Step to replicate

1. Create two variables passworder and Passworder (notice p with caps)
2. Run a customize build overridden the contents of the field
3. While the fields remains hidden in the metadata as expected, the variable with capital P has it values revealed in the build summary see screenshot revealed.jpg
4. However, if the build is run as customized but with the values not changed, the fields remained hidden

I believe the class com.atlassian.bamboo.util.PasswordMaskingUtils should be Masked