The post specifically concerns ReDoS; I think DoS as a broader class has slightly more merit. (Ultimately, I don't care if people factor out accidentally expon

The post specifically concerns ReDoS; I think DoS as a broader class has slightly more merit. (Ultimately, I don't care if people factor out accidentally exponential regular expressions -- that seems like a good thing to do! I take umbrage at the idea, however, that they're a vulnerability class that deserves the serious attention we give to things that attackers actually use. My perspective is that ReDoS reports are better suited for linting and CQA than they are for security reporting.)