Currently, it is possible and even very well likely to unintentionally print credentials obtained with the vault plugin to the jenkins log. As a user of this plugin I would want the vault plugin to behave like the credentials binding plugin https://wiki.jenkins-ci.org/display/JENKINS/Credentials+Binding+Plugin and mask any passwords from the log.
Our team would be willing to provide a PR.