# Add sensitive paths here, one per line
# Example:
# /admin-panel/
# /hidden-login
# /internal/api/debug

# ── Admin Panels ─────────────────────────────────────────────────
/admin/
/admin/login
/admin/login.php
/admin/index.php
/admin/dashboard
/admin/panel
/admin/controlpanel
/admin/cp
/admin/manage
/admin/console
/admin/admin.php
/admin/admin.html
/admin/admin.asp
/admin/admin.aspx
/admin/admin.jsp
/admin/admin/
/admin/account/
/admin/home/
/admin/portal/
/admin/signin
/admin/site/
/admin/system/
/admin/user/
/admin/users/
/admin/backend/
/admin/access/
/admin/config/
/admin/settings/
/admin/setup/
/admin/tools/
/admin/logs/
/admin/stats/
/admin/report/
/admin/reports/
/admin/maintenance/
/admin/db/
/admin/database/
/admin/sql/
/admin/phpmyadmin/
/admin/phpMyAdmin/
/admin/myadmin/
/admin/mysql/
/admin/pma/
/admin/webadmin/
/administrator/
/administrator/index.php
/administrator/login
/administrator/login.php
/administrator/admin/
/administrators/
/administration/
/administrador/
/admin-panel/
/admin-login/
/admin-area/
/admin-console/
/admin-portal/
/admin-backend/
/admin1/
/admin2/
/admin3/
/adm/
/adm/admloginuser.asp
/adm/index.php
/adm/login.php
/siteadmin/
/siteadmin/login.php
/siteadmin/index.php
/webadmin/
/webadmin/login.php
/webadmin/index.php
/panel/
/panel/login
/panel/admin
/cpanel/
/controlpanel/
/control-panel/
/control/
/manager/
/manager/html
/management/
/manage/
/manage/login
/wp-admin/
/wp-admin/admin.php
/wp-admin/install.php
/wp-admin/setup-config.php
/wp-login.php
/wp-config.php
/wp-config.php.bak
/wp-config.php.old
/wp-config.php.orig
/wp-config.php.save
/wp-config.php~
/wp-config-sample.php
/wp-content/
/wp-includes/
/wp-json/
/wp-json/wp/v2/users
/xmlrpc.php
/joomla/administrator/
/administrator/manifests/
/phpmyadmin/
/phpMyAdmin/
/phpMyAdmin/index.php
/phpmyadmin/index.php
/pma/
/myadmin/
/mysql/
/mysqladmin/
/mysqlmanager/
/dbadmin/
/db/
/database/
/sql/
/sqlmanager/
/SQLiteManager/
/sqlitemanager/
/sqlite/
/pgadmin/
/pgadmin4/
/adminer/
/adminer.php
/filemanager/
/filemanager/dialog.php
/elfinder/
/elfinder/elfinder.html
/tinymce/plugins/filemanager/
/fckeditor/
/ckeditor/

# ── Login Pages ──────────────────────────────────────────────────
/login
/login.php
/login.asp
/login.aspx
/login.jsp
/login.html
/login/
/login/admin
/login/index.php
/login/login.php
/login-admin/
/user/login
/users/login
/user/signin
/users/signin
/account/login
/accounts/login
/auth/login
/auth/signin
/signin
/signin.php
/signin/
/sign-in
/sign-in/
/secure/login
/secure/
/member/login
/members/login
/members/
/member/
/portal/
/portal/login
/portal/index.php
/customer/login
/customers/login
/staff/login
/employee/login
/employees/login
/user-login/
/userlogin/
/sso/
/sso/login
/saml/
/saml/login
/oauth/
/oauth/authorize
/oauth/token

