ReDoS

A 1000ms timeout in an isolated worker decides which ReDoS warnings survive

A dev.to post describes a ReDoS scanner that builds the string which hangs each flagged regex, times it at growing input sizes in a worker, and reports only the patterns that measurably blow up.