While investigating Private Topics Plugin - #109 by thoka I stumbled upon the fact, that a mention for a user in a restricted category is not reported, when the username contains uppercase letters. If I mention @SomeUser , the editor requests /composer/mentions.json?names[]=SomeUser&topic_id=10728 in the result the username is returned in lowercase, without user_reasons set. A query for the username in lowercase letters returns "user_reasons": {"someuser":"category"} . If I use lowercase letters for the usernames in the composer, warnings for people with not sufficient rights will be shown. If one use the autocompletion provided by the editor, the typed lowercase usernames will be replaced by uppercase names and therefore not reported.