"Username has already been taken" shown for invalid character in username
Someone tried to register for our GitLab instance using their email as their username. They were shown "username is already taken", so assumed that a user existed (e.g. maybe we'd created one for them through the API) and tried to get a "reset password" email. Since no user existed, they didn't get an email.
I see in the source that all validation errors are displayed as "Username is already taken", even when the username was not taken, as here. It would be ideal to show "Username is invalid" when the username is invalid, but as a temporary mitigation it might be quicker to change the string to "Username is already taken or invalid", so that the user at least knows there are two possibilities.
This is a fairly nasty UX trap: I can't see anything on the registration form that tells users the validity constraints on usernames, so someone following all directions can get stuck this way. I'd hope at least changing the string is a relatively quick partial fix.