...
The variable used is $config['encryption_key'] which by default is set to 'open-audit'.
NOTE - If you change this key after you have created some credentials, those credentials will be unusable (they will not be able to be decrypted). You should first export them, delete them, change the encryption key, then import them.