Fix pattern consistency and comment accuracy based on code review

Co-authored-by: luisgizirian <598685+luisgizirian@users.noreply.github.com>

Author: Copilot

internal/defender/defender.go

@@ -157,7 +157,7 @@ func NewDefender(opts DefenderOptions) *Defender {
 		`[?&](redirect|return|url|next|dest|destination|continue|view|target|redir|r|u)=https?://`,  // Open redirect
 		`[?&](redirect|return|url|next|dest|destination|continue|view|target|redir|r|u)=//`,         // Protocol-relative redirect
 		`[?&](redirect|return|url|next|dest|destination|continue|view|target|redir|r|u)=.*%2f%2f`,   // Encoded // in redirect
-		`(returnUrl|redirect|return|url|next|dest|destination|continue|view|target|redir).*%25[23]`,  // Excessive URL-encoded nesting (4+ levels)
+		`[?&](returnUrl|redirect|return|url|next|dest|destination|continue|view|target|redir).*%25[23]`,  // Excessive URL-encoded nesting (4+ levels)
 	}
 
 	for _, pattern := range patterns {

internal/defender/defender_test.go

@@ -1042,7 +1042,7 @@ func TestDefender_ExcessiveURLEncodedNesting(t *testing.T) {
 			name:       "Excessive nesting with redirect param",
 			uri:        "/auth?redirect=/page1?redirect%3D/page2?redirect%253D/page3",
 			suspicious: true,
-			reason:     "3+ levels of URL encoding detected",
+			reason:     "4+ levels of URL encoding detected",
 		},
 		{
 			name:       "Simple redirect - no nesting",