Regex-based HTML rewriting in document.write interception can fail-open #407

Summary

The GPT guard uses a regex to match and rewrite GPT domain script URLs in document.write calls. If the regex fails to match (escaped quotes, unusual spacing, mixed quote styles), the original unproxied URL is passed through, causing the browser to load the GPT script directly from Google's CDN instead of through the first-party proxy.

Refs

• crates/js/lib/src/integrations/gpt/script_guard.ts lines 206-230 — rewriteHtmlString regex

Recommendation

Use DOM-based parsing (DOMParser) instead of regex, or fail-closed (block unmatched URLs rather than passing through).

Context

Production readiness audit — see #396