The solution to this is extremely simple: don't validate usernames, period.
The rationale is from an article someone linked here ("Falsehoods Programmer's Believe About Names"):
> Anything someone tells you is their name is—by definition—an appropriate identifier for them.
If you try to validate by checking for profanity, knowing full well that people can have names that contain profane substrings, I have a tongue-in-check message for you—you are a fucking asshole.
The rationale is from an article someone linked here ("Falsehoods Programmer's Believe About Names"):
> Anything someone tells you is their name is—by definition—an appropriate identifier for them.
If you try to validate by checking for profanity, knowing full well that people can have names that contain profane substrings, I have a tongue-in-check message for you—you are a fucking asshole.