# RTExit Wordlist Reference

Keep wordlists local and versioned by source. Avoid running large lists without explicit rate limits.

| Category | Common Source | Use Case |
|---|---|---|
| Subdomains | SecLists DNS | Passive/active DNS discovery |
| Web content | SecLists Discovery/Web-Content | Directory and file discovery |
| API routes | SecLists API lists | API endpoint discovery |
| Usernames | SecLists Usernames | Authorized password-policy testing only |
| Passwords | rockyou or client-provided | Only when credential testing is approved |
| XSS markers | Custom harmless markers | Context validation |

Recommended paths can be overridden in `_rtexit/config.user.toml`.

