A password manager's random password set off 35 Core Rule Set rules,
about 1 in 40 refused. The password fields the app exclusions name now
skip those rules on their paths: WordPress pwd, Drupal pass, MediaWiki
wpPassword, lgpassword and password, Mastodon's sign-in, sign-up,
password change, move and delete passwords, and Nextcloud's sign-in
password. Each field's test sends 2,000 random passwords from a fixed
seed, plus one rare password for each rule the 2,000 do not set off.
An SQL injection or a path traversal sent as a password now passes; a
script injection is still refused.
Model: opus-5-5
