# Common Bubble.io API workflow names to probe.
# Grouped by attack surface. Add your own via `run workflows analyze --wordlist file.txt`.

# — Authentication
login
signin
sign_in
signup
sign_up
register
create_account
authenticate
auth
logout
sign_out

# — Password management (⚠ temp-password exploit Tier 3.4)
set_password
change_password
reset_password
request_password_reset
forgot_password
send_password_reset_email
send_password_reset
password_reset
set_temp_password
set_temporary_password
assign_temp_password
generate_temp_password
temporary_password

# — Account lifecycle
create_user
update_user
delete_user
admin_create_user
admin_delete_user
admin_update_user
change_email
change_email_for_another_user
change_current_user
update_email
confirm_email
verify_email
send_confirmation_email

# — Tokens / 2FA / magic link
generate_token
validate_token
check_token
refresh_token
invalidate_token
send_magic_link
send_magic_link_email
magic_link_login
check_2fa_token
validate_2fa_token
enable_2fa
disable_2fa
setup_2fa
verify_2fa

# — Uploads / files
upload
upload_file
upload_image
import_csv
export_csv

# — Admin / privileged
admin
admin_login
admin_reset
admin_reset_password
admin_export
admin_backup
admin_delete_all
impersonate
ping_admin

# — Communication
contact
send_email
send_message
send_notification
broadcast
notify
subscribe
unsubscribe
opt_in
opt_out

# — OAuth / external auth
oauth_login
oauth_callback
oauth_token
social_login

# — Webhooks / integrations
webhook
callback
stripe_webhook
github_webhook
zapier_webhook

# — Billing / commerce
charge
refund
cancel_subscription
upgrade_plan
downgrade_plan

# — Misc common names
healthcheck
ping
hello
test
debug
status
