diff --git a/src/users.js b/src/users.js
index 871546be1..c67884088 100644
--- a/src/users.js
+++ b/src/users.js
@@ -91,7 +91,7 @@ function validateUsername(username) {
 
     if (constants.RESERVED_NAMES.indexOf(username) !== -1) return new BoxError(BoxError.BAD_FIELD, 'Username is reserved');
 
-    // also need to consider valid LDAP characters here (e.g '+' is reserved)
+    // also need to consider valid LDAP characters here (e.g '+' is reserved). apps like openvpn require _ to not be used
     if (/[^a-zA-Z0-9.-]/.test(username)) return new BoxError(BoxError.BAD_FIELD, 'Username can only contain alphanumerals, dot and -');
 
     // app emails are sent using the .app suffix