Bitbucket OAuth Plugin stored a credential unencrypted in the global config.xml configuration file on the Jenkins master. This credential could be viewed by users with access to the master file system. Bitbucket OAuth Plugin now stores this credential encrypted.