Blog

What our scans look like, the bugs they've found, and what's new in the product.

Everything we publish, newest first. The first tag tells you the type: a Walkthrough of a full scan on a public repo, a Finding we surfaced and reported in real open-source software, or an Update when we ship something new. A finding's full write-up goes up once the fix is public.

Update Engineering

Pay for what changed, not the whole repo

RedMirror now caches its AI review by content, so a re-scan only pays for what changed: about 90% fewer review tokens and 40% lower cost in our tests, with identical findings. How content-addressing makes it provably fresh, and why it's hard for an AI scanner to do soundly.

Jul 2026 · Read the deep dive →
Update Release notes

What's new: full reports, per-scan cost, and a stricter review

A roundup of what shipped recently: a complete report at the end of every scan, a per-scan cost readout in the CLI, a stricter verification pass that files ruled-out candidates with their reasons, and a self-updating client.

Jul 2026 · Read the update →
Walkthrough Node.js / TypeScript

Inside a scan: what $3.12 finds in OWASP Juice Shop

A real scan of OWASP's deliberately-vulnerable app, scored against its published bug list: findings across 9 of the ~11 server-side vulnerability categories, and eight confirmed — the login SQL injection, a zip-slip file write, a CAPTCHA bypass, and two broken-access-control bugs — for $3.12.

Jul 2026 · TypeScript · 61 files · $3.12 · Read the walkthrough →
Finding High Fixed Pre-auth DoS

One malformed UDP packet could tear down a SIPSorcery media session

A single crafted, unauthenticated UDP packet on the RTP/ICE media socket could crash the receive path and close the whole channel, dropping an active call. The parser assumed a minimum length; the receive loop closed the channel on any single-packet exception. One packet, no credentials.

Jun 2026 · SIPSorcery (.NET) · PR #1677 (merged) · Read the write-up →
Finding Fixed Memory exhaustion

A high-cardinality log field could grow mtail's memory without bound

mtail enforced its per-metric cardinality cap only at garbage-collection time, so a burst of high-cardinality labels from log input could grow memory without bound between sweeps. Fixed by enforcing the cap where series are created.

Jun 2026 · mtail (jaqx0r) · PR #476 (merged) · Read the write-up →
Finding Fix approved Go / supply-chain

A single unknown ecosystem could abort an entire osv-scanner offline scan

One OSV advisory carrying an ecosystem name the scanner's pinned schema didn't recognize would panic the matcher and abort the whole offline scan, not skip one advisory. Fixed by skipping unknown ecosystems instead of calling the panicking MustParse.

Jun 2026 · Google osv-scanner · PR #2882 (approved) · Read the write-up →
Finding Fixed Unbounded recursion

A cycle in Prefect block references could hang the server

Prefect resolved block references recursively with no cycle check, so a self-referential or mutually-referential block could recurse without a base case and hang the server. Fixed with cycle detection at write, a database constraint, and a depth bound at read.

May 2026 · Prefect (PrefectHQ) · PR #21829 (merged) · Read the write-up →