usernames 0.1.3

data/data/offensive/hate.yml

@@ -0,0 +1,51 @@
+# Hate tokens and numbers. Not subject to allowlist exemptions.
+# Meanings follow the ADL hate-symbol database, the Simon Wiesenthal Center and Wikipedia;
+# nothing of theirs is copied — the rules below are this project's own (data/NOTICE: usernames).
+# A bare number is not evidence (Wiesenthal guide): numbers count only in the forms listed here.
+#
+# W  = the compact name with separators removed, leet-folded (data/offensive/leet.yml).
+# R0 = the comparison key before folding; digit runs are read from R0.
+
+# Blocked anywhere as a substring of W (all >= 4 letters).
+always:
+  - wpww          # White Pride World Wide
+  - rahowa        # "racial holy war"
+  - heilhitler
+  - siegheil
+  - sonnenrad     # the "black sun" emblem
+  - whitepower
+  - waffenss
+  - goyimdefense  # Goyim Defense League
+  - goyimknow
+
+# Blocked when the digits form a whole digit run of R0, or two parts joined by one separator
+# (14_88, 14.88, 14-88). Never inside a longer run: 31488210 is a phone fragment.
+digit_runs:
+  - "1488"
+  - "8814"
+
+# A number blocked only when it sits next to one of these tokens (before or after, with or
+# without a separator): hh88, heil88, 88_hitler, combat18, 14words, 14_88.
+adjacent:
+  "88": [heil, sieg, hitler, nazi, wp, hh, "14", "18"]
+  "14": [words, "88"]
+  "18": [combat, "88"]
+
+# Blocked only when the token is a whole segment, and only in the listed locale.
+# kkk is laughter in pt-BR; zog is also King Zog of Albania (segment only).
+whole_token:
+  en: [kkk, zog]
+  es: []
+
+# Never blocked on their own: birth years (mike88), ham-radio "88" (love and kisses), the
+# Chinese lucky number, the band 311 (explicitly not hate per the ADL), 1312/ACAB (policy, not
+# hate), 420, 69, 100.
+never:
+  - "88"
+  - "18"
+  - "14"
+  - "311"
+  - "1312"
+  - "420"
+  - "69"
+  - "100"

data/data/offensive/leet.yml

@@ -0,0 +1,27 @@
+# Leetspeak folding. Applied to the input AND, at load time, to every term, so terms are stored
+# un-folded in <locale>.json.
+
+# Digit → letter. Used by BOTH the reserved impersonation check (its folded spelling) and the offensive matcher.
+digits:
+  "0": o
+  "1": i
+  "3": e
+  "4": a
+  "5": s
+  "7": t
+
+# Rewrites used by the offensive matcher ONLY, applied after the digit folds, in this order — to
+# each segment, and again to the whole name once its separators are gone, so `p_huck` is `phuck`
+# is `fuck`. `v` → `u` comes after `vv` → `w`: `fvck` is `fuck`, `vvhore` still `whore`. Then
+# every run of three or more of one letter is cut to two (`fuuuuuck` → `fuuck`, which the
+# stretched variants fold to as well).
+# Measured cost on 235,974 web2 words: vv→w and x→ks add 0 innocent hits, ph→f adds 11.
+offensive_only:
+  vv: w
+  v: u
+  ph: f
+  x: ks
+
+# Deliberately NOT folded (measured): cl→d (+879 innocent words), rn→m (+30), l↔i (+26),
+# ck→k (+24), and collapsing every double letter (8,053 vs 2,798 baseline; `ass`→`as`) — only runs
+# of three or more are cut.

data/data/reserved/ALLOWLIST_EXCEPTIONS.txt

@@ -0,0 +1,6 @@
+# Reserved words that are also a first name or surname in test/corpora/ and are kept on purpose.
+# One entry per line: `<word> # <reason>`. Generated by script/build_reserved_data.rb.
+# Every other name collision is dropped at build time (nick mac page price win old list ping).
+
+# source: usernames (MIT) — deliberate exceptions to the no-real-names rule
+root # Unix superuser and a CA validation mailbox; the impersonation risk outweighs the rare given name

