On a scala of 0-10 how severe would you rate database credentials (root) in a jira ticket attachments

So i noticed some person attached example code that contain cleartext database credentials of a database. It’s actually even the root db user. How severe would for example a pentester rate this? Just out of interest

attachments code credentials cybersecurity database interest jira pentester rate root scala ticket