Constant EXAMPLE_PLACEHOLDER_PASSWORD 

pub const EXAMPLE_PLACEHOLDER_PASSWORD: &str = "replace-me-with-something-long";

The password script/config.example.toml ships, which no running server may keep.

The example is what script/install-selfsigned.sh copies into place and what the manual install in docs/deployment.md starts from, and the ACME section of that page leaves the certificate at the paths the example already names. So an unedited copy is a configuration a server starts on, and this password is published in the repository. Config::warnings reports it, the installer refuses to install a file that still carries it, and config::tests::the_shipped_example_configuration_is_valid pins that this is the string the example holds, so the two cannot drift apart. The installer’s own copy of the string is pinned to this constant by it_installer::the_placeholder_password_never_survives.