2025-07-31-regexp-injection-threat-model.md

category	minorAnalysis

• The js/regex-injection query no longer considers environment variables as sources by default. Environment variables can be re-enabled as sources by setting the threat model to include the "environment" category.