Summary
The profanity filter in backend/src/utils/username-validator.ts (line 69) is:
const PROFANITY_FILTER = /\b(profanity|badword|offensive|inappropriate)\b/i;
This regex literally matches the English words "profanity", "badword", "offensive", and "inappropriate" — not actual offensive words. Any real profanity in a username passes this check without being flagged.
Impact
Usernames with offensive language can be registered and appear publicly on creator profiles.
Fix
Replace the placeholder with a real profanity word list or integrate a library such as bad-words or leo-profanity. Alternatively, add the actual offensive terms to the regex or use an allow-list approach (only allow username characters that can't form offensive words).
Summary
The profanity filter in
backend/src/utils/username-validator.ts(line 69) is:This regex literally matches the English words "profanity", "badword", "offensive", and "inappropriate" — not actual offensive words. Any real profanity in a username passes this check without being flagged.
Impact
Usernames with offensive language can be registered and appear publicly on creator profiles.
Fix
Replace the placeholder with a real profanity word list or integrate a library such as
bad-wordsorleo-profanity. Alternatively, add the actual offensive terms to the regex or use an allow-list approach (only allow username characters that can't form offensive words).