Well, for starters there are many tools to lookup if a username exists on websites and this would limit that endpoint of https://$DISCOURSE_FORUM/u/$USERNAME/. Since Discourse the default setup doesn’t limit viewing a users profile to only signed in users, this is kinda where I’m getting at.