v3.1.34

• New recall: catches the most common concat-SQLi style (a quote-wrapped value) plus Sequelize literal(), vm code execution, node-serialize deserialization, server-side template injection (ejs/Handlebars), ECB/insecure ciphers, document.write XSS, prototype pollution via bracket assignment & lodash set, sendFile path traversal, and open redirect via the Location header
• Three new rules (436 total); validated against a real-world corpus — zero new false positives, only genuine previously-missed vulnerabilities flagged
• Added a ReDoS guard that runs every rule pattern against adversarial input on each build (it caught a backtracking regression in this very release before ship)