Joe Youngblood’s report surprised me because I didn’t realize our conservative sanitize_username approach doesn’t apply to registrations when you’re not in multi-site mode. https://x.com/YoungbloodJoe/status/2118795342875431305 We should assume every CRUD attempt is hostile. Where else can we tighten up the range… Continue Reading →