Regularly use Google Dorks on your own domain (e.g., site:yourwebsite.com "Index of" ) to see what the public can see. Conclusion
It is rarely a deliberate choice to publish passwords. Usually, it happens because of: index of password txt best