# paste a regex — is it a ReDoS time bomb?
Why other tools cry wolf — and this one doesn't
Most ReDoS linters are static only: they pattern-match on shapes like (x+)+ and warn.
That produces a flood of false positives — plenty of nested quantifiers are perfectly fast — so the warnings get ignored.
redosray flags candidates statically too, then actually runs each one in an isolated worker against a purpose-built attack string that grows geometrically, timing every step. If match time explodes past the timeout, you get a proof: the smallest input that crossed it, plus the growth curve. If it stays fast at every size, redosray stays quiet. The result you see above is a real measurement taken in your browser just now.
Proven, not guessed
Every “vulnerable” verdict comes with a measured hang and the exact killer input. No hand-wavy warnings.
Exponential vs polynomial
Tells you whether backtracking blows up exponentially (a few dozen chars kill it) or polynomially (quadratic and up).
Offline & private
Pure JavaScript, no dependencies, no network. The CLI scans your repo the same way — your source never leaves your machine.
Copy-paste fix ready
Every finding gives you file:line:col and the attack input, so you can add a regression test the moment you patch it.
Scan your whole repo
The playground checks one regex. The CLI extracts every regex literal from your JavaScript, TypeScript and Python and confirms each the same way — with file:line and a proof.
# no install needed npx redosray ./src # or install it npm i -g redosray redosray ./src # fail CI if any confirmed ReDoS is found redosray ./src --ci # check a single pattern redosray -e '(a+)+$' # machine-readable redosray ./src --json
Exit code 2 on a confirmed vulnerability makes --ci a one-line pre-commit or CI gate.