Comment by alexpovel

It's currently whitelist-based [0]. The downside is larger (code) size. The upside is simplicity. I imagine a blacklist could also work well, at smaller size but with more preprocessing needed.

[0]: https://github.com/alexpovel/srgn/blob/0008cce1c71f0d83f6a31...