I can enter “pricing” and “contact” and get to at least the next step. I haven’t tried actually registering them. You should probably ban such things, maybe some others you’d like to reserve too.

I haven’t tried circumventing the client-side restrictions on which characters are allowed at all, but the content shown at pages like https://eagledial.com/robots.txt makes me wonder. I don’t imagine it lets me put just anything into the page, so it’s probably not an attack vector (e.g. being able to register .well-known/acme-challenge things and get a TLS certificate for the domain, or convincing Google that you own the site via a site verification page at /google*.html), but something to think about and be careful of.

All of your “Follow Us” links have an empty href.

Angular favicon.ico.

Yes, that's good feedback, thank you. As you noted we don't ban any names. It sounds like a good idea to block "special names".

https://github.com/shouldbee/reserved-usernames is a list that could be a good starting point

Interesting resource. I was surprised to see "m" as the only single-letter reserved name. Would've guessed at least "v" as well.

Why 'm' and 'v' ?

For services that put the username as a sub domain

m.example.com looks like a mobile URL for main site