Developer Utilities Tier 2 Ready POST /v1/regex-safety

Regex ReDoS Scanner API — Detect Catastrophic Backtracking & Explain Regular Expressions

Audit regular expressions for O(2^n) ReDoS backtracking, explain patterns, and test matches. Statically audit regular expressions for O(2^n) exponential and O(n^2) polynomial ReDoS catastrophic backtracking, get safe rewrite hints, plain-English explanations, and test matches.

Try It Live in Your Browser · No API Key Required

1. Interactive Sandbox & Sample JSON Output

200 OK · Ready

Editable Request JSON (`POST /v1/regex-safety`)

Live 200 OK Response Envelope

{
  "ok": true,
  "data": {
    "valid_syntax": true,
    "safe": false,
    "verdict": "vulnerable",
    "worst_case_complexity": "O(2^n)_exponential",
    "risk_score": 90,
    "normalized_pattern": "^([a-zA-Z0-9_]+)+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$",
    "normalized_flags": "i",
    "evil_input_hint": "A repeating alphanumeric/character run of 28–35 characters followed by a non-matching terminator (e.g. 'aaaaaaaaaaaaaaaaaaaaaaaaaaaa!') triggers exponential backtracking.",
    "safe_rewrite_hint": "^(?:[a-zA-Z0-9_]+)@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$",
    "explanation": [
      "Anchored at the start of the string (^).",
      "Anchored at the end of the string ($).",
      "Uses character class bracket expressions ([...]).",
      "Active flags: case-insensitive (i)."
    ],
    "findings": [
      {
        "category": "nested_quantifier_exponential",
        "severity": "critical",
        "description": "Quantified group '([a-zA-Z0-9_]+)+' contains an inner repeating quantifier, causing O(2^n) catastrophic backtracking on non-matching suffixes",
        "fragment": "([a-zA-Z0-9_]+)+",
        "remediation": "Flatten nested quantifiers (e.g. replace '(a+)+' with 'a+') or separate repeated tokens with a mandatory delimiter."
      }
    ],
    "test_results": [
      {
        "input": "dev@tinplate.dev",
        "matched": true,
        "match_text": "dev@tinplate.dev",
        "index": 0,
        "captures": [
          "dev"
        ]
      }
    ]
  },
  "meta": {
    "request_id": "req_rgx_01",
    "ms": 1
  }
}

Get API Key on RapidAPI Get API Key on Zyla Hub Download OpenAPI 3.0.3 Spec

2. Quickstart Code Examples

Full TypeScript & Python SDK →

curl -X POST "https://api.tinplate.dev/v1/regex-safety" \
  -H "Content-Type: application/json" \
  -H "X-RapidAPI-Key: YOUR_RAPIDAPI_KEY" \
  -d '{"pattern":"^([a-zA-Z0-9_]+)+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$","flags":"i","test_strings":["dev@tinplate.dev"]}'

import { TinplateClient } from "@tinplate/sdk"; // npm install @tinplate/sdk

const tinplate = new TinplateClient({
  rapidApiKey: process.env.RAPIDAPI_KEY!,
});

const { data, meta } = await tinplate.call("/v1/regex-safety", {
  "pattern": "^([a-zA-Z0-9_]+)+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$",
  "flags": "i",
  "test_strings": [
    "dev@tinplate.dev"
  ]
});
console.log(`[${meta.ms} ms]`, data);

import requests

response = requests.post(
    "https://api.tinplate.dev/v1/regex-safety",
    headers={
        "Content-Type": "application/json",
        "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
    },
    json={
  "pattern": "^([a-zA-Z0-9_]+)+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$",
  "flags": "i",
  "test_strings": [
    "dev@tinplate.dev"
  ]
}
)
print(response.json())

const response = await fetch("https://api.tinplate.dev/v1/regex-safety", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
  },
  body: JSON.stringify({
  "pattern": "^([a-zA-Z0-9_]+)+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$",
  "flags": "i",
  "test_strings": [
    "dev@tinplate.dev"
  ]
}),
});
const result = await response.json();
console.log(result);

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "tinplate_regex_safety",
    "arguments": {
      "pattern": "^([a-zA-Z0-9_]+)+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$",
      "flags": "i",
      "test_strings": [
        "dev@tinplate.dev"
      ]
    }
  }
}

OpenAPI 3.0.3 Schema Contract

Request Parameters & Response Schema Reference

Request Body Parameters (`POST /v1/regex-safety`)

Parameter	Type & Constraints	Description
`pattern`required	`string` minLen: 1, maxLen: 8192	Regular expression pattern string (without surrounding /.../ slashes, or in /pattern/flags literal format).
`flags`optional	`string` maxLen: 16, default: ""	Optional ECMAScript RegExp flags (e.g. 'i', 'g', 'm', 's', 'u', 'v').
`test_strings`optional	`string[]`	Optional sample strings (max 512 chars each) to test against the pattern when safe to execute.

