The worker constructs the browser's native RegExp with the selected g, i, m, s, u, and y flags. Global controls repeated exec() calls, multiline changes ^ and $ line-boundary behavior, dot-all lets dot include line terminators, Unicode changes code-point-aware pattern behavior, and sticky requires the next match at lastIndex.
Untrusted matching never runs on the page's main thread. A module worker loads the bounded engine, and the page terminates the worker if it has not completed within 1,000 ms. Browsers without Worker support do not fall back to unsafe synchronous execution.
When supported, the engine adds the d flag internally to obtain exact full and capture ranges. Ranges are half-open UTF-16 code-unit offsets, so slicing testText.slice(start, end) reproduces the matched span even when code-point or grapheme counts differ.
Global zero-width results require manual lastIndex advancement because no text was consumed. Without u, advancement is one UTF-16 code unit; with u, a high-surrogate and following low-surrogate pair are advanced together according to JavaScript's Unicode string-index rule.
Patterns are limited to 16 KiB UTF-8, test text to 1 MiB UTF-8, returned matches to 1,000, each value preview to 500 code points, combined returned previews to 100,000 code points, and visual highlighting to the first 50,000 UTF-16 code units. Exact ranges remain available when copied values are shortened.
Input and match contents remain in browser memory and the worker message channel. Success telemetry is deliberately restricted to selected flags, input byte sizes, returned match count, and whether a result or preview limit was reached; raw patterns and text are excluded.