pg_stat_statements: password in command is not obfuscated

Hello,

It seems that passwords used in commands are not removed when caught by
pg_stat_statements
(they are not "normalized" being utility statements)

exemple:
alter role tt with password '123';

select query from public.pg_stat_statements
where query like '%password%';

query
----------------------------------------
alter role tt with password '123';

Do you think its a bug ?

Regards
PAscal

--
Sent from: http://www.postgresql-archive.org/PostgreSQL-general-f1843780.html