{"record":{"id":"00844353019b4d0b","repo":"BerriAI/litellm","slug":"invalid-secret-name-secret-name-r","errorCode":null,"errorMessage":"Invalid secret_name {secret_name!r}","messagePattern":"Invalid secret_name (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/secret_managers/base_secret_manager.py","lineNumber":21,"sourceCode":"from typing import Any, Final\n\nimport httpx\n\nfrom litellm import verbose_logger\n\n_UNSAFE_SECRET_NAME_PATTERN: Final = re.compile(r\"(^|/)\\.\\.(/|$)|[\\x00-\\x1f\\x7f-\\x9f…

]\")\n\n\ndef raise_if_unsafe_secret_name(secret_name: str) -> None:\n    \"\"\"\n    Validate a secret name before it is used by a secret manager integration.\n\n    Rejects \"..\" only as a path segment (bounded by \"/\" or the start/end of the\n    string, e.g. \"../x\", \"x/..\", or exactly \"..\"), not as a plain substring, so\n    names like \"release-1.0..2\" are not rejected.\n    \"\"\"\n    if _UNSAFE_SECRET_NAME_PATTERN.search(secret_name):\n        raise ValueError(f\"Invalid secret_name {secret_name!r}\")\n\n\nclass BaseSecretManager(ABC):\n    \"\"\"\n    Abstract base class for secret management implementations.\n    \"\"\"\n\n    @abstractmethod\n    async def async_read_secret(\n        self,\n        secret_name: str,\n        optional_params: dict | None = None,\n        timeout: float | httpx.Timeout | None = None,\n    ) -> str | None:\n        \"\"\"\n        Asynchronously read a secret from the secret manager.\n\n        Args:","sourceCodeStart":3,"sourceCodeEnd":39,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/secret_managers/base_secret_manager.py#L3-L39","documentation":"Generic sentinel from the secret-name sanitizer raise_if_unsafe_secret_name: the name matched the unsafe pattern (a '..' path segment or a control character), so the secret manager refuses to resolve it. This is a path-traversal/invalid-input guard, not a provider error; the offending value is the secret_name argument itself.","triggerScenarios":"Thrown at litellm/secret_managers/base_secret_manager.py:21 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Pass a valid secret name: non-empty string matching the backend's naming rules (no illegal characters).","Trim whitespace and validate secret_name against the expected pattern before calling."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}