Adam Jordan

The Jenkins LoadNinja Plugin stores LoadNinja API keys unencrypted in `config.xml` files on the Jenkins controller. This allows users with Item/Extended Read permission, or access to the Jenkins controller file system, to view the API keys. The vulnerable files are located on the Jenkins controller.

The Jenkins LoadNinja Plugin does not properly mask LoadNinja API keys as they are displayed on the job configuration form. This could allow attackers to observe and capture these keys.