How do you regression-test a ReDoS fix without hanging CI?

A known-bad regex is useful evidence, but putting it directly in the test process can hang the runner before the timeout assertion fires.

The boundary I am using:

• run each adversarial case in a fresh worker thread or child process
• let the parent own a hard timeout and terminate the child
• keep semantic-parity fixtures separate from timing guards
• require the safer replacement to pass both suites
• record the timeout class and bounded elapsed time as evidence

Browser workers have the same trap: startup time should not consume the execution budget, and output limits matter alongside time limits.

Disclosure: I maintain MonoTools. I recently tightened its browser-local Regex Tester around a 300 ms post-startup Worker budget, named groups, replacement previews, and regression cases:
try the bounded tester

What does your team treat as a deterministic CI failure receipt for ReDoS: an exit code, a timeout class, an elapsed-time range, or something else?