What our scans look like, the bugs they've found, and what's new in the product.
Everything we publish, newest first. The first tag tells you the type: a Walkthrough of a full scan on a public repo, a Finding we surfaced and reported in real open-source software, or an Update when we ship something new. A finding's full write-up goes up once the fix is public.
Role-by-role guides for bug bounty hunters, software engineers, security analysts, and vibecoders — each with a real, kernel-proven example, and where verification fits in the AI-native SDLC.
One offline binary that gives your own coding agent the power to find real bugs and prove them, right on your machine with your own model. Nothing to upload. 7-day free trial, then $19/month.
If you maintain a public repository, RedMirror Reflection is free: a renewable one-year licence, the same binary as the paid edition, your model, your machine. Open source is where we find and prove real bugs, and maintainers should not have to pay to secure the code everyone depends on.
A complete walkthrough, install to finding: a real read-only SQL tool, redmirror-reflect init, and one audit where Pi + RedMirror prove a read-only bypass with a concrete attack path. Every command and output is from the real run.
RedMirror Reflection 0.7 wires a commit-time and CI gate into any coding agent, so a finding cannot ship until it is confirmed real. We hardened it after a small open model, run live, confirmed a planted bug and slipped one past the gate.
RedMirror Reflection 0.6 exports SARIF 2.1, so findings drop straight into GitHub code scanning, Defender, or Azure DevOps, and each one carries the reachable path an attacker takes to the bug, not just a line number. Plus regex denial-of-service (ReDoS), more cross-site scripting, and the same result every time.
The most dangerous bug isn’t a crash, it’s a failed or denied state that renders as a normal, reassuring value: 0 errors, $0 owed, access granted. A real one we shipped ourselves (a $0 balance that was fiction), why it beats a crash, and why it’s a reachability property you can prove.
“LLM evaluation, locally” means two different things. This is the one that matters when the code can’t leave: a local model proposes where a bug might be, a compiled kernel on the same machine proves it, and nothing is uploaded. Works offline and air-gapped, and the verification uses no tokens.
Five authorization holes that pass every test: IDOR, a sibling endpoint that forgot its check, mass assignment via one extra field, a retired v1 that skips the new guards, and a missing tenant filter. Why the model can’t see them, and why each reduces to a reachability property you can prove.
An LLM reviewer generates the most probable review comment, not the true one, so it invents bugs, hallucinates repro logs, and calls insecure code secure. You can’t prompt your way out of it. The fix is to stop grading the model’s prose and prove whether the bad state is actually reachable: the model proposes, a compiled kernel disposes.
Reflection 0.5.0 now finds injection bugs (SQL injection, command injection, path traversal, SSRF, code injection, XSS) and proves the path, triages a whole codebase in one call, and guides your model to a working exploit on a live app. In a small five-run test on a real, long-patched bug, guided landed it 5 of 5 versus 3 of 5 blind, in about a third fewer steps.
Agents now write most of the diff and run the first review passes, so the bottleneck moves to the approval gate. We map RedMirror Reflection onto the six-stage AI-native SDLC and show where a verification step belongs: at test and deploy, turning ranked opinions into findings a human can trust.
Prove the bug, don’t just report it. A real run where the kernel grounds an IDOR (broken object-level authorization) in a document store and hands back the exact attack path — the reproduction a triager can’t argue with.
Gate the merge, not the vibe. A real run where the kernel proves a wallet service can mint money on an overdraw, then proves the fix holds across every reachable state so CI can block on it.
Triage with a reproduction, not an opinion. A real run where the kernel confirms a suspected privilege escalation — a non-admin reaching a privileged action its sibling guards — with a concrete attack path.
Check the code your AI wrote before it takes money. A real run where an AI builds a checkout, then the kernel proves money bugs in it — and verifies the fixes — before it ships.
Reflection 0.4.0 plugs into deepseek-harness (dsh) with one command. We had dsh, driven by a small open model, find and prove two real bugs in a vibecoded checkout: coupons that stack, and a total that goes negative, each proven with a reachable attack path.
We had a cheap model vibecode a checkout API, then had the same class of model, with the Reflection kernel behind it, check it before production. It came back with two reachable bugs: coupons that stack to zero, and a negative price that charges a negative amount. Each proven by the kernel, fixed, and re-verified. The whole run is reproducible in one container.
Our SIPSorcery media-session DoS picked up CVE-2026-54632 and a mention in RTCSec News. The same issue argues that AI-found vulnerabilities keep arriving with inflated scores and hallucinated repro logs. That's the right complaint, and it's why nothing leaves here without a reachable path and a proof of concept that runs.
RedMirror On-Prem is a self-hosted, bring-your-own-model bug-finder: a compiled kernel verifies every finding, so a weak or cheap model still can't flood you with false positives. To prove the design holds we ran four LLMs through one harness and let the compiler grade every answer, and got two false alarms in a hundred runs.
RedMirror now caches its AI review by content, so a re-scan only pays for what changed: about 90% fewer review tokens and 40% lower cost in our tests, with identical findings. How content-addressing makes it provably fresh, and why it's hard for an AI scanner to do soundly.
A roundup of what shipped recently: a complete report at the end of every scan, a per-scan cost readout in the CLI, a stricter verification pass that files ruled-out candidates with their reasons, and a self-updating client.
A real scan of OWASP's deliberately-vulnerable app, scored against its published bug list: findings across 9 of the ~11 server-side vulnerability categories, and eight confirmed — the login SQL injection, a zip-slip file write, a CAPTCHA bypass, and two broken-access-control bugs — for $3.12.
A single scan of Microsoft's Contoso University sample read 48 files in about 12 minutes for $1.70. From 29 candidates it confirmed 5 security defects (a null-dereference bug and four ReDoS findings in a bundled library), noted 3 hardening items, and ruled out 7 with a stated reason for each.
A single crafted, unauthenticated UDP packet on the RTP/ICE media socket could crash the receive path and close the whole channel, dropping an active call. The parser assumed a minimum length; the receive loop closed the channel on any single-packet exception. One packet, no credentials.
mtail enforced its per-metric cardinality cap only at garbage-collection time, so a burst of high-cardinality labels from log input could grow memory without bound between sweeps. Fixed by enforcing the cap where series are created.
One OSV advisory carrying an ecosystem name the scanner's pinned schema didn't recognize would panic the matcher and abort the whole offline scan, not skip one advisory. Fixed by skipping unknown ecosystems instead of calling the panicking MustParse.
Prefect resolved block references recursively with no cycle check, so a self-referential or mutually-referential block could recurse without a base case and hang the server. Fixed with cycle detection at write, a database constraint, and a depth bound at read.