The vulnerability stems from unencrypted storage of private keys in JiraStepsConfig.xml. Jenkins plugins typically use Java classes with DataBound setters/getters and XStream serialization for configuration. The functions responsible for setting the private key value (setPrivateKey()) and persisting the configuration (save()) would directly handle the plaintext storage. The advisory's explicit reference to JiraStepsConfig.xml and lack of encryption mechanism confirms these functions are involved in the insecure storage.