Oh yes this. It's so easy to critically fuck up an invite into an organisation. If you get typo the username you are potentially compromised. I've seen a couple of near misses on this already.
Note: the invite input box actually autocompletes ALL github usernames.
This can be vulnerable to "ticket trick" - often support/helpdesk sites are put on the main domain and have reply-to email addresses that will reflect the content back to the user requesting support. This can be used to sign up for slack, etc.
This is what I do but I really wish there was a better integration with auth providers and could use it for the invite. Would be nice to search my directory to type the email and confirm the name matches the email.
This is what GitLab does with their hosted AD/LDAP connector.
I’m in fear of mistyping something and inviting the wrong person.
Sorry, but string prefix search over a few hundred million entries is something you can do with the same performance using just postgres on a single server with just a few hours of dev time.
I've done it before, it's not as impressive as it seems.
With trigrams you can even do precise substring search on this scale with good performance.
Note: the invite input box actually autocompletes ALL github usernames.