Overly Restrictive Regular Expression

An overly restrictive regex doesn't match every input it should, creating a gap in your security checks. This isn't about the regex being computationally complex; it's about its logic being incomplete. For example, using /[0-8]/ to validate digits would miss the number '9', potentially allowing an unwanted value to slip through. The result is either false negatives (missing real threats) or false positives (blocking safe input), depending on whether the regex is used to allowlist or blocklist terms. As a developer, you must carefully review the intended scope of your validation. Test your regular expressions against the full range of both valid and malicious edge cases to ensure they capture everything relevant. This proactive testing helps close the gap between what you think your regex catches and what it actually allows or blocks in practice.