ok with the context the post makes a little more sense, and im willing to share a bit since the issue has been fixed. that specific person was able to call to api because of a lack of a check, and used Cyrillic letters to get that username. since their username had a cyrillic letter the profile page wouldn't work due to the url breaking.
talked to autoresponder on discord, theyre a real gem. i enjoyed the little mystery and stir they made here.