Hey Product Hunt 👋 I wanted to point a small, local model at my code and have it actually find real vulnerabilities or bugs. On its own, it can’t: it invents bugs that aren’t there and walks past the ones that are. RedMirror Reflection is what makes it a real bug finder. Here’s how it discovers bugs, not just checks them. First it guides the model to where bugs actually live: the vulnerable relations in the code and the angles that matter for that subsystem (authorization, conservation of value, ownership, path handling, idempotency). Then it searches every reachable state of that subsystem and surfaces the exact sequence that breaks it. You get back GROUNDED with the concrete attack path, or a proof the code is safe. It’s a discovery with evidence, not an opinion, and it comes with a stamp you can replay. It's able to do that by shipping in the binary a layer of custom embeddings and a proprietary solver that we built. This is essentially our moat. The part that still surprises me: because that exhaustive search costs zero tokens, the model barely has to be smart. On the 440-case OpenSSF benchmark, gpt-oss-20b found 96% of the real bugs, the same recall as the 120B. A local 8b Qwen model ran the whole thing on one GPU. A small model that genuinely finds real vulnerabilities, because the finding no longer rests on trusting it. It drops into Claude Code, Cursor, Codex, Gemini CLI, and pi with one line: redmirror-reflect init . The binary is an MCP server, so your agent drives it natively. Bring your own model, cloud or fully offline. First month is free, then $10 per seat. I’d love your feedback, especially on which small model you’d point at it and what you’d want it to find next. I’m here all day.

Make any LLM find vulnerabilties & bugs

Works on 120b, 20b and even 8b models

Works on 120b, 20b and even 8b models