Response `data` Object Fields (`200 OK`)

Field	Type	Description
`valid_syntax`	`boolean`	Field 'valid_syntax'
`safe`	`boolean`	Field 'safe'
`verdict`	`"safe" \| "warn" \| "vulnerable" \| "invalid"`	Field 'verdict'
`worst_case_complexity`	`"O(n)_linear" \| "O(n^2)_polynomial" \| "O(2^n)_exponential" \| "invalid"`	Field 'worst_case_complexity'
`risk_score`	`integer`	Field 'risk_score'
`normalized_pattern`	`string`	Field 'normalized_pattern'
`normalized_flags`	`string`	Field 'normalized_flags'
`evil_input_hint`	`string \| null`	Field 'evil_input_hint'
`safe_rewrite_hint`	`string \| null`	Field 'safe_rewrite_hint'
`explanation`	`string[]`	Field 'explanation'
`findings`	`object[]`	Field 'findings'
`test_results`	`object[]`	Field 'test_results'

3. What Regex ReDoS Vulnerability Scanner & Pattern Explainer API Detects & Validates

Static O(2^n) exponential ReDoS detection: nested quantifiers ((a+)+, ([a-z]+)*) and quantified overlapping alternations ((foo|foobar)+, (\w+|\d+)+)
O(n^2) polynomial ReDoS detection: adjacent unbounded wildcards (.*.*), overlapping quantified character classes (\w+\d*), and unanchored leading .* scans
Generates an evil_input_hint explaining the backtracking trigger, a safe_rewrite_hint, and a plain-English structural explanation
Safely evaluates up to 20 sample test_strings with capture-group extraction while bounding execution on vulnerable patterns

Honest Engineering Boundaries

4. Known Limitations & Test Verification

Release Version: v1.0.7 · Last Verified / Benchmarked: 14 November 2026 · Latency Note: Sub-millisecond figures measure in-Worker V8 compute time (typical client HTTPS network RTT to the nearest Cloudflare PoP is 15–65 ms) · See Full Portfolio Benchmarks & Corpora →

Performs fast structural AST analysis in memory (typically under 5 ms in deterministic mode) rather than full NFA-to-DFA state-space explosion.
Tested v1.0.4 (14 November 2026).

5. Marketplace Plans & Payload Quotas

Plan	Monthly Price	Included Requests	Rate Limit	Max Request Payload	Best For
BASIC	$0.00 / month	500 / month (hard limit)	10 req / min	64 KB	Evaluation, local development & CI smoke tests
PRO	$9.99 / month	15,000 / month	60 req / min	128 KB	Solo developers & production apps
ULTRA	$29.99 / month	100,000 / month	300 req / min	256 KB	Growing SaaS & multi-agent pipelines
MEGA	$79.99 / month	500,000 / month	1,000 req / min	256 KB	High-volume enterprise workloads

Subscribe on RapidAPI Subscribe on Zyla Hub Full Pricing Details

6. Frequently Asked Questions

Why should I validate LLM-generated or user-supplied regular expressions?

A single vulnerable regex like ^([a-z]+)+$ in a JSON Schema pattern, WAF rule, or search filter lets an attacker freeze a Node.js or Python event loop for minutes with a 32-byte string.

Is it safe to pass an evil regex with test_strings to this API?

Yes—the ReDoS detector is purely static, and when a pattern is flagged as O(2^n)_exponential, sample test strings are automatically length-capped to 24 characters before execution.

Does it accept /pattern/flags literal syntax?

Yes, you can pass either raw pattern + flags fields or a slash-delimited literal like '/^(a+)+$/i'.

Zero Payload Logging

7. Data Handling, Privacy & Marketplace Proxy Disclosure

Patterns and sample strings are analyzed in memory and discarded immediately.

Worker Zero-Logging Guarantee: Cloudflare Workers Observability and invocation logging are disabled in configuration (observability.enabled = false, head_sampling_rate = 0, invocation_logs = false). Payloads are processed strictly in volatile V8 memory and never logged or stored by Tinplate.

Marketplace Proxies vs. Direct Bearer Key: Requests sent via RapidAPI or Zyla API Hub pass through those marketplaces' proxy infrastructure (subject to their respective privacy policies). Security-sensitive workloads requiring end-to-end zero-intermediary processing can connect directly to https://api.tinplate.dev using a Direct Bearer Key (Authorization: Bearer <API_KEY>). Read our full Privacy Notice and OpenAPI 3.0.3 JSON Schema.