RedMirror: make any LLM find real bugs - Make any LLM find real bugs in your code, and prove them

Hey Product Hunt 👋 I wanted to point a model at my code and have it actually find real vulnerabilities. On its own it can't: it invents bugs that aren't there and walks past the ones that are. RedMirror Reflection is what makes it a real bug finder. Since we were last here we've shipped a lot: it now also finds injection bugs (SQLi, command injection, path traversal, SSRF, XSS) and can guide your model to land the exploit on a live app, and there's a free 7-day trial now, no card. Here's how it discovers bugs instead of just checking them. It guides the model to where bugs actually live (the vulnerable relations and the angles that matter for that subsystem: authorization, conservation of value, ownership, path handling, idempotency), then a compiled kernel searches every reachable state and surfaces the exact sequence that breaks it. You get back GROUNDED with the concrete attack path, or a proof the code is safe. Evidence, not an opinion, with a stamp you can replay. The part that still surprises me: because that exhaustive search costs zero tokens, the model barely has to be smart. On the 440-case OpenSSF benchmark, gpt-oss-20b found 96% of the real bugs, the same recall as the 120B. A local qwen model ran the whole thing on one GPU. It drops into Claude Code, Cursor, Codex, Gemini CLI and pi with one line: redmirror-reflect init . The binary is an MCP server, so your agent drives it natively. Bring your own model, cloud or fully offline, your code never leaves your machine. Free 7-day trial, then $4.99 per seat. I'd love your feedback, especially which small model you'd point at it and what you'd want it to find next. I'm here all day.