[BUG] Slow-regex check in security-guidance - The same plugin's check for slow regexes misses {n,} repeats. - Denial of service only

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

The same plugin's check for slow regexes misses {n,} repeats. It rejects repo-supplied patterns shaped like (a+)+ but lets (a+){2,}$ through. That pattern took 5 s on 26 characters and 21 s on 28, doubling with each character. A committed .claude/security-patterns.yaml could stall the hook on every edit. Denial of service only, so low.

What Should Happen?

It should reject (a+){2,}$ pattern as well.

Error Messages/Logs

The same plugin's check for slow regexes misses {n,} repeats. It rejects repo-supplied patterns shaped like (a+)+ but lets (a+){2,}$ through. That pattern took 5 s on 26 characters and 21 s on 28, doubling with each character. A committed .claude/security-patterns.yaml could stall the hook on every edit. Denial of service only, so low.

Steps to Reproduce

The same plugin's check for slow regexes misses {n,} repeats. It rejects repo-supplied patterns shaped like (a+)+ but lets (a+){2,}$ through. That pattern took 5 s on 26 characters and 21 s on 28, doubling with each character. A committed .claude/security-patterns.yaml could stall the hook on every edit. Denial of service only, so low.

Claude Model

Opus

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

N/A

Platform

Google Vertex AI

Operating System

Other

Terminal/Shell

Other

Additional Information

The same plugin's check for slow regexes misses {n,} repeats. It rejects repo-supplied patterns shaped like (a+)+ but lets (a+){2,}$ through. That pattern took 5 s on 26 characters and 21 s on 28, doubling with each character. A committed .claude/security-patterns.yaml could stall the hook on every edit. Denial of service only, so low.