July 2026
RedMirror's recent releases ship four improvements, all live now. Every scan writes a full Markdown report listing each confirmed defect plus an “investigated, not a security issue” table of ruled-out candidates. The CLI prints each scan's exact cost and your balance, a stricter verification pass re-checks every candidate before calling it a finding, and the client updates itself.
A short roundup of what shipped recently. All of it is live now: update your client with redmirror update and you have it.
Every scan now writes a complete Markdown report, not just a list of findings. It opens with a summary and the verification standard the scan held itself to, then lays out each confirmed defect with its root cause, impact, a suggested fix, and the relevant code. Below that sit the hardening notes, the candidates that still need review, and an “Investigated, not a security issue” table that lists every candidate the scan ruled out, each with the specific reason it was dismissed. Nothing is silently dropped, and nothing is padded to look busy.
For a real example, read our walkthrough of a full scan of Contoso University, where the report is reproduced end to end.
Scans are metered to the token, and now the CLI tells you the damage as soon as a scan finishes, alongside your remaining balance:
# printed at the end of a scan this scan cost $1.70 · balance now $38.52
You can still see the price before you commit a cent: redmirror estimate ./path quotes any scan on your machine, for free, without spending a token.
The biggest change is one you mostly see as less. Every candidate a scan turns up is now re-checked against the exact code that decides it before it is ever called a finding, including the code it depends on elsewhere: a function's return type, a caller's guard, a framework's default encoding. Candidates that don't hold up under that scrutiny are filed under “investigated, not a security issue” with the reason, rather than dumped on you as findings or hidden from you entirely.
The effect is fewer, better findings. In the Contoso walkthrough above, 29 candidates became 5 confirmed defects, with 7 explicitly ruled out and shown with reasons. You get the short list you can act on, and the receipts for everything that didn't make it.
The command-line client updates itself. redmirror update replaces the binary in place, and the client checks for a newer version on startup so you are never far behind. No package manager, no reinstall.
Four things are live now: a full Markdown report at the end of every scan, a per-scan cost readout in the CLI, a stricter verification pass that files ruled-out candidates with the reason they were dismissed, and a self-updating client. Run redmirror update and you have them all.
Every scan writes a complete Markdown report. It opens with a summary and the verification standard the scan held itself to, then lays out each confirmed defect with its root cause, impact, a suggested fix, and the relevant code. Below that sit the hardening notes, the candidates that still need review, and an "Investigated, not a security issue" table listing every candidate the scan ruled out, each with the specific reason it was dismissed.
Scans are metered to the token, and the CLI tells you what a scan cost as soon as it finishes, alongside your remaining balance. You can also see the price before you commit a cent: redmirror estimate ./path quotes any scan on your machine, for free, without spending a token.
Every candidate a scan turns up is now re-checked against the exact code that decides it, including the code it depends on elsewhere, before it is ever called a finding. Candidates that don't hold up are filed under "investigated, not a security issue" with the reason, rather than dumped on you as findings or hidden entirely. In the Contoso University walkthrough, 29 candidates became 5 confirmed defects, with 7 explicitly ruled out and shown with reasons.
The command-line client updates itself. redmirror update replaces the binary in place, and the client checks for a newer version on startup, so you are never far behind. There is no package manager and no reinstall.
Point RedMirror at your code and you get the full report, the ruled-out list, and the exact cost. Check the price first with redmirror estimate, free and local.