I'm currently doing security research on the dangers of using default or well known 'secrets' for applications.
To test how big of an issue this actually is, I decided to download local copies of the 'large' stack-exchange websites and wrote some scripts that went through the data to extract strings which match a specific pattern.
This yielded around 15k possible unique secrets so far (it's still running, as of writing, I don't have the strongest computer, I also did this for some few thousand files on GitHub, leading to even more results). Which leaves me with the following question:
How ethical is it to publish such a list on the internet, alongside a tool which lets you test (locally) if your application is prone to such an attack, using said wordlist?
I've seen lots of wordlists published online, there's even entire dedicated GitHub repositories to this. If I were to publish the wordlist, it wouldn't have any personal information attached to it, but I'm still not entirely sure how ethical it would be.