Hello, It seems that passwords used in commands are not removed when caught by pg_stat_statements (they are not "normalized" being utility statements) exemple: alter role tt with password '123'; select query from public.pg_stat_statements where query like '%password%'; query ---------------------------------------- alter role tt with password '123'; Do you think its a bug ? Regards PAscal -- Sent from: http://www.postgresql-archive.org/PostgreSQL-general-f1843780.html