{"record":{"id":"066d7e13f532acbb","repo":"ruvnet/ruflo","slug":"invalid-password-length","errorCode":"INVALID_PASSWORD_LENGTH","errorMessage":"Password length must be at least 16 characters","messagePattern":"Password length must be at least 16 characters","errorType":"exception","errorClass":"CredentialGeneratorError","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/security/src/credential-generator.ts","lineNumber":125,"sourceCode":"  constructor(config: CredentialConfig = {}) {\n    this.config = {\n      passwordLength: config.passwordLength ?? 32,\n      apiKeyLength: config.apiKeyLength ?? 48,\n      secretLength: config.secretLength ?? 64,\n      passwordCharset: config.passwordCharset ??\n        CHARSETS.UPPERCASE + CHARSETS.LOWERCASE + CHARSETS.DIGITS + CHARSETS.SPECIAL,\n      apiKeyCharset: config.apiKeyCharset ?? CHARSETS.URL_SAFE,\n    };\n\n    this.validateConfig();\n  }\n\n  /**\n   * Validates configuration parameters.\n   */\n  private validateConfig(): void {\n    if (this.config.passwordLength < 16) {\n      throw new CredentialGeneratorError(\n        'Password length must be at least 16 characters',\n        'INVALID_PASSWORD_LENGTH'\n      );\n    }\n\n    if (this.config.apiKeyLength < 32) {\n      throw new CredentialGeneratorError(\n        'API key length must be at least 32 characters',\n        'INVALID_API_KEY_LENGTH'\n      );\n    }\n\n    if (this.config.secretLength < 32) {\n      throw new CredentialGeneratorError(\n        'Secret length must be at least 32 characters',\n        'INVALID_SECRET_LENGTH'\n      );\n    }","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/security/src/credential-generator.ts#L107-L143","documentation":"CredentialGenerator's constructor runs validateConfig() and refuses passwordLength < 16 with CredentialGeneratorError INVALID_PASSWORD_LENGTH. The floor is deliberate: the module is a security boundary for machine-generated credentials, and shorter outputs would undercut the entropy it promises.","triggerScenarios":"new CredentialGenerator({ passwordLength: 12 }) or any value below 16; a config file or env var where the length field is absent/zero and coerces low; porting settings from another generator with an 8/12-character convention.","commonSituations":"Legacy config copied forward with short lengths; YAML/env numeric fields parsed as strings sneaking past comparisons; someone 'tuning' length down for readability or DB column limits.","solutions":["Set passwordLength >= 16 (24 is a comfortable choice), or omit it to use the built-in default","Validate numeric config from env/files before constructing, converting and clamping explicitly","If a shorter value is truly required for a non-security token, use a different utility — do not lower this floor"],"exampleFix":"// before\nnew CredentialGenerator({ passwordLength: 12 });\n\n// after\nnew CredentialGenerator({ passwordLength: 24 });","handlingStrategy":"validation","validationCode":"const cfg = { passwordLength: Number(process.env.PW_LENGTH ?? 24) };\nif (!(cfg.passwordLength >= 16)) {\n  throw new Error(`passwordLength must be >= 16, got ${cfg.passwordLength}`);\n}\nnew CredentialGenerator(cfg);","typeGuard":"function isCredentialGeneratorError(e: unknown, code?: string): boolean {\n  return e instanceof Error && e.name === 'CredentialGeneratorError'\n    && (code === undefined || (e as { code?: string }).code === code);\n}","tryCatchPattern":"try {\n  return new CredentialGenerator(cfg);\n} catch (e) {\n  if (isCredentialGeneratorError(e, 'INVALID_PASSWORD_LENGTH')) {\n    return new CredentialGenerator({ ...cfg, passwordLength: 16 });\n  }\n  throw e;\n}","preventionTips":["Validate numeric security config once at config-load time with clear context","Omit length fields to accept the module defaults rather than copying old numbers","Add a config-schema check in CI so short lengths fail the build, not production"],"tags":["security","credentials","configuration","validation"],"backgroundTag":"config-validation-failed","analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-08-22T09:17:25.309Z"}