What our scans look like, the bugs they've found, and what's new in the product.
Everything we publish, newest first. The first tag tells you the type: a Walkthrough of a full scan on a public repo, a Finding we surfaced and reported in real open-source software, or an Update when we ship something new. A finding's full write-up goes up once the fix is public.
RedMirror now caches its AI review by content, so a re-scan only pays for what changed: about 90% fewer review tokens and 40% lower cost in our tests, with identical findings. How content-addressing makes it provably fresh, and why it's hard for an AI scanner to do soundly.
A roundup of what shipped recently: a complete report at the end of every scan, a per-scan cost readout in the CLI, a stricter verification pass that files ruled-out candidates with their reasons, and a self-updating client.
A real scan of OWASP's deliberately-vulnerable app, scored against its published bug list: findings across 9 of the ~11 server-side vulnerability categories, and eight confirmed — the login SQL injection, a zip-slip file write, a CAPTCHA bypass, and two broken-access-control bugs — for $3.12.
A single crafted, unauthenticated UDP packet on the RTP/ICE media socket could crash the receive path and close the whole channel, dropping an active call. The parser assumed a minimum length; the receive loop closed the channel on any single-packet exception. One packet, no credentials.
mtail enforced its per-metric cardinality cap only at garbage-collection time, so a burst of high-cardinality labels from log input could grow memory without bound between sweeps. Fixed by enforcing the cap where series are created.
One OSV advisory carrying an ecosystem name the scanner's pinned schema didn't recognize would panic the matcher and abort the whole offline scan, not skip one advisory. Fixed by skipping unknown ecosystems instead of calling the panicking MustParse.
Prefect resolved block references recursively with no cycle check, so a self-referential or mutually-referential block could recurse without a base case and hang the server. Fixed with cycle detection at write, a database constraint, and a depth bound at read.