 / 15 / 20+) | Contributing developers |
| Cost known first | redmirror estimate — local, free |
Flat monthly | Seat-count math |
| Scan freely | Every scan, on demand | Free tier: every 3 days | Free tier: ~100 code tests |
| Enterprise | Pay once, use as much as you need | Custom + separate pentest (€3.5k+) | Quote-only |
Aikido and Snyk are broad platforms billed by subscription — by user tier and by developer. RedMirror does one thing — deep code audit — and bills the scan, not the head count: a 20-developer team doesn't buy 20 seats to scan one repo.
Need it air-gapped? RedMirror Offline runs your own model at the enterprise tier, so code and model never leave your infrastructure.
A note on the rate: we add a markup over the raw model price to cover server costs. The lifter, the kernel and the reproduction sandbox all run on our machines, and that structural work is what makes a finding worth reading.
Competitor figures from Aikido and Snyk published pricing (mid-2026) and may change.
An angle is a class of bug: a single question to ask of your code. By default, RedMirror reads each part of your code and picks the one question that matters most there, then checks it. The ten families below are the vocabulary it draws from:
These ten are built in, and you can run any by name with --angles (for example --angles injection,crypto). You can also pass a custom angle: a property you want to hold, stated
in plain language with --focus (one or several). RedMirror turns each into a checkable
invariant and searches your real code for an input that violates it, handing back the exact steps that
do. The rule can be anything you can phrase as true-or-false: a semantic invariant, a functional
requirement, a business rule, or an acceptance criterion.
$ redmirror scan ./repo \ --focus "only the owner can change the fee" \ --focus "the total of all balances always equals the supply" \ --focus "a request is never served before the auth check runs"
Good angles are concrete and falsifiable: a rule that is either true or has a counterexample. Leave
--focus off and RedMirror picks the most-important property for each part of your code
automatically, drawing on the ten families above.
Scans stay cheap because RedMirror is focused: it checks the single highest-signal property for
each part of your code rather than running every rule against everything, and most of the cost is reading
your code once. Adding your own --focus angles costs a little more reasoning on top.
Pick a part of your code that holds state and has rules, like a payment flow, an auth check, or a shopping cart. (We call that a subsystem.) RedMirror tries every reachable combination of states and either hands you the exact steps that break it, or a proof that, within the search budget, nothing does.
Got a flagged finding from a scanner or a researcher? Paste it in. RedMirror checks it against your real code and tells you real or false, pointing at the exact line that decides it, so you don’t lose a day chasing a non-bug.
Not sure where to look? RedMirror reads your code, surfaces the suspicious spots across the languages above, then proves the ones it can, leaving you a short list of real leads instead of a wall of maybes.
Write down what the code is supposed to do (your functional requirements or acceptance criteria, in plain terms), and RedMirror checks the implementation against them, surfacing the inputs where the behaviour diverges from the spec.
Most AI scanners charge you full price on every scan: they re-run the model over your whole repo, every time. RedMirror caches its analysis by content, so a re-scan only pays for what changed. Fix a couple of files and the rest is served straight from cache, instantly and for no tokens, so you can iterate, or scan on every push in CI, without watching the bill climb.
And it’s always fresh: the cache can only ever reuse code that is byte-for-byte identical, so anything you touched is always re-analyzed. It never stores your source, only the result of an analysis, addressed by a hash and expired quickly. How it works →
The CLI carries no secret of value, just your rm_live_ key. Drop it into CI or a
local shell.
redmirror scan ./repoThe client uploads only the files you scoped to; the engine analyzes them server-side. The code a
check needs reaches the model provider behind the tier you pick, so pick deliberately:
--provider tresor runs every request inside a hardware enclave.
The compiled kernel runs exhaustive search over the lifted model and returns either a reachable counterexample (the exact triggering sequence) or a bounded proof that the invariant holds.
An LLM file-review surfaces broader candidate bugs; an adversarial verify pass re-checks each one against the real code and refutes the weak ones, so noise is filtered before you ever see it.
If the sandbox (sbx) is installed, each confirmed finding is reproduced by running a
minimal probe in an isolated sandbox on your machine. Findings reproduced in the sandbox
sharply reduce the probability of false positives. Without the sandbox, RedMirror falls
back to the kernel proof, so you still get a verdict either way.
RedMirror lifts every path of the suspect code into a state tree, lays your invariants over it, walks the tree to a reachable bad state, and returns the refuting counterexample. Here it catches a classic reentrancy: the external call runs before the balance is written back.
function withdraw(uint amt) {
require(balance[user] >= amt);
user.call{value: amt}("");
balance[user] -= amt;
}function withdraw(uint amt) {
require(balance[user] >= amt);
user.call{value: amt}(""); // reenters before balance is updated
balance[user] -= amt;
}Beyond the public fixes above, many findings have been disclosed privately and will be public soon.