I asked this same question[0] on StackExchange earlier this year. It has been asked many times and it really comes down to considering a username a secret or no

I asked this same question[0] on StackExchange earlier this year. It has been asked many times and it really comes down to considering a username a secret or not. In B2B applications where there is no registration form, then the username is probably a secret. In B2C applications where anyone can register, then the username likely isn't a secret. Many of those applications have the concept of "mentions" by username so clearly the username is not considered a secret in that case. [0]: https://security.stackexchange.com/q/158075/11536 https://security.stackexchange.com/q/158075/11536