Redos
Catastrophic-regex detector: nested quantifiers, overlapping alternation, user-controlled patterns.
One of 104 modules in the GateTest scan suite. Catches the issue before it reaches code review, and on paid tiers opens a pull request with the fix already written.
Example finding from the redos module
(a+)+ at src/validator.ts:30 — catastrophic backtracking
Why we catch it
OWASP-grade scanning that goes beyond CVE lookups into your actual code paths.
The Redos module sits in this category alongside 6 related modules. Together they form one of the layers of a GateTest scan — checks fire in parallel, findings cluster by root cause, and on paid tiers the AI auto-fix loop reads each finding, writes the fix, validates against the scanner, and opens a PR.
How GateTest covers redos
- ✓Runs in every scan. Included on the Full ($99), Scan + Fix ($199), and Forensic Scan ($399) tiers. No additional configuration.
- ✓Free CLI.
npm i -g gatetest && gatetest --module redosagainst any local repo. No paywall on the scanning itself. - ✓AI auto-fix PR. Scan + Fix tier opens a pull request with the fix, a regression test, and a pair-review by a second Claude. Forensic Scan tier adds per-finding diagnosis and cross-finding attack-chain correlation.
- ✓Honest confidence rating. Findings come with high / medium / low confidence so noisy patterns don't block the gate. The confidence-calibrator trainer reads customer suppressions and tightens rules over time.
Scan your repo for redos
Free preview of the headline findings. Pay per scan — no subscription.
Frequently asked questions
What does the Redos module catch?
Catastrophic-regex detector: nested quantifiers, overlapping alternation, user-controlled patterns. Example finding: (a+)+ at src/validator.ts:30 — catastrophic backtracking
Does GateTest fix Redos issues automatically?
Yes — on the Scan + Fix tier ($199) and Forensic Scan tier ($399), Claude reads the finding, writes the fix, validates against the scanner, writes a regression test, and opens a pull request for your review.
Which tiers include the Redos module?
The Full tier ($99), Scan + Fix tier ($199), and Forensic Scan tier ($399) include all 104 modules including Redos. The Quick tier ($29) only includes 4 essential modules.
Can I run the Redos module from the CLI for free?
Yes — install with `npm i -g gatetest` and run `gatetest --module redos` against any local repository. Paid tiers add AI auto-fix and the cross-finding correlation work.