Published August 29, 2026
RedMirror Reflection 0.6 exports its findings as SARIF 2.1, so they drop straight into GitHub code scanning, Microsoft Defender, or Azure DevOps. Unlike an ordinary scanner result, each finding carries the reachable path an attacker takes to the bug, not just a line number. This release also catches regex denial-of-service (ReDoS), finds more cross-site scripting, and makes every result reproducible from one run to the next.
A scanner result is usually a line number and a severity label you have to take on faith. A reviewer still has to reconstruct whether the bug is real and how you would actually reach it. RedMirror already answers that, it traces the value from where it enters to the dangerous operation and shows the path is reachable. Version 0.6 puts that path into the format your dashboard already reads.
Run redmirror-reflect audit --sarif report.sarif and RedMirror writes a standard SARIF 2.1 file alongside its normal pass/fail result. Upload it to GitHub code scanning, Defender, or Azure DevOps and every RedMirror finding shows up next to the rest of your security signal, with no custom integration.
The part that sets it apart is inside each result: a codeFlow, the ordered steps from untrusted input to the dangerous operation. A reviewer opens the finding and sees the exploit as a sequence, the source, the hops it travels, the sink, instead of a bare location to go investigate. A tool that only asserts “there is a bug on line 42” cannot fill that in with a genuinely reachable path. RedMirror can, because it found the bug by walking that path in the first place.
Some bugs are not a bad state you can reach, they are a bad amount of time. A regular expression with the wrong shape can be made to backtrack catastrophically, so a short crafted input hangs the process for seconds or minutes. That is ReDoS, regular-expression denial of service, and most scanners walk straight past it because they are looking for reachable states, not runtime blowups.
Reflection 0.6 flags the dangerous shapes: a group that repeats inside another repeat like (.*,)+, or two unbounded whitespace matches sitting next to each other, and it points at the pattern to rewrite. It is careful about it, an ordinary division or a plainly safe pattern is left alone.
XSS is only caught when the tool recognises the place untrusted text reaches the page. This release widens that set. The jQuery factory $(...) counts as a sink when it is handed a variable rather than a static selector, and React’s dangerouslySetInnerHTML, which is a JSX attribute rather than a function call and so was easy to miss, is now caught. More real cross-site scripting surfaces, and the safe cases, a literal selector like $('.menu'), stay quiet.
A scanner you cannot trust to be consistent is a scanner you cannot put in a pipeline. We found and closed a source of non-determinism in the analysis: on the same code, an earlier build could occasionally reach a slightly different result from one run to the next. As of 0.6 that is gone. The finding you see today is the finding your teammate sees tomorrow and the one your CI records, run after run.
Findings that carry the attacker’s path, in the format your dashboard already reads. A denial-of-service class other scanners miss. More XSS. And the same result every time. Update an existing install with redmirror-reflect update.
SARIF (Static Analysis Results Interchange Format) is the standard file format code-scanning tools use to report findings. Because it is a standard, a SARIF file drops straight into GitHub code scanning, Microsoft Defender, or Azure DevOps without custom integration. RedMirror Reflection 0.6 writes SARIF 2.1 with redmirror-reflect audit --sarif <file>.
Most scanner results give you a single line and a severity label, and a reviewer still has to work out whether the bug is real and how you would reach it. RedMirror’s SARIF results include a codeFlow: the ordered sequence of steps an attacker takes from untrusted input to the dangerous operation. A tool that only asserts a location cannot fill that in with a genuinely reachable path.
ReDoS (regular-expression denial of service) is a regular expression that a crafted input can make run for seconds or minutes, hanging the process. It is a whole class of denial-of-service bug that many scanners miss because it is about time, not a reachable state. Reflection 0.6 flags catastrophic-backtracking regexes and points at the pattern to rewrite.
Yes. As of 0.6, analysis is fully reproducible from one run to the next on the same code, so a finding you see today is the finding your teammate sees tomorrow and the one your CI records. Reproducibility is what lets you trust a scanner in a pipeline.
Run redmirror-reflect audit --sarif report.sarif. It writes the SARIF file alongside the normal pass/fail result, then upload report.sarif to your code-scanning dashboard. Existing installs move to 0.6 with redmirror-reflect update.
No waitlist any more. The bring-your-own-model, runs-entirely-on-your-machine edition ships today as a single binary. First month free, then $4.99/month, cancel any time.
Install the binary, point it at your code and your own model (local or cloud), and your coding agent finds real bugs and proves each one.
Get started · 7-day free trial