# X-POSURE Path/Endpoint Wordlist
# Common paths for sensitive file discovery
# Lines starting with # are comments

# Environment files
/.env
/.env.local
/.env.development
/.env.development.local
/.env.test
/.env.test.local
/.env.production
/.env.production.local
/.env.staging
/.env.example
/.env.sample
/.env.bak
/.env.backup
/.env.old

# Configuration files
/config.json
/config.yaml
/config.yml
/config.xml
/config.ini
/config.php
/config.js
/config.ts
/configuration.json
/settings.json
/settings.yaml
/settings.yml
/app.config
/web.config
/appsettings.json
/appsettings.Development.json
/appsettings.Production.json

# Secrets/Credentials
/secrets.json
/secrets.yaml
/secrets.yml
/credentials.json
/credentials.yaml
/credentials.xml
/auth.json
/keys.json
/private.key
/private.pem
/id_rsa
/id_rsa.pub
/id_dsa
/id_ecdsa
/id_ed25519

# Version Control
/.git
/.git/config
/.git/HEAD
/.git/index
/.git/logs/HEAD
/.git/logs/refs/heads/master
/.git/logs/refs/heads/main
/.git/objects
/.git/refs
/.gitignore
/.gitattributes
/.gitmodules
/.gitlab-ci.yml
/.github
/.github/workflows
/.github/CODEOWNERS
/.svn
/.svn/entries
/.svn/wc.db
/.hg
/.hgignore
/.bzr

# Cloud credentials
/.aws/credentials
/.aws/config
/.azure/credentials
/.azure/config
/gcp-key.json
/google-credentials.json
/service-account.json
/firebase-adminsdk.json
/firebase.json
/.gcloud/credentials
/terraform.tfvars
/terraform.tfstate
/.terraform

# Package managers
/package.json
/package-lock.json
/yarn.lock
/npm-shrinkwrap.json
/composer.json
/composer.lock
/requirements.txt
/Pipfile
/Pipfile.lock
/pyproject.toml
/poetry.lock
/Gemfile
/Gemfile.lock
/go.mod
/go.sum
/Cargo.toml
/Cargo.lock
/pom.xml
/build.gradle
/build.gradle.kts
/settings.gradle

# API Documentation
/swagger.json
/swagger.yaml
/swagger.yml
/openapi.json
/openapi.yaml
/openapi.yml
/api-docs
/api-docs.json
/api/docs
/api/swagger
/api/openapi
/v1/swagger.json
/v2/swagger.json
/v1/docs
/v2/docs
/graphql
/graphiql
/playground

# Admin/Debug endpoints
/admin
/admin/
/administrator
/manage
/manager
/dashboard
/panel
/control
/console
/debug
/debug/vars
/debug/pprof
/phpinfo.php
/info.php
/test.php
/actuator
/actuator/health
/actuator/info
/actuator/env
/actuator/configprops
/actuator/beans
/actuator/mappings
/actuator/heapdump
/actuator/threaddump
/metrics
/health
/healthz
/ready
/readyz
/status
/server-status
/server-info
/.well-known/health
/trace
/env

# Backups
/backup
/backup/
/backups
/backup.zip
/backup.tar
/backup.tar.gz
/backup.sql
/backup.sql.gz
/dump.sql
/dump.sql.gz
/database.sql
/database.sql.gz
/db.sql
/db_backup.sql
/site.sql
/data.sql
/*.bak
/*.backup
/*.old
/*.orig
/*.save
/www.zip
/site.zip
/source.zip

# Logs
/logs
/log
/logs/
/log/
/access.log
/error.log
/debug.log
/application.log
/app.log
/server.log
/laravel.log
/storage/logs

# CI/CD
/Jenkinsfile
/Dockerfile
/docker-compose.yml
/docker-compose.yaml
/.dockerignore
/kubernetes
/k8s
/helm
/Chart.yaml
/values.yaml
/.gitlab-ci.yml
/.travis.yml
/.circleci/config.yml
/.github/workflows/ci.yml
/.github/workflows/main.yml
/bitbucket-pipelines.yml
/azure-pipelines.yml
/appveyor.yml
/cloudbuild.yaml
/buildspec.yml

# IDE/Editor
/.idea
/.vscode
/.vscode/settings.json
/.vscode/launch.json
/.editorconfig
/.project
/.classpath
/*.swp
/*.swo
/*~

# Web server configs
/.htaccess
/.htpasswd
/nginx.conf
/httpd.conf
/apache.conf
/web.xml
/server.xml

# Robots/Sitemap
/robots.txt
/sitemap.xml
/sitemap_index.xml
/sitemap.xml.gz
/sitemap-index.xml
/humans.txt
/.well-known/security.txt
/security.txt

# Common directories
/api
/api/
/api/v1
/api/v2
/api/v3
/v1
/v2
/v3
/wp-admin
/wp-content
/wp-includes
/wp-config.php
/administrator
/joomla
/drupal
/magento
/laravel
/artisan
/vendor
/node_modules
/bower_components
/public
/static
/assets
/dist
/build
/uploads
/files
/media
/tmp
/temp
/cache
