Jenkins, like a zillion other developer-oriented tools, should never be deployed Internet-facing. Reflection attacks inside an enterprise are handled by HR. :) -- Harald Koch chk at pobox.com