Engine exports construct correctly quoted source code; they do not execute it or provide a foreign matching sandbox. Foreign profiles require well-formed Unicode and explicitly reject unsupported semantics. Keep the returned requirements and capture-name mapping with the code, bound untrusted matching in the receiving application and handle target compilation/resource errors. The .NET snippet supplies a 1,200ms native match timeout; callers must handle RegexMatchTimeoutException. Generated-code comparisons are verified on PHP 8.5.11 / PCRE2 10.44; other editions and application limits need separate validation. See the export contract.

[email protected] is an experimental npm preview. No stable release is supported yet. Security fixes target main; its current behavior can differ from the published preview.

Please report a suspected vulnerability through GitHub's private vulnerability reporting form. Private reporting is enabled for this repository. Include the affected commit or version, reproduction steps, expected and observed behavior, and impact. Do not include real secrets or personal data in a reproducer. Please avoid posting exploitable details in a public issue before maintainers have had a chance to investigate.

The security model explains parser limits, escaping, browser data flow and worker timeout. A regex copied into another application can still have different performance characteristics; report a concrete reproducible issue rather than assuming the workshop timeout protects other runtimes. No response-time or bounty commitment is offered at this stage.