We have a pipeline that uses the credentials binding plugin.  When a password, say SEKRIT, within the credentials binding closure is echo'd with surrounding whitespace, it is masked as ****.  However, if it is in the middle of a long string, especially a string of the form "--some-arg=foo –password=SEKRIT", the password is not masked.