“Don't forget to blacklist malicious usernames if you allow user-generated URLs” | Hacker News Reader