[rudycelekli]

Bug

sensitive_data_detection.custom_patterns[].regex comes straight from the user's config file and is not validated when the config loads. buildCustomPattern passes it to PatternBuilder.WithRegex, which uses regexp.MustCompile. One malformed regex therefore panics inside security.NewDetector.

NewDetector runs at startup (runtime.go, server.go, mcp.go), on config reload (ReloadConfig), and when the credential input screen is built. A typo in the config means mcpproxy won't start at all. The validating loader patterns.LoadCustomPatterns exists, but it is not on this path.

Trigger

"sensitive_data_detection": {
  "enabled": true,
  "custom_patterns": [{"name": "x", "regex": "("}]
}

Result: panic: regexp: Compile((): error parsing regexp: missing closing ): (``

Fix

In buildCustomPattern, compile the regex with regexp.Compile first and drop the pattern if it is invalid. This matches how the function already drops a pattern with no name or no regex/keywords. The other custom patterns and all built-in patterns are still loaded.

Test

TestNewDetector_InvalidCustomRegexIsSkipped configures one broken and one valid custom pattern. It asserts that NewDetector does not panic and that the valid pattern still detects TICKET-123456.

Commands run

• CGO_ENABLED=0 go test -count=1 ./internal/security: ok
• With the fix reverted (git stash of detector.go), the new test fails with NewDetector panicked on an invalid custom regex: regexp: Compile((): error parsing regexp: missing closing ): (``.
• gofmt -l on the edited files: no output

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Dumbris]

Verified: the PR test fails on main for the reason described and passes on this branch merged with main; race tests for the touched packages and CI lint (bare and server tags) are clean. Also built and tested together with the rest of this batch, independently reviewed, and cross-reviewed with a second model.

[Dumbris]

Merged. Thank you, @rudycelekli! A malformed custom pattern regex no longer stops mcpproxy from starting.