JavaScript (ECMAScript), because it runs in your browser's own engine — so what you see here is exactly what your JavaScript will do. Be aware it differs from PCRE, Python and Go in real ways: no atomic groups, no possessive quantifiers, no recursion, and lookbehind is supported in JS but not in every other flavour.
What is the ReDoS warning about?
Catastrophic backtracking. A pattern with nested quantifiers such as (a+)+$ can take exponential time on input that nearly matches — 30 characters can hang for minutes. Because JavaScript regexes run synchronously and cannot be interrupted, that would freeze the page with no way to recover. The tool flags the dangerous shapes before you run them.
How do I use named capture groups?
Write (?<name>pattern) in your regex, and reference it as $<name> in the replacement. The sample above uses (?<user>…)@(?<domain>…), which is far more readable than counting $1 and $2 — and it does not break when you add a group in the middle.
Why is the g flag always on?
So you see every match rather than only the first, which is what you want from a tester. Bear in mind that a regex object with g is stateful in JavaScript — it carries lastIndex between calls — which is a classic source of bugs when you reuse one across invocations.