Error statement is not logged, only *password---- with many dashes I use extended events to store database errors, like this:

CREATE EVENT SESSION [ErrorCapture] 
ON SERVER 
ADD EVENT sqlserver.error_reported
(
    ACTION
    (
        sqlserver.client_hostname,
        sqlserver.database_id,
        sqlserver.sql_text,
        sqlserver.username
    )
    WHERE 
    (
        [severity] &gt;= (11)
    )
) 
ADD TARGET package0.asynchronous_file_target
(
    SET filename='J:\ServerXmlOutput\ErrorCapture.xel'
)
WITH 
(
    MAX_MEMORY=4096 KB,
    EVENT_RETENTION_MODE=ALLOW_SINGLE_EVENT_LOSS,
    MAX_DISPATCH_LATENCY=10 SECONDS,
    MAX_EVENT_SIZE=0 KB,
    MEMORY_PARTITION_MODE=NONE,
    TRACK_CAUSALITY=OFF,
    STARTUP_STATE=ON
);


This works great.
Sometimes, the SQL statement (sql_text) that is logged contains only the following:

*password------------------------------------------------------------------------------------------------------------------------------------------


What is the reason, and how do I find out which statement is causing this?
It is confirmed that this is caused by a column called password or an argument @password.  

A column called abc_password does not cause this behaviour.