The configuration of Rundeck notifier in the System Configuration (/configure) has URL, Login and Password. The password is displayed in cleartext in the form. It should be hidden.
I was not able to find a rundeck notifier component while filing this bug. I put it under "other".