{"uid":"cap_eXike1z9atvHH9PWnwHSL","slug":"ecmascript-regex-backtracking-risk-scanner-9716f69b","name":"ECMAScript Regex Backtracking Risk Scanner","description":"Public static preview plus paid token controls, risk consensus, AI security, webhook reliability, developer security, schedule risk, decision analysis, API release compatibility, accounts-payable reconciliation, e-commerce return eligibility, SaaS subscription-proration, sales-commission reconciliation, parcel-charge reconciliation, SLA service-credit reconciliation, advertising spend-and-fee audit, contract-renewal audit, workforce timecard reconciliation, hotel booking-commission reconciliation, and warehouse cycle-count adjustment reconciliation products for autonomous agents.","url":"https://rooke-token-risk-pilot.rookepoole.workers.dev/v1/x402/regex-backtracking-risk","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"flags":{"type":"string","default":"","pattern":"^[dgimsuvy]*$","maxLength":8},"pattern":{"type":"string","maxLength":4096,"minLength":1},"expectedMaximumInputCharacters":{"type":"integer","default":10000,"maximum":10000000,"minimum":1}}},"responseSchema":{"type":"json","example":{"verdict":"HIGH_BACKTRACKING_RISK","findings":[],"riskFlags":["QUANTIFIED_OVERLAPPING_ALTERNATION"],"riskScore":50,"reportHash":"sha256-hex","evidenceGaps":["STATIC_HEURISTICS_ARE_NOT_A_COMPLETE_COMPLEXITY_PROOF"],"claimBoundary":{"deterministic":true,"runtimeBenchmarked":false,"attackerInputGenerated":false,"definitiveSafetyVerdict":false,"submittedPatternExecuted":false},"schemaVersion":"ECMASCRIPT_REGEX_BACKTRACKING_RISK_SCAN_V1","complexityConcern":"POTENTIALLY_EXPONENTIAL"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.05","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.05/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_eVBAQO3d9U0iFIbQ5uvh7","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.05","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Analyzes a regular expression pattern for catastrophic backtracking (ReDoS) risk using static heuristics and returns a risk verdict, score, and flagged complexity concerns.","exampleAgentPrompt":"Can you check this regex for catastrophic backtracking risk: `^(a+)+$` with no flags, assuming inputs up to 100,000 characters? I need to know if it's safe to use on untrusted user input.","exampleUseCases":[{"title":"Production regex safety gate","prompt":"Before we deploy this email validation regex `^([a-zA-Z0-9_\\.\\-]+)@([a-zA-Z0-9\\-]+\\.)+[a-zA-Z]{2,}$` to production, can you scan it for backtracking risk with the 'i' flag and inputs up to 500,000 characters?"},{"title":"CI pipeline regex audit","prompt":"I need to check our URL-matching regex `^(https?:\\/\\/)?(www\\.)?([a-zA-Z0-9]+\\.)+[a-zA-Z]{2,}(\\/.*)*$` for ReDoS vulnerabilities — run it with no flags, max input of 10,000 characters, and tell me the risk score."},{"title":"Untrusted user-submitted pattern review","prompt":"A user just submitted this regex pattern `(.*a){20}` for our search feature — can you assess its backtracking risk with the 'g' flag and worst-case inputs up to 1,000,000 characters before I allow it?"}],"resultDescription":"Returns a JSON object with: a verdict string (e.g. HIGH_BACKTRACKING_RISK), a numeric risk score, an array of risk flags (e.g. QUANTIFIED_OVERLAPPING_ALTERNATION), a complexity concern label (e.g. POTENTIALLY_EXPONENTIAL), evidence gaps noting limitations of static analysis, a claim boundary object clarifying what was and wasn't tested, a report hash for auditability, and the schema version identifier.","failureModes":["Pattern exceeds 4096-character limit — returns validation error","Invalid flags outside [dgimsuvy] — schema rejects request","minLength violation if pattern is empty string — returns 400","Static heuristics may produce false positives or miss complex runtime behavior (noted in evidenceGaps)","No runtime benchmark performed — deterministic field is true but runtimeBenchmarked is false"],"whenToPreferThis":"Choose this endpoint when you need a fast, stateless, per-pattern ReDoS risk signal without setting up your own static analysis toolchain. It is especially useful in CI/CD pipelines, agent workflows that accept user-submitted patterns, or pre-deployment audits. It is not a substitute for runtime fuzzing or formal complexity proofs, as the claim boundary explicitly flags its heuristic limitations.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-16T00:31:57.827Z","isFirstParty":false}