JIRA Client stores usernames and passwords in the config.xml file in the JIRAClient folder in the user's home directory (e.g. "%userprofile%/JIRAClient/" on a Windows PC). The password is encrypted, however the file itself is not. If the file is not protected well, it can be used by anybody who has access to it to connect to JIRA.
To our security conscious customers, we recommend using WebLogin feature, available in JIRA Client v. 3.8 and later. This way JIRA Client will not be storing any login information locally, but rather connecting to an active JIRA sessions managed by your web browser.
Please read more about this feature here: Connect with Web Browser