diff --git a/plugin-sdk/src/cli/checks/readme.ts b/plugin-sdk/src/cli/checks/readme.ts
index 6dcd39cba..abc94b3c1 100644
--- a/plugin-sdk/src/cli/checks/readme.ts
+++ b/plugin-sdk/src/cli/checks/readme.ts
@@ -29,11 +29,29 @@ export const PLACEHOLDER_PATTERNS = [
 
 export const MIN_PROSE_CHARS = 400;
 
+/**
+ * The heading body, with the trailing HTML comment authors use to hide anchors cut off.
+ *
+ * Cut with indexOf rather than a regex on purpose. The obvious spellings — the
+ * `(.+?)\s*(?:<!--.*)?$` this used to be, or a `replace(/\s*<!--.*$/, '')` in front of it —
+ * put two quantifiers on the same run of spaces, and both then backtrack quadratically:
+ * a heading line padded with 80k spaces takes ~12s, 200k takes ~30s. This gate runs over
+ * READMEs anyone can submit to the registry, so that is a stall someone can post. Same
+ * failure the wiki sidebar parser was rewritten for (server/src/nest/help/wiki.ts).
+ */
+function headingBody(line: string): string {
+  const comment = line.indexOf('<!--');
+  return comment < 0 ? line : line.slice(0, comment);
+}
+
 /** Which of REQUIRED_SECTIONS have no matching heading. */
 export function missingSections(md: string): string[] {
-  // The `(?:<!--.*)?` tail mirrors check-readme.mjs — it tolerates a trailing HTML comment
-  // on a heading line, which authors use to hide anchors.
-  const headings = [...md.matchAll(/^#{1,6}\s+(.+?)\s*(?:<!--.*)?$/gm)].map((m) => m[1].toLowerCase());
+  const headings = md
+    .split('\n')
+    // `\S.*\S|\S` instead of a lazy body: the edges are pinned to non-space, so nothing
+    // competes with the trailing `\s*`.
+    .map((line) => /^#{1,6}\s+(\S.*\S|\S)\s*$/.exec(headingBody(line))?.[1].toLowerCase())
+    .filter((h): h is string => h !== undefined);
   return REQUIRED_SECTIONS.filter((want) => !headings.some((got) => got.includes(want.toLowerCase())));
 }
 
diff --git a/plugin-sdk/test/checks.test.ts b/plugin-sdk/test/checks.test.ts
index aed36deda..ebbd91a3c 100644
--- a/plugin-sdk/test/checks.test.ts
+++ b/plugin-sdk/test/checks.test.ts
@@ -241,6 +241,24 @@ describe('README helpers mirror the registry exactly', () => {
     expect(missingSections('## What it does')).toEqual(['Screenshots', 'Permissions', 'Setup']);
   });
 
+  it('still ignores the trailing anchor comment authors hide on a heading', () => {
+    const md = '## What it does <!-- #what -->\n## Screenshots<!--x-->\n##\tPermissions   \n## Setup <!-- unterminated';
+    expect(missingSections(md)).toEqual([]);
+    // A heading that is nothing but a comment names no section.
+    expect(missingSections('# <!-- only -->')).toEqual(['What it does', 'Screenshots', 'Permissions', 'Setup']);
+  });
+
+  it('does not stall on a heading padded with spaces', () => {
+    // The old `(.+?)\s*(?:<!--.*)?$` was quadratic: ~12s at 80k spaces, ~75s at 200k.
+    // READMEs reach this gate from the registry's submission CI, so the padding is
+    // attacker-supplied. The bound is 1000x the real cost, so it fails on the shape
+    // of the regression, not on a slow machine.
+    const md = `## What it does${' '.repeat(200_000)}x\n## Screenshots\n## Permissions\n## Setup`;
+    const started = performance.now();
+    expect(missingSections(md)).toEqual([]);
+    expect(performance.now() - started).toBeLessThan(1000);
+  });
+
   it('ignores data: URIs when looking for a screenshot, like the registry does', () => {
     expect(images('![a](data:image/png;base64,xxx)')).toEqual([]);
     expect(images('<img src="shot.png">')).toEqual(['shot.png']);