A known-bad regex is useful evidence, but putting it directly in the test process can hang the runner before the timeout assertion fires.
The boundary I am using: run each adversarial case in a fresh worker thread or child process let the parent own a hard timeout and terminate the child keep semantic-parity fixtures separate from timing guards require the safer replacement to pass both suites record the timeout class and bounded elapsed time as evidence Browser workers have the same trap: startup time should not consume the execution budget, and output limits matter alongside time limits.
Disclosure: I maintain MonoTools.
I recently tightened its browser-local Regex Tester around a 300 ms post-startup Worker budget, named groups, replacement previews, and regression cases: try the bounded tester What does your team treat as a deterministic CI failure receipt for ReDoS: an exit code, a timeout class, an elapsed-time range, or something else?