Description: The regex error message shown to admins is derived from e.message and displayed in the UI
after only splitting on ": ", which may still expose full engine error text and
potentially sensitive patterns; sanitize or map errors to predefined messages to avoid
leaking internal details.
action.js [53-61]

  new RegExp(regexp, "gui");
} catch (e) {
  const key = `${id}:${word}:${e.message}`;
  if (!seen.has(key)) {
    seen.add(key);
    const parts = e.message.split(": ");
    const cleanError = parts[parts.length - 1];
    errors.push({ word, error: cleanError });
  }

Description: The modal surfaces raw e.message from the JS RegExp engine (only trimmed) back to the
admin user, which could leak engine-specific details or unexpected strings from
user-supplied patterns; prefer whitelisting known error types or generic messages.
watched-word-testing.gjs [32-35]

const addError = (word, message) => {
  errors.push({ word, error: this.cleanErrorMessage(message) });
};

• Create ticket/issue

Follow the guide to enable codebase context checks.

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status:
Logging Context: Newly added error handling logs regex compilation issues but may lack user/context
identifiers needed for comprehensive audit trails.

        Rails.logger.warn(
          "Watched word '#{word}' has invalid regex '#{r}' for #{action}: #{e.message}",
        )
        nil
      end
    end
    .select { |r| r.present? }
    .join("|")

next if regexp.blank?

# Add word boundaries to the regexp for regular watched words
regexp =
  match_word_regexp(
    regexp,
    engine: engine,
  ) if !SiteSetting.watched_words_regular_expressions?

# Add case insensitive flag if needed
begin
  Regexp.new(regexp, group_key == :case_sensitive ? Regexp::IGNORECASE : nil)


 ... (clipped 6 lines)

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status:
Error Detail Exposure: User-facing admin UI surfaces raw regex error messages which may reveal engine internals;
confirm this is acceptable for admin scope and not exposed to regular users.

const key = `${id}:${word}:${e.message}`;
if (!seen.has(key)) {
  seen.add(key);
  const parts = e.message.split(": ");
  const cleanError = parts[parts.length - 1];
  errors.push({ word, error: cleanError });
}

Learn more about managing compliance generic rules or creating your own custom rules

Invert the ternary condition for applying Regexp::IGNORECASE to correctly handle
case-sensitive and case-insensitive watched words.

app/services/word_watcher.rb [104-112]

 # Add case insensitive flag if needed
--        Regexp.new(regexp, group_key == :case_sensitive ? nil : Regexp::IGNORECASE)
-+        begin
-+          Regexp.new(regexp, group_key == :case_sensitive ? Regexp::IGNORECASE : nil)
-+        rescue RegexpError => e
-+          raise if raise_errors
-+          Rails.logger.warn(
-+            "Watched word compilation failed for #{action} (#{group_key}): #{e.message}. Regexp: #{regexp}",
-+          )
-+          nil
-+        end
+        begin
+          Regexp.new(regexp, group_key == :case_sensitive ? nil : Regexp::IGNORECASE)
+        rescue RegexpError => e
+          raise if raise_errors
+          Rails.logger.warn(
+            "Watched word compilation failed for #{action} (#{group_key}): #{e.message}. Regexp: #{regexp}",
+          )
+          nil
+        end

[To ensure code accuracy, apply this suggestion manually]