Bamboo sets a local proxy for Git connections. When a test plan is configured to use a username and password it appears that these are not only saved in plaintext, but are passed as plaintext to the Git proxy and also saved in the log files.

At the least, these passwords should never be saved to log files.