CVE-2025-53666: Jenkins Dead Man's Snitch Plugin vulnerability stores tokens in plain text

The vulnerability lies in the Dead Man's Snitch Plugin's handling of the API token. The core of the issue is that the token is stored as a plain String field within the DeadMansSnitchNotifier class. Jenkins persists the configuration of build steps, including this notifier, in config.xml files. Due to the use of @DataBoundConstructor with a String type for the token, the token is written to the config.xml file without any encryption. This allows any user with read access to the job configuration or file system access to the Jenkins controller to view the token. The getToken() method also exposes this token in plain text, which can lead to it being displayed in the Jenkins UI. The perform method is the function that uses this unencrypted token to communicate with the Dead Man's Snitch service. The lack of use of Jenkins' Secret class for handling the token is the root cause of this vulnerability.