You don't even need to call out to an external API to get good coverage for this rule, in case you're averse to doing such a thing. You can just do a case-inse

You don't even need to call out to an external API to get good coverage for this rule, in case you're averse to doing such a thing. You can just do a case-insensitive match against this file that I compiled a while back: https://github.com/robsheldon/bad-passwords-index https://github.com/robsheldon/bad-passwords-index It includes the most commonly reused passwords according to in-the-wild breaches. I'm a bit embarrassed to see that it's been 2 years since the last update. I was thinking recently about updating this again. I think I'll do that.