Jenkins MaskPassword: what is `var`?

Question

I want to mask certain strings from being logged in the console when a Jenkins pipeline executes.

Read How can I make groovy on Jenkins mask the output of a variable the same way it does for credentials? and https://www.jenkins.io/doc/pipeline/steps/mask-passwords/ (the latter leaves something to be desired)

Essentially, this works. The following pipeline is derived from the answer at How can I make groovy on Jenkins mask the output of a variable the same way it does for credentials? :

pipeline {
  agent any
    stage( "1" ) {
      steps {
        script {
          def a_secret = "super_password"
          wrap([$class: 'MaskPasswordsBuildWrapper',
                varPasswordPairs: [[password: "${a_secret}",
                                    var: 'PASSWORD']]]) {
           echo "a_secret: ${sa_username}"
           // echo "PASSWORD: ${PASSWORD}"
          }
        }
      }
    }
  }
}

When the above executes, the following gets logged in the console:

a_secret: ********

...which is as desired.

Question: What does var: 'PASSWORD' refer to? In the linked Stack Overflow Q&A, I don't see PASSWORD being defined or used anywhere.

If I add echo "PASSWORD: ${PASSWORD}", then I get the error groovy.lang.MissingPropertyException: No such property: PASSWORD for class: groovy.lang.Binding