July 2026
A short roundup of what shipped recently. All of it is live now: update your client with redmirror update and you have it.
Every scan now writes a complete Markdown report, not just a list of findings. It opens with a summary and the verification standard the scan held itself to, then lays out each confirmed defect with its root cause, impact, a suggested fix, and the relevant code. Below that sit the hardening notes, the candidates that still need review, and an “Investigated, not a security issue” table that lists every candidate the scan ruled out, each with the specific reason it was dismissed. Nothing is silently dropped, and nothing is padded to look busy.
For a real example, read our walkthrough of a full scan of Contoso University, where the report is reproduced end to end.
Scans are metered to the token, and now the CLI tells you the damage as soon as a scan finishes, alongside your remaining balance:
# printed at the end of a scan this scan cost $1.70 · balance now $38.52
You can still see the price before you commit a cent: redmirror estimate ./path quotes any scan on your machine, for free, without spending a token.
The biggest change is one you mostly see as less. Every candidate a scan turns up is now re-checked against the exact code that decides it before it is ever called a finding, including the code it depends on elsewhere: a function's return type, a caller's guard, a framework's default encoding. Candidates that don't hold up under that scrutiny are filed under “investigated, not a security issue” with the reason, rather than dumped on you as findings or hidden from you entirely.
The effect is fewer, better findings. In the Contoso walkthrough above, 29 candidates became 5 confirmed defects, with 7 explicitly ruled out and shown with reasons. You get the short list you can act on, and the receipts for everything that didn't make it.
The command-line client updates itself. redmirror update replaces the binary in place, and the client checks for a newer version on startup so you are never far behind. No package manager, no reinstall.
Point RedMirror at your code and you get the full report, the ruled-out list, and the exact cost. Check the price first with redmirror estimate, free and local.