BF: need to anchor the start to avoid another repeat of DoS injection like Apache