# ── API Endpoints ────────────────────────────────────────────────
/api/
/api/v1/
/api/v2/
/api/v3/
/api/v4/
/api/v1/users
/api/v1/user
/api/v1/admin
/api/v1/config
/api/v1/settings
/api/v1/token
/api/v1/tokens
/api/v1/auth
/api/v1/login
/api/v1/register
/api/v1/password
/api/v1/reset
/api/v1/keys
/api/v1/key
/api/v1/secrets
/api/v1/health
/api/v1/status
/api/v1/info
/api/v1/debug
/api/v1/test
/api/v1/logs
/api/v1/metrics
/api/v2/users
/api/v2/admin
/api/v2/config
/api/v2/token
/api/v2/auth
/api/v2/debug
/api/v2/health
/api/v2/metrics
/api/internal/
/api/internal/debug
/api/internal/config
/api/internal/users
/api/internal/admin
/api/private/
/api/private/admin
/api/admin/
/api/admin/users
/api/admin/config
/api/admin/settings
/api/debug/
/api/test/
/api/secret/
/api/health
/api/healthz
/api/health-check
/api/status
/api/info
/api/version
/api/docs
/api/swagger
/api/swagger.json
/api/swagger.yaml
/api/openapi.json
/api/openapi.yaml
/api/graphql
/api/explorer
/graphql
/graphql/
/graphiql
/graphql-explorer
/playground
/api-docs
/api-docs/
/swagger
/swagger/
/swagger-ui
/swagger-ui.html
/swagger-ui/
/swagger.json
/swagger.yaml
/openapi.json
/openapi.yaml
/redoc
/redoc/
/docs/api
/docs/swagger
/v1/
/v2/
/v3/
/v1/api/
/v2/api/
/rest/
/rest/api/
/restapi/
/jsonapi/
/json/
/rpc/
/rpc/api
/xmlrpc/
/xmlrpc.php
/soap/
/wsdl
/wsdl/
/.well-known/
/.well-known/security.txt
/.well-known/openid-configuration
/.well-known/jwks.json
/.well-known/oauth-authorization-server

# ── Config & Env Files ───────────────────────────────────────────
/.env
/.env.local
/.env.dev
/.env.development
/.env.test
/.env.staging
/.env.prod
/.env.production
/.env.backup
/.env.bak
/.env.old
/.env.orig
/.env.example
/.env.sample
/.env.template
/.env.default
/.env.copy
/.env~
/.env.1
/.env.2
/.env.save
/env
/env.php
/env.js
/.envrc
/config.php
/config.php.bak
/config.php.old
/config.php~
/config.inc.php
/config.inc
/config.ini
/config.yml
/config.yaml
/config.json
/config.xml
/config.toml
/config.cfg
/config.conf
/config.config
/config/
/config/config.php
/config/database.php
/config/app.php
/config/mail.php
/config/secrets.php
/config/config.yml
/config/config.yaml
/config/config.json
/config/config.xml
/config/production.json
/config/development.json
/config/local.json
/config/default.json
/configuration.php
/configuration.ini
/configuration.yml
/configuration.yaml
/configuration.xml
/settings.php
/settings.py
/settings.ini
/settings.yml
/settings.yaml
/settings.json
/settings.xml
/settings/
/settings/settings.php
/app/config/
/app/config/config.php
/app/config/parameters.yml
/application.properties
/application.yml
/application.yaml
/application-dev.properties
/application-prod.properties
/bootstrap.php
/bootstrap.ini
/composer.json
/composer.lock
/package.json
/package-lock.json
/yarn.lock
/Gemfile
/Gemfile.lock
/Pipfile
/Pipfile.lock
/requirements.txt
/requirements.dev.txt
/pyproject.toml
/setup.py
/setup.cfg
/Makefile
/Dockerfile
/docker-compose.yml
/docker-compose.yaml
/docker-compose.override.yml
/.dockerignore
/Vagrantfile
/Procfile
/.travis.yml
/.github/
/.github/workflows/
/.circleci/config.yml
/nginx.conf
/apache.conf
/.htaccess
/.htpasswd
/web.config
/web.config.bak
/php.ini
/php.ini.bak
/.user.ini
/php-fpm.conf
/uwsgi.ini
/gunicorn.conf
/supervisord.conf
/supervisord.conf.bak
/my.cnf
/my.ini
/postgresql.conf
/pg_hba.conf
/redis.conf
/mongod.conf

# ── Source & Version Control ─────────────────────────────────────
/.git/
/.git/HEAD
/.git/config
/.git/index
/.git/COMMIT_EDITMSG
/.git/packed-refs
/.git/logs/HEAD
/.git/refs/heads/master
/.git/refs/heads/main
/.git/info/
/.git/info/exclude
/.git/objects/
/.gitignore
/.gitconfig
/.gitmodules
/.gitattributes
/.svn/
/.svn/entries
/.svn/wc.db
/.hg/
/.hg/hgrc
/.bzr/
/.cvs/
/CVS/
/.DS_Store
/Thumbs.db
/.idea/
/.vscode/
/.project
/.classpath
/.settings/
/nbproject/
/.editorconfig
/.eslintrc
/.eslintrc.js
/.eslintrc.json
/.babelrc
/.prettierrc
/tsconfig.json
/jsconfig.json
/webpack.config.js
/vite.config.js
/rollup.config.js
/next.config.js
/nuxt.config.js
/.npmrc
/.yarnrc
/.ruby-version
/.python-version
/.node-version
/Jenkinsfile
/.ansible/
/ansible.cfg
/inventory
/playbook.yml

