redos

From README

ReDoS Security Check (CWE-1333) What this checks Protects against Regular Expression Denial of Service where a crafted input causes catastrophic backtracking in regex engines. A single malicious string can pin a CPU core for minutes or hours, taking down the service. Vulnerable patterns Nested quantifiers applied to user input — a quantified group whose body is itself quantified produces exponential state Overlapping alternation inside repetition — alternatives that can match the same prefix multiply backtracking work Common "email" or "URL" regexes built from quantified character classes wrapped in further repetition Regexes compiled from external configuration or user input where the pattern shape itself is attacker-controlled Fix immediately Flag the vulnerable regex, explain the risk, and suggest a fix establishing these properties. Translate the principle to the language and engine of the audited file — do not echo examples from another stack. No nested quantifiers on user input.