Password parameters are stored as plain text in jobs' config and builds' history. They are accessible in:

• <job>/config.xml
• <job>/builds/<date>/build.xml

Cf. attached patches to fix that:

• PasswordParameterDefinition now inherits from SimpleParameterDefinition rather than StringParameterDefinition and uses a Secret to store the default password rather than a string.
• PasswordParameterValue now inherits from ParameterValue rather than StringParameterValue and uses Secret to store the password rather than a string.
• Backward compatibility kept.