Function default_sslmode 

pub(crate) fn default_sslmode(host: &str) -> SslMode

The default SslMode applied when a profile does not set sslmode.

Loopback hosts get Prefer so local Mz (which does not offer TLS) works without explicit config. Everything else gets Require — TLS is required but certificate verification is not. Users who want verification set sslmode = "verify-ca" or sslmode = "verify-full" explicitly.