This happened while I was working for my company's client, I was analysing why the build failed and I had ctrl+c the build files(.zip) to my local webserver to see what was wrong. After sometime I was replying an official email via outlook. But somehow those copied build files (.zip) ended up in this email. I realised this only it was too late. Yes config files had clear text passwords.