## Lesson — Use boundary-guard anchors for domain blocklists

**Tags:** security, regex
**Scope:** packages/pack-agent-security/test/**/*.ts

Simple anchors like `(?:^|\.)` are insufficient for domain matching; use boundary guards like `[^\w-]` to prevent partial matches against sibling domains (e.g., preventing 'evil.com' from matching 'not-evil.com').
