- divide common and uncommon heuristics and make optional flag to check for old/dead apps. Perhaps divided in categories like STRICT, STANDARD, LOOSE for varying levels of depth;
- partial scans: as soon as a result is hit the scan gets terminated to save processing time, when we already know that any hit will suffice to block billing;