I don’t know what specifically you’re speaking of, but for the stuff I know of, Mastodon uses WebFinger, which puts the important stuff inside /.well-known/, and .well-known should be blacklisted as a “username” in any of these sorts of systems, for this very reason. (
https://www.rfc-editor.org/rfc/rfc8615 specifies the /.well-known/ path prefix.)