If something relies on trusted data I'd argue there isn't a ReDoS vulnerability there at all. In some ways this reminds of XML/JSON parsing vulnerabilities. If

If something relies on trusted data I'd argue there isn't a ReDoS vulnerability there at all. In some ways this reminds of XML/JSON parsing vulnerabilities. If ran on untrusted / unsanitised data they can be absolutely tier 1 critical (remote code execution) but if parsing trusted data then they are essentially benign. If someone claims you have a vulnerability and you disagree then it's on the submitter to prove it with a PoC or a plausible mechanism for triggering it. That doesn't however invalidate the whole class of vulnerabilities.