What went wrong
Every test here ends with an optional board. You finish a run, type a nickname, and your score stays there for the next person to see. There is no account and no login, and that is on purpose. We think a leaderboard should cost you five seconds, not a signup form.
It also means the nickname box is the only place on the site where one visitor writes something every other visitor sees. In August 2026, somebody used it to post a Korean insult aimed at a stranger's mother. It sat on the reaction time board until someone spotted it by eye.
The filter that let it through was a single regular expression holding eleven banned words. It failed in two ways:
- The words in that insult were not on the list.
- Even if they had been, the phrase had a space in the middle. That was enough to slip past a match on the raw text.
The second failure is the more important one. Adding eleven more words would not have fixed it. A space, a dot or a stretched vowel walks around a raw text match no matter how long the list gets.
The list is the small half of the problem
The new checker folds the nickname before it looks at it. Folding means stripping out or evening out everything that does not change the meaning:
- Full-width characters become ordinary ones.
- Letters go to lower case.
- Digits and symbols that stand in for letters are turned back into those letters.
- Every space, dot, underscore and emoji is dropped.
- A run of the same character is squeezed down to one.
Only then does the check run.
After folding, the insult that got through becomes one unbroken string. So do a dozen other spellings of it that nobody had to list by hand. Spaced out, dotted, padded with symbols or stretched, they all fold to the same thing. The list did get longer, but that is not the main change. What changed is how much each entry now covers.
This is the general shape of the problem. A blocklist grows one word at a time, while the ways around it multiply with every trick you combine. Answering each new trick with a longer list is a slow way to lose. In our view, cleaning up the input first is the only part that keeps up.
Blocking too much is the expensive mistake
The opposite mistake gets far less attention. If a filter rejects a harmless nickname, that person gets bounced with no explanation. They assume the site is broken and leave. They will not write in to complain, so we would never find out.
English has a famous example. The town of Scunthorpe was blocked for years by filters that found a rude word inside its name. Penistone had the same problem, and so did anyone named Cockburn.
Korean has a worse version of this trap. The language builds words by stacking syllables, so everyday words often contain a rude pair of syllables by accident. Several ordinary Korean nicknames carry a crude piece inside them just because of how the syllables line up. One of them just means "the loner king", and another means "I guess I'm a fool".
So the checker keeps a second list of known safe words. It strips those out of the folded text before the ban check runs, and that order matters more than it looks. An earlier version treated a safe word as a pass for the whole nickname. Anyone could add a harmless word to an insult and sail through. Removing the safe pieces instead leaves the rest of the text exposed, so that trick does not work.
When someone reports that a normal nickname was refused, we grow the safe list rather than shrink the banned one. We would rather miss an insult than silently reject a real person.
The trap in Korean initials
Korean writers often shorten a phrase to its first consonants, and that is a common way to write swear words. The obvious response is to reduce every nickname to its first consonants and check that too.
That is a trap. Reducing full syllables to their first consonants throws away the information that made them innocent. The Korean word for watermelon reduces to exactly the same consonant pair as one of the most common swear words. The words for hands and feet, and for firefighter, start with that same pair. A filter built that way would reject watermelon.
So the checker only compares first consonants when the nickname was typed as bare consonants in the first place. Someone who types two consonants is shortening something. Someone who types a real word is writing a real word, and it stays a real word.
Why the list is not in your browser
It would be friendlier to check the nickname while you type, before you press the button. But that means sending the banned words to your browser. That would publish a map of exactly what to avoid, and the person who would find it most useful is somebody probing the filter.
So the check runs on the server, the only place that can actually refuse a submission. A refused nickname comes back with its own status code, separate from the one for length and format errors. The page turns that into a clear message asking for a different name, not a generic failure. You find out right away. You just do not find out what the list contains.
What we are not pretending to do
A determined person can still get past this filter. We left three gaps open on purpose.
First, a filler syllable in the middle of a Korean swear word beats the fold. Closing that gap would mean breaking every syllable into letters and dropping the vowels. That starts rejecting ordinary names and popular musicians, and we think the over-blocking would cost more than the leak.
Second, Korean swear words spelled in the Latin alphabet are not on the list. Those letter sequences show up inside ordinary names from other languages, and the false alarms arrive faster than the real hits.
Third, nothing here catches an insult that uses no banned word at all, which covers most of the creative ones.
The final defense is a person reading the board and deleting the entry, and that is what happened in August. A filter's job is to stop the accidental encounter. It is not there to win an argument with somebody who has decided to be unpleasant.
Frequently asked questions
My nickname was refused, but it is not offensive. What now?
Email ysc9550@gmail.com with the nickname, and we will add it to the safe list. That is a real fix, not a polite reply. We treat a false rejection as a bug, because the person it happens to has no way of knowing why.
Can I get an entry removed from the board?
Yes. Email the same address with the test and the nickname. We remove abusive entries whether or not anyone reports them. But a person checks the boards on no fixed schedule, so a report is faster.
Why not use a moderation API instead of writing this?
A hosted service would classify better, especially phrasing that uses no banned word. But it would also send every nickname visitors type to an outside company. It would add a network call to a submission path that currently touches nothing outside this site, and it would cost money per request. For a nickname box, we did not think the trade was worth it.