Joe Youngblood’s report surprised me because I didn’t realize our conservative sanitize_username approach doesn’t apply to registrations when you’re not in multi-site mode.
https://x.com/YoungbloodJoe/status/2118795342875431305
We should assume every CRUD attempt is hostile. Where else can we tighten up the range of what we accept? For usernames we could make new registrations have stricter rules than before without breaking backwards compatibility.
Just like we ship with moderated comments on by default, I think it’s a good opportunity to look at every instance where we send an email and look at how we can become less interesting to spammers. Should comment notification
