Error statement is not logged, only *password---- with many dashes

Question

I use extended events to store database errors, like this:

CREATE EVENT SESSION [ErrorCapture] 
ON SERVER 
ADD EVENT sqlserver.error_reported
(
    ACTION
    (
        sqlserver.client_hostname,
        sqlserver.database_id,
        sqlserver.sql_text,
        sqlserver.username
    )
    WHERE 
    (
        [severity] >= (11)
    )
) 
ADD TARGET package0.asynchronous_file_target
(
    SET filename='J:\ServerXmlOutput\ErrorCapture.xel'
)
WITH 
(
    MAX_MEMORY=4096 KB,
    EVENT_RETENTION_MODE=ALLOW_SINGLE_EVENT_LOSS,
    MAX_DISPATCH_LATENCY=10 SECONDS,
    MAX_EVENT_SIZE=0 KB,
    MEMORY_PARTITION_MODE=NONE,
    TRACK_CAUSALITY=OFF,
    STARTUP_STATE=ON
);

This works great. Sometimes, the SQL statement (sql_text) that is logged contains only the following:

*password------------------------------------------------------------------------------------------------------------------------------------------

What is the reason, and how do I find out which statement is causing this?

Answer 1

It is confirmed that this is caused by a column called password or an argument @password.

A column called abc_password does not cause this behaviour.