[jeroenhd]

Hyphens and underscores are often permitted characters in usernames, more so than exclamation marks or other special characters.

I don't really see what problem using a hyphen in a username could pose, unless there's some kind of filter being applied that doesn't take into account the previously permitted characters. I'd guess someone applied an [A-z0-9]+ without thinking too much about it because that's what the current username rules are.

I'm more surprised that there's a second authorization endpoint, Github could've just used their existing OAuth2 implementation to log users in if they didn't want to reuse the existing login code.

[rement]

Fun ASCII gotcha: [A-z] includes [ ] \ ^ _ and `

[kitten_mittens_]

I think this is why I usually see `[A-Za-z]` for ascii. My previous employer decidedly ignored "non-english" text.

`[A-z]` -> https://regex101.com/r/IlhPiD/1 `[A-Za-z]` -> https://regex101.com/r/iWjwf2/1

After looking it up, `\p{L}` looks like it matches letters https://regex101.com/r/1UiG9S/1.