According to the Guide:
If an environment variable for a password is provided, Duplicacy will always take it. The table below shows the name of the environment variable for each kind of password. Note that if the storage is not the default one, the storage name will be included in the name of the environment variable (in uppercase). For example, if your storage name is b2, then the environment variable should be named DUPLICACY_B2_PASSWORD.
The Web UI allows characters in storage names that are not allowed in environment variable names, e.g. -. So if a storage is named xxx-b2, what are the corresponding non-default environment variable names for the passwords, since DUPLICACY_XXX-B2_PASSWORD would not be legal?