Set auth_verbose_passwords to 'no'. 'plain' and 'yes' write attempted passwords in cleartext to the log, including the real passwords of users who only made a typo. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>