Hello Angela,

• are these really plain text or do you get a crypted/obsfucated value?
• We use the EnvInject plugin to inject passwords and they are shown in the history crypted/obsfucated with Jenkins' secret key.

Hi Mirko,

The values are really plain text. From your reply, I'm thinking that we could do a test installing the EnvInject plugin and see if we get any better. So far, we mask passwords using the MaskPassword plugin and it seems that EnvInject provides the same functionality and more.

Thanks for your reply, I'll let you know if it works.

This really looks more like a bug in Mask Passwords, which should not store passwords on disk in plain text.

anbeque Could you please mention the version of Mask Passwords plugin you are using?

I have got the same error. I'm using View Cloner Plugin, that requires a user and a password. In the Build History, when we compare two build histories, it shows the password in plain text. I've installed Purge Build History to delete all build histories, but it is still possible to access the plain password through Job Config History.

Yes, the job config history still shows the passwords that are input into another plugin's configuration.  This is bad. I am an admin and my admin password is clearly visible for whoever is able to browse job config history.