August 2026
RedMirror Reflection 0.5.0 does two new things: it finds injection bugs (SQL injection, command injection, path traversal, SSRF, code injection, XSS and more) and proves the path a request takes to reach them, and it helps your coding agent exploit them on a live app. In a small five-run test against a real, long-patched path-traversal bug on a running server, a capable model guided by RedMirror landed the exploit every time and in about a third fewer steps. On its own it got there three times in five. Update with redmirror-reflect update.
RedMirror Reflection is a command-line binary that runs as a server for your coding agent, on your machine, with your own model. Its job has always been to end a stubborn argument: not "here are some things that look risky", but "here is a real bug, and here is the exact sequence that reaches it." Until now it did that for state and logic bugs, the kind that live in how a system moves between states. 0.5.0 opens the other big half of the security world: the bugs where a request value flows to a dangerous operation. And once it can find those, it can help you do the thing that actually proves impact, which is land the exploit on something that is running.
Most tools that look for injection give you a ranked list of suspicions. A value looks tainted, an operation looks dangerous, and you are left to sort the real one from the forty that are guarded, escaped, or unreachable. RedMirror does the opposite. You give it the path a request value takes to a dangerous operation, and it proves whether the value still arrives in a form that can hurt you, or shows that a step in between neutralises it.
The part that a checklist cannot do is context. Escaping is not one thing. A value made safe for HTML is still dangerous in a shell command. A value made safe for a shell is still dangerous in a SQL string. RedMirror tracks the exact kind of neutralisation each step performs, so a value that was cleaned for the wrong context and then reaches a sink still comes back as a real, reachable finding. That is precisely the case a boolean "is it tainted" check waves through. What you get back is a path you can replay, not a probability.
A real service is not one file, it is dozens or hundreds of request handlers. Checking them one at a time is slow, and it is exactly where a smaller model gets lost. So 0.5.0 adds a single call that points at a directory and hands back only the files that have a dangerous operation reachable from a request, ranked by impact, each one naming the operation and the payload class it needs.
# one call over a directory of request handlers scanned 86 files → 9 worth attacking, the rest set aside high plugins.go file read from a request path (path traversal) high reports.go shell from a request field (command injection) high search.go query built from a request (SQL injection) ... 6 more, then the clean files, dropped
Instead of reading eighty-six files, your agent reads nine and knows what each one needs. This used to live in one integration only. Now it is built into the tool itself, so every supported agent gets it: Claude Code, Cursor, Gemini, Codex, Windsurf, and the rest.
Finding the weakness is half the job. The other half, the half that turns a report into something nobody can wave away, is landing the exploit on something that is actually running. For authorized testing, 0.5.0 lets you point RedMirror at a live target and its source. It tells your agent which endpoints are genuinely reachable from a request and the exact payload class each one takes, so the agent attacks the two or three that matter instead of fuzzing hundreds of routes that go nowhere.
We ran a small, deliberate test to see whether the guidance actually changes the outcome. We took one capable coding model, a running server, and a real, long-patched path-traversal bug, and we let the model try to read a protected file off the box. Five runs with RedMirror guiding it, five runs blind, everything else identical.
# same model, same target, five runs each way guided by RedMirror landed it 5 / 5 (and ~30% fewer steps) on its own landed it 3 / 5
Blind, the model could sometimes stumble onto the right endpoint and tune the attack, three times in five. Pointed straight at the reachable weakness and the payload it needed, it got there every time, and faster. Five runs is a small test and we are calling it that. But the direction is the whole point of the tool: narrow to what is real, then act.
This sits alongside the number we have published from the start. On the OpenSSF benchmark of 440 real, disclosed vulnerabilities, each paired with its fix, RedMirror takes a coding model from catching 54% of the real bugs to 96%, and a small model reaches the same as a large one. The compiler grades every answer, so a cheap model cannot flood you with false alarms.
Check your own rules. Some invariants are specific to your business, not to any CWE list: a refund never exceeds the purchase, an order never ships before payment clears. Write the rule once and RedMirror verifies it for you, with no per-file setup.
Weak crypto, flagged with the fix. It now calls out MD5, DES, RC4, ECB and the other primitives that are broken by design, and tells you what to use instead.
init installs the tools now, not just the guide. A fresh redmirror-reflect init <agent> sets your agent up to drive the whole flow out of the box.
It is still one binary that runs on your machine, with your own model, local or cloud, and nothing to upload. Existing installs move to 0.5.0 with a single command:
# already installed? one command redmirror-reflect update # new setup, for whichever agent you use redmirror-reflect init claude # or cursor, gemini, codex, windsurf, ...
0.5.0 adds injection bug finding with proof (SQL injection, command injection, path traversal, SSRF, code injection, XSS and more), a one-call directory triage that returns only the files with a request-reachable dangerous operation ranked by impact, and a guided live-target mode that tells your model which endpoints are actually reachable and the payload class each needs. It also adds business-rule checks, weak-crypto flagging, and makes init install the tools, not just the guide.
You give it the path a request value takes to a dangerous operation, and it proves whether the value still reaches that operation in a form that is dangerous, or shows that something along the way neutralises it. It reasons about context: a value escaped for HTML but passed to a shell is still dangerous. You get a reachable path you can replay, not a ranked guess.
Yes, for authorized testing. Point it at a running target and its source and it reports which endpoints are reachable from a request and the exact payload class each one needs, so you attack the few that matter instead of fuzzing blindly. In a five-run test against a real, long-patched path-traversal bug on a live server, a capable coding model guided by RedMirror landed the exploit every run and in about a third fewer steps; on its own it got there three times in five.
All of them. The one-call directory triage is now built into the binary, so Claude Code, Cursor, Gemini, Codex, Windsurf, and the other supported agents all get it, not only one. Point it at a directory and it returns the handful of files with a request-reachable dangerous operation instead of you checking each file one at a time.
Run redmirror-reflect update. It is a single binary that runs on your machine as a server for your coding agent, with your own model, local or cloud. A fresh setup is redmirror-reflect init <agent>, which now installs the tools as well as the guide.
Update with redmirror-reflect update, then ask your agent to sweep a directory of request handlers and prove the first real bug it finds. Your machine, your model, nothing uploaded.