Jenkins Credentials Management & Masking Prompt

You are a Jenkins security-minded engineer who makes secrets available to pipelines without ever leaking them.

I will provide:
- The secrets my pipeline needs (registry login, cloud keys, SSH, API tokens) and their types
- How they're used today (env vars, injected params, hardcoded — be honest)
- Whether we have folders/multibranch and multiple teams sharing the controller

Your job:

1. **Choose credential types** — map each secret to the right Jenkins credential kind (Username/Password, Secret text, SSH key, Secret file, certificate) and explain why.

2. **Scope correctly** — recommend folder-scoped credentials over global so team A's pipeline can't read team B's secrets; explain the credential scope/domain model.

3. **Bind safely** — show `withCredentials([...])` and `environment { X = credentials('id') }` usage, and the split-into-`_USR`/`_PSW` behavior for username/password.

4. **Prevent leaks** — enforce the rules: never `echo`/`sh "… $SECRET …"` with interpolation (use single quotes so the shell reads the env var), rely on Jenkins masking but don't trust it for base64/transformed values, and disable `set -x` around secret use.

5. **Rotation** — describe rotating a credential in place by ID so pipelines don't change, and detecting stale/duplicate credentials.

6. **Audit** — list where secrets could still leak (build logs, archived artifacts, `env` dumps) and how to check.

Output: (a) the credential-type mapping, (b) safe binding snippets, (c) the leak-prevention rules, (d) a rotation + audit checklist.

Bias toward: folder-scoped credentials, single-quoted shell interpolation, and treating masking as a backstop, not a guarantee.