Longest-First Matching Algorithm Prevents Domain Fragment Bypass in Privacy Filter

The implementation detail that makes the 38-pattern blocklist robust: matching longer patterns before shorter ones prevents substring attacks where variants like [provider domain] would slip through a gmx-only match.