rcon passwords sent in plain text

Connecting to rcon sends your password in plain text. I enabled rcon on a test server and wanted to be sure it was safe to use.

After enabling it I did a capture with wire-shark, and found my password was sent in plain text. I was unable to find any mention of this anywhere.

Please bind rcon to localhost by default or provide a fix.