While looking at console logs, in our case, it failed to delete the workspace and go to post build steps and run a command that contains credentials, the console logs expose the credentials instead of using ****.

I created a job that use credentials binding and no build steps but only post build step, in the post build step, I echo the credentials and it exposed them. It looks like any time when no actual build steps is run, the credentials are not hidden.