RedMirror Reflection

What’s new in RedMirror Reflection. Update any time with redmirror-reflect update.

0.6.0August 2026latest

Send findings to your code-scanning dashboard. redmirror-reflect audit --sarif report.sarif writes a standard SARIF 2.1 file that drops straight into GitHub code scanning, Microsoft Defender, or Azure DevOps. Every finding brings the whole path an attacker takes to reach it, not just a line number, so a reviewer sees the exploit at a glance.
Catches regex denial-of-service. RedMirror now flags a regular expression that a crafted input can make hang for seconds or minutes (a ReDoS), a whole class of denial-of-service bug most scanners walk past, and points at the pattern to rewrite.
Finds more cross-site scripting. Wider coverage of the ways untrusted text reaches the page, jQuery and React among them, so more real XSS surfaces and fewer slip through.
Same code, same answer, every time. Results are now fully reproducible from one run to the next, so a finding you see today is the finding your teammate sees tomorrow.

0.5.1August 2026

Setting up with the pi agent is now instant. redmirror-reflect init pi no longer pauses while it registers the tools — you’re ready in a blink instead of waiting on a first-run hitch.

0.5.0August 2026

Finds injection bugs, and proves them. SQL injection, command injection, path traversal, SSRF, code injection, XSS and more — RedMirror traces a request value to the dangerous operation and shows the reachable path, or shows that something along the way neutralises it. You get a real, replayable finding, not a maybe.
Exploit a live app, guided. Point RedMirror at a running target and its source and it tells you which endpoints are actually reachable from a request, and the exact payload class each one needs — so you attack the few that matter instead of fuzzing blindly. In a five-run test against a real bug on a live server, the guided model landed the exploit every time and in about a third fewer steps; on its own it managed three times in five.
Triage a whole codebase in one step. Point it at a directory and it returns just the files with a request-reachable dangerous operation, ranked by impact — instead of checking each file one at a time. Available in every supported agent (Claude Code, Cursor, Gemini, Codex, Windsurf and more), not only pi.
Check your own rules. Write a business rule once — “a refund never exceeds the purchase”, “an order never ships before payment clears” — and RedMirror verifies it for you, no extra setup per file.
Flags weak crypto (MD5, DES, RC4, ECB and friends) with the fix to use instead.
init now installs the tools, not just the guide — a fresh setup drives the whole flow out of the box.

0.4.2August 2026

Fixed a stale line in the built-in agent skill that pointed at a command which no longer exists — your agent could waste a turn on it. The skill now matches the commands the tool actually has.

0.4.1August 2026

Now works inside DeepSeek’s deepseek-harness (dsh) too. Wire RedMirror into it with one command, redmirror-reflect init dsh, then ask it to find and prove a bug.

0.3.5August 2026

Works in more editors out of the box — one-line setup for Claude Code, Cursor, Codex, Gemini CLI, Windsurf, jcode, and pi (and any MCP-capable agent).
Point it at a whole repository and it works through the codebase subsystem by subsystem.
Sharper, more accurate results.

0.3.0August 2026

One-step setup: redmirror-reflect init <agent> connects RedMirror to your coding agent — Claude Code, Cursor, Gemini CLI, Codex, Windsurf, or pi.
Runs entirely inside your agent, using the model you already work with there.

0.2.0August 2026

Update in place with a single command: redmirror-reflect update.
Add RedMirror to your editor in one line: redmirror-reflect init <agent> — Claude Code, Cursor, Codex, Gemini CLI, and pi.
Scan a whole repository subsystem by subsystem, tracking coverage so nothing is left unexamined.
Broader model support: runs reliably across more local and hosted models.
More accurate results and finding counts when your agent finishes a review.

Changelog