RegEx Syntax Railroad Visualizer & ReDoS Auditor

Regular expressions are among the most compact, expressive, and indispensable tools in software engineering, powering input validation, data extraction, lexical analysis, and text transformation. Yet their dense, non-linear syntax often resembles an inscrutable string of punctuation. A single regex can contain nested capture groups, zero-width assertions, character class ranges, alternations, and greedy quantifiers. When bugs or edge-case matching failures occur, deciphering what the pattern is actually doing requires tracing complex finite automata state transitions manually. Furthermore, poorly constructed regular expressions present a severe, often overlooked cybersecurity vulnerability known as Regular Expression Denial of Service (ReDoS). When an NFA (Non-deterministic Finite Automaton) engine encounters nested quantifiers or overlapping alternations paired with an unmatchable input string, the engine performs catastrophic backtracking. The number of paths the regex engine must evaluate escalates exponentially (O(2^n)), freezing the single-threaded Node.js event loop, exhausting CPU cores, and causing complete server unresponsiveness. This RegEx Syntax Railroad Visualizer and ReDoS Analyzer provides a graphical engineering workbench designed to make regular expressions transparent, auditable, and resilient. It compiles any regular expression pattern into an interactive, high-definition SVG railroad state machine diagram while simultaneously analyzing the underlying Abstract Syntax Tree (AST) for catastrophic backtracking traps. Characters and patterns correspond to physical rail switches: literals appear as green stations, character sets as blue blocks, quantifiers (*, +, {n,m}) as looping return tracks or forward bypass tracks, and alternations (|) as parallel branching rails. Our built-in security auditor scans the compiled AST before execution, immediately flagging nested quantifiers, overlapping branches, and greedy loops, warning developers before vulnerable patterns are committed to production codebases.