pub const DEFAULT_PASSPHRASE_PATHS: &[&str];
Where to look for a passphrase file when none is given explicitly, most secure first: secret files mount-injected by the container, then the working directory.