Published September 18, 2026
RedMirror Reflection is free for open source. If you maintain a public or open-source repository, you get a free, renewable one-year licence for that work: the same binary as the standard edition, bringing your own model, running on your machine. We do it because open source is where we find and prove real security bugs, and the people maintaining the code everyone depends on should not have to pay to secure it.
This is a stance, not a promotion. The open-source maintainer is the person carrying the most security burden for the least reward, and a tool that proves real bugs should be in their hands, not behind a paywall.
Two reasons, and we will be honest about both.
The first is principle. A huge amount of the software the world runs on is maintained by a small number of people, often in their spare time, for free. When a vulnerability lands in one of those projects, the whole ecosystem downstream inherits it. Asking the volunteer who holds that line to also pay for the tooling to secure it has it backwards. If RedMirror can help a maintainer ship a fix instead of a CVE, that is worth more to us than a licence fee.
The second is self-interest, and it is the honest kind. RedMirror is a bug-finder that proves its findings, and the way you earn trust in that claim is by finding real bugs in real code out in the open. Open-source repositories are where we do that. Every maintainer who runs RedMirror on their project is a chance to surface a genuine, reproducible bug, report it, and show what the tool actually does. The interests line up: they get their code secured for free, and we get to keep proving the product on code nobody staged for us.
Real, reachable security bugs, each proven with a reproduction rather than a style nit, and the fixes have shipped upstream. You can see the running list on our findings page: projects like google/osv-scanner, apache/airflow, PrefectHQ/prefect, sipsorcery, and mtail, with links to the fix and a write-up where the disclosure is public. That is the whole point of the tool, so it is also the whole point of the free tier. The more open-source code runs on RedMirror, the more real bugs get caught before they become someone’s incident.
Other tools have free tiers for open source too, and that is a good thing. The difference is where the work happens. RedMirror Reflection is a single offline binary: it reads your source locally and calls whatever model you point it at, and with a local model nothing ever leaves your machine. There is no repository to upload, no server that keeps a copy of your code, and the verification runs on your own hardware. Free, in our case, does not mean handing your code to someone else’s cloud in exchange.
It is for anyone maintaining or contributing to a public or open-source repository. The licence is the same binary as the standard edition, with the same verification, granted as a renewable one-year term. To get it, tell us your email and the repository you work on at redmirror.io/open-source. We review each request by hand, so give us a day or two, and then your free licence arrives by email. For private or commercial code, access is by request at redmirror.io/#access.
Yes. If you maintain a public or open-source repository, RedMirror Reflection is free: a renewable one-year licence for your open work, the same single binary as the standard edition. You bring your own model and it runs on your machine, so your code never leaves it. You request it at redmirror.io/open-source and we review each one by hand.
Maintainers and contributors working on public or open-source repositories. You tell us the repository you work on when you request a licence, we take a quick look, and we send a free licence for that open-source work. For private or commercial code, access is by request at redmirror.io/#access.
It is the same binary and the same verification, not a stripped-down version. The difference is the code you point it at: the free licence is for public and open-source work, while the standard licence covers private and commercial code. The free licence runs as a renewable one-year term.
No. RedMirror Reflection is one offline binary that reads your source locally and calls whatever model you point it at. Pair it with a local model and nothing ever leaves your machine. Unlike a hosted cloud scanner, there is no server to upload your repository to.
Go to redmirror.io/open-source and give us your email and the public repository you maintain. We review requests by hand, so it takes a day or two, then we email your free licence.
Tell us your email and the public repository you maintain, and we send a free licence once we have had a quick look. Same binary as the standard edition, bring your own model, runs entirely on your machine.
Request your free licencePrivate or commercial code? Request access →