# ── Backup & Old Files ───────────────────────────────────────────
/backup/
/backup/backup.sql
/backup/backup.tar.gz
/backup/backup.zip
/backup/db.sql
/backup/database.sql
/backup/site.zip
/backup/files.tar.gz
/backups/
/bak/
/old/
/old/index.php
/archive/
/archives/
/temp/
/tmp/
/temp/backup/
/tmp/backup/
/dump/
/dump.sql
/db.sql
/database.sql
/data.sql
/site.sql
/wp.sql
/wordpress.sql
/backup.sql
/backup.tar
/backup.tar.gz
/backup.zip
/site.tar.gz
/site.zip
/files.zip
/www.zip
/web.zip
/html.zip
/public.zip
/logs.zip
/index.php.bak
/index.php.old
/index.php~
/index.html.bak
/index.html.old
/index.bak
/home.php.bak
/default.php.bak
/1.php
/2.php
/test.php
/test.html
/test.asp
/test.aspx
/test/
/testing/
/dev/
/development/
/staging/
/stage/
/demo/
/sample/
/example/
/draft/

# ── Log & Debug Files ────────────────────────────────────────────
/logs/
/log/
/logs/access.log
/logs/error.log
/logs/debug.log
/logs/app.log
/logs/application.log
/logs/system.log
/logs/auth.log
/logs/security.log
/logs/php_error.log
/logs/apache_access.log
/logs/apache_error.log
/logs/nginx_access.log
/logs/nginx_error.log
/logs/mysql.log
/logs/db.log
/log/access.log
/log/error.log
/log/debug.log
/log/app.log
/log/auth.log
/log/security.log
/error.log
/access.log
/debug.log
/app.log
/application.log
/system.log
/server.log
/php_error.log
/php-errors.log
/phperror.log
/laravel.log
/storage/logs/laravel.log
/storage/logs/
/var/log/apache2/access.log
/var/log/nginx/access.log
/debug/
/debug.php
/debug.asp
/debug.html
/debug/info
/debug/config
/debug/routes
/debug/phpinfo
/phpinfo.php
/phpinfo.html
/info.php
/info.html
/server-info
/server-status
/?debug=true
/?test=true
/?phpinfo=1
/.well-known/security.txt

# ── Cloud & Infrastructure ───────────────────────────────────────
/.aws/
/.aws/credentials
/.aws/config
/aws-credentials
/aws.config
/.azure/
/.gcloud/
/.boto
/credentials
/credentials.json
/credentials.xml
/credentials.yml
/credentials.yaml
/service-account.json
/serviceaccount.json
/gcp-credentials.json
/google-credentials.json
/terraform.tfstate
/terraform.tfstate.backup
/terraform.tfvars
/.terraform/
/.terraform.lock.hcl
/ansible/
/ansible/inventory
/ansible/hosts
/inventory/hosts
/k8s/
/kubernetes/
/helm/
/charts/
/.kube/
/.kube/config
/kubeconfig
/kube.config
/cluster.yml
/values.yaml
/secrets.yaml
/secrets.yml
/secrets.json
/secret.yaml
/secret.json

# ── CI/CD & Deployment ───────────────────────────────────────────
/deploy/
/deploy.php
/deploy.sh
/deployer.php
/deployment/
/release/
/releases/
/build/
/builds/
/dist/
/.deploy/
/pipeline/
/ci/
/.ci/
/artifacts/
/artifact/

# ── Database & Storage ───────────────────────────────────────────
/db/
/database/
/databases/
/sqlite.db
/database.db
/app.db
/data.db
/users.db
/site.db
/.sqlite
/db.sqlite
/db.sqlite3
/database.sqlite
/database.sqlite3
/data/
/data/users.json
/data/config.json
/data/db.json
/data/database.json
/uploads/
/upload/
/uploads/config.php
/files/
/file/
/media/
/static/
/assets/
/public/
/storage/
/store/
/stores/

