Unfortunately I must use Typo3 at work, I know stupid idea, and they store the whole application in the web servers document root, so everything is public by default.
There's an extension to use a .env file for the configuration, but this extension also want this file in the root of the public folder. That's a very high security risk.
If you forget to disallow the access to it in the .htaccess or server configuration everyone can see your credentials and whatever else you store there.
Some time ago exactly this happens in my company. Purely accidental I found this security break and fixed it quickly. I can just hope it was not online for a long time, because inside the .env file where also hints where to find other scripts, password/user hints and other credentials.
But this shows why you should never put your .env file in a public accessable folder and it is highly risky to implement an extension (or library) that expects this file in the public folder by default.
Of course you can say it was the admin mistake to not forbid the access to this file. But this can happen very easily and your application should not rely on this, especially not for such a risky file. If you do it, that's a really bad design flaw and you should refactor it as soon possible.
I know that the Typo3 developers are not following modern development or design rules and uses a lot of old coding styles, but I'll try an issue for this.