Description
First off, I think this is a great package!
The only thing that stood out to me as a bit strange was the naming of the rule, PasswordExposed.
We chatted about this briefly on Twitter, but I'll expand a little bit more here.
If you look at Laravel's built-in validation rules, they are all named after the valid state of the field, rather than the invalid state. E.g. email, string, date. Additionally, the example custom Rule in the Laravel docs that validates that a field is all uppercase characters is called Uppercase.
I think this package would have greater symmetry with Laravel's own rules if was named PasswordNotExposed (or NotPwned 😂)
Obviously this is a pretty fundamental change, so you may like to consider keeping a PasswordExposed class that extends PasswordNotExposed to maintain backwards compatibility (I'm assuming that would work?)
I'm happy to submit a PR if you like this idea, but given that it's renaming the main file of the package, I figured you might want your own name on that commit :)