# ── Exposed Panels & Services ────────────────────────────────────
/jenkins/
/jenkins/login
/jenkins/api/
/jenkins/script
/jenkins/scriptText
/jenkins/manage
/jenkins/credentials/
/sonarqube/
/sonar/
/grafana/
/grafana/login
/grafana/api/
/kibana/
/elasticsearch/
/elasticsearch/_cat/
/elasticsearch/_cluster/
/elasticsearch/_nodes/
/_cat/
/_cluster/health
/_nodes/stats
/solr/
/solr/admin/
/mongo/
/mongodb/
/redis/
/memcached/
/rabbitmq/
/rabbitmq/api/
/activemq/
/activemq/admin/
/zookeeper/
/kafka/
/consul/
/consul/ui/
/consul/v1/
/vault/
/vault/v1/
/etcd/
/prometheus/
/prometheus/api/
/prometheus/graph
/alertmanager/
/jaeger/
/zipkin/
/nagios/
/icinga/
/zabbix/
/cacti/
/munin/
/prtg/
/netdata/
/portainer/
/portainer/#/
/rancher/
/traefik/
/traefik/api/
/traefik/dashboard/
/haproxy/
/haproxy/stats
/nginx/status
/nginx-status
/fpm-status
/php-fpm/status
/server-status
/server-info
/status
/health
/healthz
/readyz
/livez
/ping
/metrics
/actuator/
/actuator/health
/actuator/info
/actuator/env
/actuator/configprops
/actuator/beans
/actuator/mappings
/actuator/loggers
/actuator/threaddump
/actuator/heapdump
/actuator/metrics
/actuator/trace
/actuator/httptrace
/actuator/scheduledtasks
/actuator/sessions
/actuator/shutdown
/spring/
/spring/actuator/

# ── Mail & Communication ─────────────────────────────────────────
/mail/
/webmail/
/webmail/index.php
/roundcube/
/squirrelmail/
/horde/
/zimbra/
/mailadmin/
/postfixadmin/
/phpmyemail/
/smtp/
/imap/
/mailconfig/
/mailman/
/listinfo/
/phplist/

# ── CMS Specific ─────────────────────────────────────────────────
# WordPress
/wp-cron.php
/wp-activate.php
/wp-mail.php
/wp-signup.php
/wp-trackback.php
/wp-content/debug.log
/wp-content/uploads/
/wp-content/plugins/
/wp-content/themes/
/wp-content/backup-db/
/wp-snapshots/
/wp-admin/admin-ajax.php
/wp-admin/options-general.php

# Joomla
/administrator/
/configuration.php
/htaccess.txt
/README.txt
/LICENSE.txt
/web.config.txt
/cache/
/components/
/modules/
/plugins/
/templates/
/tmp/
/logs/

# Drupal
/CHANGELOG.txt
/INSTALL.txt
/INSTALL.mysql.txt
/INSTALL.pgsql.txt
/UPGRADE.txt
/README.txt
/sites/default/settings.php
/sites/default/files/
/modules/
/themes/
/profiles/

# Django
/django-admin/
/__debug__/
/static/admin/
/media/admin/

# Laravel
/storage/
/storage/app/
/storage/logs/
/storage/framework/
/bootstrap/cache/
/.env.example

# Symfony
/app/config/
/app/config/parameters.yml
/app/cache/
/app/logs/
/web/config.php
/web/app_dev.php
/web/app_test.php
/app_dev.php
/config.php
/check.php

# Ruby on Rails
/rails/info/properties
/rails/info/routes
/rails/mailers
/cable/
/sidekiq/
/resque/

# ── Default & Index Pages ────────────────────────────────────────
/default/
/default.php
/default.asp
/default.aspx
/default.html
/index.php
/index.asp
/index.aspx
/index.jsp
/index.bak
/home/
/home.php
/main.php
/main/
/welcome/
/welcome.php
/start/
/init/
/init.php
/install/
/install.php
/install/install.php
/installer/
/installer/install.php
/setup/
/setup.php
/setup.html
/upgrade/
/upgrade.php
/update/
/update.php
/update/update.php
/migrate/
/migration/
/maintenance/
/maintenance.php
/offline/
/offline.html
/under-construction/
/coming-soon/

