[JENKINS-56985] Jenkins is exposing credentials when no build steps but post build steps

While looking at console logs, in our case, it failed to delete the workspace and go to post build steps and run a command that contains credentials, the console logs expose the credentials instead of using ****.

I created a job that use credentials binding and no build steps but only post build step, in the post build step, I echo the credentials and it exposed them. It looks like any time when no actual build steps is run, the credentials are not hidden.

---
Originally reported by awong29, imported from: Jenkins is exposing credentials when no build steps but post build steps

• status: Open
  
• priority: Blocker
  
• component(s): credentials-binding-plugin, credentials-plugin
  
• label(s): plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 3
  
• imported: 2025-12-08
  

While looking at console logs, in our case, it failed to delete the workspace and go to post build steps and run a command that contains credentials, the console logs expose the credentials instead of using ****. 


I created a job that use credentials binding and no build steps but only post build step, in the post build step, I echo the credentials and it exposed them. It looks like any time when no actual build steps is run, the credentials are not hidden.

• environment: Jenkins 2.164.2, credentials-plugin 2.1.18 credentials-binding-plugin 1.18