JuliusBrussee/caveman · error

secretbox: %s decrypted to an empty secret

Error message

secretbox: %s decrypted to an empty secret

What it means

The ciphertext in the configured environment variable decrypted successfully with secretbox but produced an empty plaintext secret. This guard in ResolveEnvironmentSecret rejects empty results because an empty secret is never a valid configuration: either the wrong ciphertext variable was set, or the secret was encrypted while empty.

Source

Thrown at shared/platform/secretbox/secretbox.go:185

	plain := strings.TrimSpace(os.Getenv(plaintextEnv))
	encoded := strings.TrimSpace(os.Getenv(ciphertextEnv))
	production := runtimeenv.IsProduction()
	if production && plain != "" {
		return "", fmt.Errorf("secretbox: production refuses plaintext %s; use %s", plaintextEnv, ciphertextEnv)
	}
	if encoded == "" {
		return plain, nil
	}
	wrapped, err := base64.StdEncoding.DecodeString(encoded)
	if err != nil {
		return "", fmt.Errorf("secretbox: %s is not valid base64", ciphertextEnv)
	}
	decrypted, err := Decrypt(wrapped)
	if err != nil {
		return "", fmt.Errorf("secretbox: decrypt %s: %w", ciphertextEnv, err)
	}
	if len(decrypted) == 0 {
		return "", fmt.Errorf("secretbox: %s decrypted to an empty secret", ciphertextEnv)
	}
	return string(decrypted), nil
}

View on GitHub (pinned to 766dce6b13)

Solutions

1. Re-encrypt a non-empty secret value and set the ciphertext environment variable to the new base64 payload
2. Verify the ciphertext env var name was not typo'd or swapped with another secret's variable
3. Check that the plaintext used when encrypting was not an empty or whitespace-only string

When it happens

Trigger: Thrown at shared/platform/secretbox/secretbox.go:185 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@766dce6b13 (2026-08-18). Data as JSON: /api/errors/12a0b7867b632fc7. Report an issue: GitHub.