Please do not report security vulnerabilities in public issues.
Report suspected vulnerabilities privately through the Jenkins security process:
https://www.jenkins.io/security/reporting/
Include the plugin version, Jenkins version, impact, reproduction steps, and a proposed mitigation when available. Do not include credentials or confidential IBM i data.