{"record":{"id":"12a0b7867b632fc7","repo":"JuliusBrussee/caveman","slug":"secretbox-s-decrypted-to-an-empty-secret","errorCode":null,"errorMessage":"secretbox: %s decrypted to an empty secret","messagePattern":"secretbox: (.+?) decrypted to an empty secret","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/secretbox/secretbox.go","lineNumber":185,"sourceCode":"\tplain := strings.TrimSpace(os.Getenv(plaintextEnv))\n\tencoded := strings.TrimSpace(os.Getenv(ciphertextEnv))\n\tproduction := runtimeenv.IsProduction()\n\tif production && plain != \"\" {\n\t\treturn \"\", fmt.Errorf(\"secretbox: production refuses plaintext %s; use %s\", plaintextEnv, ciphertextEnv)\n\t}\n\tif encoded == \"\" {\n\t\treturn plain, nil\n\t}\n\twrapped, err := base64.StdEncoding.DecodeString(encoded)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"secretbox: %s is not valid base64\", ciphertextEnv)\n\t}\n\tdecrypted, err := Decrypt(wrapped)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"secretbox: decrypt %s: %w\", ciphertextEnv, err)\n\t}\n\tif len(decrypted) == 0 {\n\t\treturn \"\", fmt.Errorf(\"secretbox: %s decrypted to an empty secret\", ciphertextEnv)\n\t}\n\treturn string(decrypted), nil\n}\n","sourceCodeStart":167,"sourceCodeEnd":189,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/766dce6b1394ebb56a3090748d5a0240a5aefb36/shared/platform/secretbox/secretbox.go#L167-L189","documentation":"The ciphertext in the configured environment variable decrypted successfully with secretbox but produced an empty plaintext secret. This guard in ResolveEnvironmentSecret rejects empty results because an empty secret is never a valid configuration: either the wrong ciphertext variable was set, or the secret was encrypted while empty.","triggerScenarios":"Thrown at shared/platform/secretbox/secretbox.go:185 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-encrypt a non-empty secret value and set the ciphertext environment variable to the new base64 payload","Verify the ciphertext env var name was not typo'd or swapped with another secret's variable","Check that the plaintext used when encrypting was not an empty or whitespace-only string"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"766dce6b1394ebb56a3090748d5a0240a5aefb36","analyzedAt":"2026-08-18T03:14:35.516Z","contentChangedAt":"2026-08-18T03:14:35.516Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}