code: public boolean isMasked(final @CheckForNull ParameterValue value, 
              final @Nonnull String paramValueClassName) {
          
          // We always mask sensitive variables, the configuration does not matter in such case
          if (value != null && value.isSensitive()) {
              return true;
          }
          
          synchronized(this) {
              // Check if the value is in the cache
              if (paramValueCache_maskedClasses.contains(paramValueClassName)) {
                  return true;
              }
              if (paramValueCache_nonMaskedClasses.contains(paramValueClassName)) {
                  return false;
              }
           
              // Now guess
              boolean guessSo = guessIfShouldMask(paramValueClassName);
              if (guessSo) {
                  // We are pretty sure it requires masking
                  paramValueCache_maskedClasses.add(paramValueClassName);
                  return true;
              } else {
                  // It does not require masking, but we are not so sure
                  // The warning will be printed each time the cache is invalidated due to whatever reason
                  LOGGER.log(Level.WARNING, "Identified the {0} class as a ParameterValue class, which does not require masking. It may be false-negative", paramValueClassName);
                  paramValueCache_nonMaskedClasses.add(paramValueClassName);
                  return false;
              }
          }
      }
docs: Returns true if the specified parameter value class name corresponds to
  a parameter definition class name selected in Jenkins' main
  configuration screen.
  @param value Parameter value. Without it there is a high risk of false negatives.
  @param paramValueClassName Class name of the {@link ParameterValue} class implementation
  @return {@code true} if the parameter value should be masked.
  {@code false} if the plugin is not sure, may be false-negative especially if the value is {@code null}.
  @since TODO