I only skimmed the code, but when it's encrypted, is the only key/input that iv that you've got in the source there?
The passphrase and IV are used to encrypt/decrypt the data using the aes-256-cbc algorithm (https://github.com/reZach/my-budget/blob/master/app/crypto/c...).