GitHub CodeQL code scanning alerts #435 and #436 found that two hardcoded tenant-hostname examples in the Marathi translation regression test were passed directly to RegExp. The unescaped dots matched any character, so text such as aXexampleXcom could satisfy a check intended to require a.example.com.
The affected code ran only in tests/marathiTranslationProgress.test.cjs. It was not part of a WeKan server or browser bundle, accepted no request or user input and denied no operation. There is consequently no attributable runtime attempt to record in Admin Panel → Problems.
Fix: compare the required hostnames as exact strings with includes(). Positive and negative tests prove literal dots are required. A repository-wide guard recognizes a loop that feeds hostname-like literals into RegExp and confirms the reported shape exists nowhere else in tracked first-party JavaScript. Fixed for the upcoming WeKan release on 2026-08-27.