Do you mean credentials that people add to their user account? (ex https://ci.jenkins.io/user/halkeye/credentials/)
Or users credentials added to the global credential management?
Cause if the first, then its a bug in git plugin and should properly reported and fixed.
But if its the second, there’s no way to filter them out, by design.
@MarkEWaite might be able to explain a bit better