System silently appends a sequence number when an existing username is entered
#27 opened Aug 25, 2026 by Dharmendra Kumar
When a user changes their username to a username that is already taken, the system does not inform the user that the requested username is unavailable. Instead, it silently modifies the entered username by appending a sequence number. For example, if the username qabash already exists and another user enters qabash, the system automatically changes it to qabash-2 without displaying any warning, error, or availability suggestion. Steps to Reproduce- - Log in to an existing user account. - Navigate to the profile settings. - Enter a username that is already used by another user. Example: qabash - Save the username. Observe the username assigned by the system. Actual Result: The system accepts the requested username without informing the user that it is already taken and automatically changes it to: qabash-2 No warning, validation message, or confirmation is shown to the user. Expected Result: The system should clearly indicate that the requested username is already taken before or during submission. For example: Username already taken. Please choose another username. The system could also provide alternative suggestions, such as: qabash1 qabash-qa qabash-dev However, the system should not silently alter the user's requested username. If the application intentionally uses automatic username generation, the user should at least be informed and given an opportunity to accept or modify the suggested username. Why This Is a Problem: Silently modifying user input can lead to confusion because the user may believe they successfully claimed the username they entered. For example, a user enters: qabash but their actual username becomes: qabash-2 This can also cause inconsistencies when the username is used in: - Profile URLs - Public profiles - Referral/invite links - External sharing - User identification Suggested Improvement: Implement real-time or on-submit username availability validation.
Resolution
Fixed — the username-availability check was looking at the wrong internal field, so it could never actually tell whether a name was taken. That let every save fall through to a silent fallback that appended "-2" without telling you. Re-entering your own current username is now a safe no-op, and trying to claim a name someone else already has now returns a clear "already taken" error instead of silently mutating what you typed.
Last updated Aug 25, 2026