it would be good to look for ".lower()" squatters if you host on an idn.

if you have a software system that contains two different implementations of IDNA 2003 processing user input" Is that a real thing though? Is someone doing that?

Is that a real thing though?

[dead]

[dead]

[flagged]

That's a little over the top. string.lower() is not a security vulnerability. Not following the spec is the security vulnerability.