{"record":{"id":"0ac714c19acd0eae","repo":"ruvnet/ruflo","slug":"invalid-secret-length","errorCode":"INVALID_SECRET_LENGTH","errorMessage":"Secret length must be at least 32 characters","messagePattern":"Secret length must be at least 32 characters","errorType":"exception","errorClass":"CredentialGeneratorError","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/security/src/credential-generator.ts","lineNumber":139,"sourceCode":"   * Validates configuration parameters.\n   */\n  private validateConfig(): void {\n    if (this.config.passwordLength < 16) {\n      throw new CredentialGeneratorError(\n        'Password length must be at least 16 characters',\n        'INVALID_PASSWORD_LENGTH'\n      );\n    }\n\n    if (this.config.apiKeyLength < 32) {\n      throw new CredentialGeneratorError(\n        'API key length must be at least 32 characters',\n        'INVALID_API_KEY_LENGTH'\n      );\n    }\n\n    if (this.config.secretLength < 32) {\n      throw new CredentialGeneratorError(\n        'Secret length must be at least 32 characters',\n        'INVALID_SECRET_LENGTH'\n      );\n    }\n  }\n\n  /**\n   * Generates a cryptographically secure random string using rejection sampling\n   * to eliminate modulo bias.\n   *\n   * @param length - Length of the string to generate\n   * @param charset - Character set to use\n   * @returns Random string\n   */\n  private generateSecureString(length: number, charset: string): string {\n    const charsetLength = charset.length;\n    const result = new Array(length);\n","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/security/src/credential-generator.ts#L121-L157","documentation":"The third leg of validateConfig(): secretLength < 32 throws CredentialGeneratorError INVALID_SECRET_LENGTH. This governs signing secrets/HMAC material, where 32 bytes of entropy is the standard minimum for modern security claims.","triggerScenarios":"new CredentialGenerator({ secretLength: 24 }); a shared config object reused for passwords, keys, and secrets with one short length field; downgrading secret length to match an external system's input limit.","commonSituations":"One-size config objects applied to all three credential kinds; porting configs from tools with weaker defaults; a downstream system rejecting long secrets and prompting a reduction.","solutions":["Set secretLength >= 32, or omit it for the built-in default","Give secrets their own config field rather than sharing the password length","If a consumer caps secret size, fix that consumer — short HMAC secrets are a real vulnerability"],"exampleFix":"// before\nnew CredentialGenerator({ secretLength: 24 });\n\n// after\nnew CredentialGenerator({ secretLength: 32 });","handlingStrategy":"validation","validationCode":"const MIN_SECRET = 32;\nif (cfg.secretLength !== undefined && cfg.secretLength < MIN_SECRET) {\n  throw new Error(`secretLength must be >= ${MIN_SECRET}, got ${cfg.secretLength}`);\n}\nnew CredentialGenerator(cfg);","typeGuard":"function isCredentialGeneratorError(e: unknown, code?: string): boolean {\n  return e instanceof Error && e.name === 'CredentialGeneratorError'\n    && (code === undefined || (e as { code?: string }).code === code);\n}","tryCatchPattern":"try {\n  return new CredentialGenerator(cfg);\n} catch (e) {\n  if (isCredentialGeneratorError(e, 'INVALID_SECRET_LENGTH')) {\n    return new CredentialGenerator({ ...cfg, secretLength: 32 });\n  }\n  throw e;\n}","preventionTips":["Give signing secrets their own config field, never shared with password length","Fix downstream consumers that cap secret size rather than reducing entropy","Validate config in one place at startup so the throw includes deployment context"],"tags":["security","secrets","configuration","validation"],"backgroundTag":"config-validation-failed","analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-08-22T09:17:25.309Z"}