Review suggestion: mention local nonce path

> do we maybe also want to mention the specific path where the local
> nonce is kept?

docs/faq.rst

@@ -717,7 +717,7 @@ Borg uses :ref:`AES-CTR encryption <borg_security_critique>`. An
 essential part of AES-CTR is a sequential counter that must **never**
 repeat. If the same value of the counter is used twice in the same repository,
 an attacker can decrypt the data. The counter is stored in the home directory
-of each user as well as in the repository. When creating a new archive borg uses
+of each user (under $HOME/.config/borg/security) as well as in the repository. When creating a new archive borg uses
 the highest of the two values. The value of the counter in the repository may be
 higher than your local value if another user has created an archive more recently
 than you did.