I found credentials-binding-plugin prints raw text when use secret text start with whitespace (like " secret") .

Here is my sample pipeline script:

node {
    withCredentials([string(credentialsId: 'SAMPLE_CREDENTIAL', variable: 'SAMPLE_CREDENTIAL')]) {
        sh 'echo $SAMPLE_CREDENTIAL'
    }
}

All output:

Started by user user
Running in Durability level: MAX_SURVIVABILITY
[Pipeline] node
Running on Jenkins in /var/jenkins_home/workspace/print_credential_pipeline
[Pipeline] {
[Pipeline] withCredentials
[Pipeline] {
[Pipeline] sh
[print_credential_pipeline] Running shell script
+ echo****
credential test
{{[Pipeline] }}}
[Pipeline] // withCredentials
{{[Pipeline] }}}
[Pipeline] // node
[Pipeline] End of Pipeline
Finished: SUCCESS