Re: Downvote bots. I can’t say they’re necessarily bots, but my instance has scripts that flag accounts that exclusively give out downvotes and then bans them. That’s about the best I can do, at present, to counter those for my users.

It is usually not a good idea to specify what your exact metrics are for a ban. A bad actor could see that and then get around it by randomly upvoting something every now and then.

There is also the risk of homograph attacks. The link below is for domain name encoding via IDN, but the same applies to usernames. You could easily impersonate another user by having chars that look similar.

https://en.wikipedia.org/wiki/IDN_homograph_attack