Maybe it's something to do with a MIME sniffing attack. The user profile URL may be detected as a different MIME type by the browser based on the extension: https://gitlab.com/myname.js
I'm not sure how one could exploit it though...
I'm not sure how one could exploit it though...
[1]: https://docs.microsoft.com/en-us/previous-versions/windows/i...
Update: tested this link in FireFox 92 - it still performs sniffing in 2021: http://www.debugtheweb.com/test/mime/script.asp (based on the content, not extension)