data/data/reserved/impersonation.txt

@@ -0,0 +1,69 @@
+# Impersonation words: matched on the whole name, every segment, leet-folded, plural
+# Generated by script/build_reserved_data.rb — edit the script, not this file.
+
+# source: usernames (MIT) — staff and authority roles (Mastodon, Discourse and Misskey defaults; facts only)
+admin
+administration
+administrator
+ceo
+cofounder
+employee
+founder
+maintainer
+mod
+moderation
+moderator
+official
+operator
+owner
+root
+staff
+superadmin
+superuser
+sysadmin
+sysop
+
+# source: usernames (MIT) — support, trust and safety desks a scammer would pose as
+appeals
+billing
+compliance
+customercare
+customerservice
+customersupport
+help
+helpcenter
+helpdesk
+helpline
+payments
+safety
+security
+support
+trust
+trustandsafety
+verification
+verified
+
+# source: usernames (MIT) — platform voices: the system itself, its bots and its announcements
+abuse
+announcement
+announcements
+bot
+donotreply
+hostmaster
+mailerdaemon
+noreply
+notification
+notifications
+postmaster
+system
+team
+webmaster
+
+# source: usernames (MIT) — joined compounds that segment matching cannot see (admin_team is caught, adminteam is not)
+adminteam
+modteam
+officialaccount
+safetyteam
+securityteam
+staffteam
+supportteam

data/data/reserved/mailboxes.txt

@@ -0,0 +1,77 @@
+# Mailbox and role names: matched exactly
+# Generated by script/build_reserved_data.rb — edit the script, not this file.
+
+# source: rfc2142 (IETF standards facts) — RFC 2142 role mailboxes
+abuse
+ftp
+hostmaster
+info
+marketing
+news
+noc
+postmaster
+sales
+security
+support
+usenet
+uucp
+webmaster
+www
+
+# source: django-registration (BSD-3-Clause) — mailboxes Certificate Authorities accept for domain validation
+admin
+administrator
+is
+it
+mis
+root
+ssladmin
+ssladministrator
+sslwebmaster
+sysadmin
+
+# source: django-registration (BSD-3-Clause) — protocol hostnames and no-reply addresses
+imap
+mail
+mailer-daemon
+no-reply
+nobody
+noreply
+pop
+pop3
+smtp
+webmail
+
+# source: forwardemail (MIT) — role and no-reply mailbox names (ASCII base names; leet/homoglyph variants are the matcher's job)
+administracion
+billing
+boletins
+bounce
+bounces
+conserje
+contabilidad
+contact
+contacto
+contato
+do-not-reply
+do-not-respond
+donotreply
+donotrespond
+email
+help
+mailer.daemon
+mailerdaemon
+naoresponda
+no-replys
+no_reply
+noreplys
+soporte
+ssl
+suporte
+sys.administrator
+sysadministrator
+system-administrator
+system.administrator
+systemadministrator
+tls
+vendas

data/data/reserved/system.txt

@@ -0,0 +1,124 @@
+# System words: matched exactly
+# Generated by script/build_reserved_data.rb — edit the script, not this file.
+
+# source: usernames (MIT) — code sentinels and JavaScript prototype keys
+__proto__
+constructor
+false
+hasownproperty
+infinity
+nan
+nil
+none
+null
+prototype
+then
+true
+undef
+undefined
+void
+
+# source: usernames (MIT) — mention words: @everyone/@here/@channel/@all (Slack, Mattermost, Discourse, Misskey; facts only)
+all
+channel
+everyone
+here
+mention
+mentions
+
+# source: usernames (MIT) — placeholders for deleted or absent users (GitHub's ghost, verified; the rest convention)
+anon
+anonymous
+deleted
+deleted_user
+deleteduser
+ghost
+nobody
+removed
+suspended
+unknown
+
+# source: usernames (MIT) — pronoun and name placeholders (Discourse and Misskey defaults; facts only)
+host
+instance
+me
+name
+nickname
+random-username
+server
+user
+username
+you
+
+# source: usernames (MIT) — Windows reserved device names (Microsoft Learn, file naming; facts only)
+aux
+com1
+com2
+com3
+com4
+com5
+com6
+com7
+com8
+com9
+con
+lpt1
+lpt2
+lpt3
+lpt4
+lpt5
+lpt6
+lpt7
+lpt8
+lpt9
+nul
+prn
+
+# source: usernames (MIT) — Windows built-in accounts (Microsoft Learn; facts only)
+defaultaccount
+guest
+helpassistant
+krbtgt
+wdagutilityaccount
+
+# source: usernames (MIT) — Debian base-passwd users and groups, systemd service users (facts only)
+_apt
+adm
+backup
+bin
+daemon
+disk
+games
+irc
+mail
+man
+news
+nogroup
+proxy
+sudo
+sync
+sys
+systemd-coredump
+systemd-journal-remote
+systemd-network
+systemd-oom
+systemd-resolve
+systemd-timesync
+tty
+users
+uucp
+www-data
+
+# source: django-registration (BSD-3-Clause) — special hostnames: a username turned subdomain must not hijack client auto-configuration
+autoconfig
+autodiscover
+broadcasthost
+isatap
+localdomain
+localhost
+wpad
+
+# source: usernames (MIT) — RFC 2606 / RFC 6761 special-use names (facts only)
+example
+invalid
+test