As of 2020/09/01, all versions of Bagisto appear to leak database and email server credentials in the document root.