Regex safety for bots
- Anchor command patterns with ^ and $ so "/startx" does not trigger /start.
- Avoid nested quantifiers such as (a+)+ or (.*)*, which explode on crafted input (ReDoS). Limit input length before matching.
- Never build a pattern from user input without escaping it.
- Prefer the platform's structured data (Telegram entities, Discord interaction options) over parsing raw text.