# Tier B Hidden Path Wordlist (SecLists-derived, community extensible)
# Loaded by gossan-hidden directory brute-force probe.
# Add custom paths below — one per line, lines starting with # are ignored.

# Admin / management
admin
administrator
adminpanel
admincp
admins
adminarea
adminconsole
admin_dashboard
admin/login
admin/auth
admin/user
backend
backoffice
cms
cpanel
controlpanel
dashboard
manager
manage
mgmt
moderator
panel
portal
root
superadmin
webadmin
wp-admin

# API / docs
api
api/v1
api/v2
api/v3
api/v4
api/docs
api-docs
api/swagger
api/openapi
api/graphql
api/rest
api/json
api/xml
api/soap
apidocs
graphql
graphiql
playground
swagger
swagger-ui
swagger.json
swagger/v1/swagger.json
swagger/v2/swagger.json
openapi.json
openapi.yaml
redoc
/docs
/v1
/v2
/v3
/rest
/rest/v1
/rest/v2
/soap
/wsdl

# Dev / CI / test
.git
.git/config
.git/HEAD
.git/index
.svn
.hg
.bzr
.env
.env.local
.env.production
.env.staging
.env.development
.env.test
.env.backup
.env.old
.env.example
.htaccess
.htpasswd
.dockerignore
.dockerenv
jenkins
teamcity
travis
github
.gitlab-ci.yml
.circleci
codecov
sonarqube
nexus
artifactory
sonar
/test
/tests
/testing
/dev
/development
/staging
/stage
/beta
/alpha
/demo
/sandbox
/preview
/canary
/build
/dist
/release
/releases
/tmp
/temp
/cache

# Config / secrets
config
config.php
config.yml
config.yaml
config.json
config.xml
config.ini
config.cfg
configuration
settings
settings.py
settings.yml
settings.json
web.config
application.yml
application.properties
application.yaml
appsettings.json
appsettings.Development.json
secrets.yml
secrets.json
credentials
keys
token
tokens
oauth
oidc
jwt

# Backup / dumps
backup
backups
backup.zip
backup.tar.gz
backup.tar
backup.sql
backup.db
dump
 dumps
dump.sql
db.sql
data.sql
 database.sql
backup.sql
archive
archives
old
bak
.bak
.save
.swp
~
.orig
.copy

# Source / files
src
source
sources
app
apps
lib
libs
vendor
node_modules
package.json
composer.json
requirements.txt
Gemfile
go.mod
Cargo.toml
pom.xml
build.gradle
Makefile
README.md
CHANGELOG.md
LICENSE

# Logs / debug
logs
log
error.log
access.log
debug.log
php_errors.log
stderr.log
stdout.log
console
debug
error
trace
profiler
phpinfo.php
info.php
server-status
server-info

# Database / storage
db
database
databases
mysql
postgres
mongodb
redis
elasticsearch
sqlite
couchdb
firebase
graphql

# Mail / messaging
mail
email
webmail
roundcube
squirrelmail
postfix
dovecot
smtp
imap
pop3

# Network / infra
status
health
healthz
ready
readyz
alive
ping
metrics
prometheus
grafana
kibana
sentry
newrelic
datadog
nagios
zabbix
munin
cacti

# CMS / frameworks
wordpress
wp-content
wp-includes
wp-json
joomla
administrator
drupal
laravel
symfony
django
rails
flask
express
nextjs
nuxt
angular
react
vue
strapi
ghost
magento
prestashop
shopify

# Security / auth
auth
authenticate
authorization
login
logout
signin
signout
register
signup
password
reset-password
forgot-password
change-password
verify
verification
2fa
mfa
sso
saml
ldap
oauth2
callback

# Help / docs
help
docs
documentation
wiki
faq
support
tutorial
guide
manual
api-docs
reference

# Files / uploads
upload
uploads
files
file
media
assets
static
images
img
css
js
scripts
download
downloads
public
private
internal
restricted
secure

# Misc
robots.txt
sitemap.xml
sitemap_index.xml
.crossdomain.xml
.security.txt
.well-known
.well-known/openid-configuration
.well-known/oauth-authorization-server
.well-known/jwks.json
.well-known/apple-app-site-association
.well-known/assetlinks.json
.well-known/change-password
.well-known/security.txt
.well-known/traffic-advice
