Detect catastrophic backtracking regular expressions

ReDoS hides in validation code. Look for nested or ambiguous quantifiers applied to request data.

grep -rEn "(.*)+|(.+)+|([a-z]+)+|(a|aa)+" --include=*.{js,ts,py,java,rb} .

The classic evil regex has overlapping repetition.

/^(a+)+$/.test("a".repeat(40)+"!");   // exponential time

Pro note: confirm with a timing test that a small crafted input causes seconds of CPU. The safe fix is a linear engine (RE2) or a rewritten pattern with possessive quantifiers or anchors. Email and URL validators are frequent offenders; check any regex applied before rate limiting.