# ── Sensitive Documents ──────────────────────────────────────────
/robots.txt
/sitemap.xml
/sitemap.xml.gz
/sitemap_index.xml
/crossdomain.xml
/clientaccesspolicy.xml
/security.txt
/humans.txt
/ads.txt
/app-ads.txt
/wpad.dat
/autodiscover/autodiscover.xml
/autodiscover.xml
/autoconfig/
/mail/config-v1.1.xml
/webdav/
/webdav
/dav/
/davfs/
/jkstatus/
/jk-status/
/readme.txt
/README.txt
/README.md
/CHANGELOG
/CHANGELOG.txt
/CHANGELOG.md
/LICENSE
/LICENSE.txt
/VERSION
/version.txt
/version.json
/release-notes.txt
/release_notes.txt
/todo.txt
/TODO
/TODO.txt
/notes.txt
/NOTES
/password.txt
/passwords.txt
/passwd
/shadow
/etc/passwd
/etc/shadow
/proc/self/environ
/proc/version
/proc/cmdline

# ── Internal & Hidden ────────────────────────────────────────────
/internal/
/internal/api/
/internal/api/debug
/internal/admin/
/internal/config/
/internal/logs/
/internal/health
/internal/status
/internal/metrics
/private/
/private/api/
/private/admin/
/private/config/
/private/logs/
/secret/
/secret/api/
/hidden/
/hidden-admin/
/hidden-login/
/system/
/system/admin/
/system/config/
/system/logs/
/sys/
/sysadmin/
/sysinfo/
/server/
/server/admin/
/server/config/
/server/info/
/network/
/network/admin/
/infra/
/infra/admin/
/ops/
/devops/
/sre/
/platform/
/platform/admin/
/core/
/core/admin/
/core/config/
/engine/
/engine/admin/
/api/private/
/api/internal/
/api/secret/
/api/hidden/
/api/test/
/api/debug/
/api/v0/
/api/beta/
/api/alpha/
/api/legacy/
/api/old/
/api/2/
/api/3/
/backend/
/backend/admin/
/backend/api/
/backend/config/
/backend/login/
/dev/null
/dev/config
/dev/debug
/dev/api
/test/config
/test/debug
/test/api
/staging/config
/staging/debug
/staging/api

# ── Security & Auth ──────────────────────────────────────────────
/auth/
/auth/admin/
/auth/token
/auth/refresh
/auth/logout
/auth/reset
/auth/callback
/auth/verify
/auth/register
/auth/signup
/auth/forgot-password
/auth/change-password
/auth/2fa
/auth/mfa
/auth/otp
/authentication/
/authorization/
/access/
/access/admin/
/access/control/
/permissions/
/roles/
/acl/
/token/
/tokens/
/jwt/
/keys/
/keys/public
/keys/private
/keys/api
/apikey/
/apikeys/
/api-key/
/api-keys/
/.ssh/
/.ssh/id_rsa
/.ssh/id_rsa.pub
/.ssh/known_hosts
/.ssh/authorized_keys
/.ssl/
/.ssl/server.crt
/.ssl/server.key
/certs/
/certs/server.crt
/certs/server.key
/ssl/
/ssl/server.crt
/ssl/server.key
/tls/
/tls/server.crt
/tls/server.key
/pki/
/ca/
/ca/cert.pem
/ca/key.pem

# ── E-commerce & Payment ─────────────────────────────────────────
/cart/
/checkout/
/checkout/admin/
/order/
/orders/
/payment/
/payment/admin/
/payments/
/billing/
/billing/admin/
/invoice/
/invoices/
/transaction/
/transactions/
/store/admin/
/shop/admin/
/product/admin/
/products/admin/
/catalog/admin/
/inventory/admin/

# ── User Management ──────────────────────────────────────────────
/users/
/user/
/users/admin
/users/list
/users/export
/users/import
/users/dump
/user/admin
/user/list
/user/profile
/user/settings
/user/account
/accounts/
/account/
/accounts/admin
/accounts/list
/profile/
/profiles/
/member/admin/
/members/admin/
/customer/
/customers/
/customers/admin/
/customers/list
/subscribers/
/subscribers/list
/export/users
/export/users.csv
/export/users.json
/export/data
/export/db
/download/users
/download/data

# ── Monitoring & Metrics ─────────────────────────────────────────
/monitor/
/monitoring/
/dashboard/
/dashboards/
/analytics/
/analytics/admin/
/stats/
/statistics/
/reports/
/report/
/telemetry/
/trace/
/tracing/
/profiler/
/profiling/
/flame/
/heap/
/goroutines/
/pprof/
/debug/pprof/
/debug/vars
/debug/gc
/debug/requests
/debug/events
/expvar/
/metrics/
/metrics/json
/metrics/prometheus
