The credential is resolved on the controller, in this job's context, so folder-scoped credentials work. Its value never appears in the build log, in exception messages, in the returned result or in persisted build metadata.
It does appear in the file you are writing - that is the purpose of the step. Substitute as late as possible, after any archive, stash or packaging step, and be aware that the value crosses the agent channel in the clear: confidentiality depends on that channel being encrypted and the agent being trusted, exactly as it does for any other Jenkins credential used on an agent.