this is a very good point. I suppose you could in some cases make the test cases "exhaustive" (or at least drawing from all possible inputs) which would possibly mitigate this problem. Putting a limit on size/running time as you suggest is certainly a good idea, though it's not like any algorithm can brute-force more than a couple of composed tokens at a time....