Global variable password values exposed with REST expand=variableContext

http://server:8085/rest/api/latest/plan/PROJECTKEY-PLANKEY/JOBKEY?expand=variableContext

This occurs even if logged in with just use authority. Given you made passwords not visible with build results, it seems strange they are exposed this way.