{"record":{"id":"16b8210e06733475","repo":"vectordotdev/vector","slug":"secret-must-be-a-string","errorCode":null,"errorMessage":"secret must be a string","messagePattern":"secret must be a string","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/vector-vrl/functions/src/set_secret.rs","lineNumber":10,"sourceCode":"use vector_vrl_category::Category;\nuse vrl::prelude::*;\n\nfn set_secret(\n    ctx: &mut Context,\n    key: Value,\n    secret: Value,\n) -> std::result::Result<Value, ExpressionError> {\n    let key_str = key.as_str().expect(\"key must be a string\");\n    let secret_str = secret.as_str().expect(\"secret must be a string\");\n\n    ctx.target_mut()\n        .insert_secret(key_str.as_ref(), secret_str.as_ref());\n    Ok(Value::Null)\n}\n\n#[derive(Clone, Copy, Debug)]\npub struct SetSecret;\n\nimpl Function for SetSecret {\n    fn identifier(&self) -> &'static str {\n        \"set_secret\"\n    }\n\n    fn usage(&self) -> &'static str {\n        \"Sets the given secret in the event.\"\n    }\n","sourceCodeStart":1,"sourceCodeEnd":28,"githubUrl":"https://github.com/vectordotdev/vector/blob/3708c39b12a93212ed8b8d7510b4cc7769cb5864/lib/vector-vrl/functions/src/set_secret.rs#L1-L28","documentation":"The second guard in set_secret: secret.as_str().expect(\"secret must be a string\") (lib/vector-vrl/functions/src/set_secret.rs). The secret parameter is typed BYTES in the function signature, and the VRL compiler enforces this before execution, so the expect fires only if a non-string secret Value reaches the runtime helper — an internal invariant break rather than a normal user error.","triggerScenarios":"A compiled VRL program invoking set_secret with a secret Value that is not bytes (integer, object, null) at runtime — normally blocked at compile time; occurs with compiler bugs, version-skewed vector-vrl crates, or embeddings that call the helper directly.","commonSituations":"VRL compiler fuzzing/regressions; custom integrations invoking functions without the type-checking pass; partially upgraded workspaces mixing vector-vrl releases.","solutions":["Upgrade Vector/vector-vrl so compiler and built-ins match","Coerce secret values explicitly in VRL: set_secret(\"key\", to_string!(secret_value))","Embed via the standard compile-then-execute pipeline only","Report reproducible occurrences to vectordot/vector"],"exampleFix":"# before (vrl)\nset_secret(\"api_key\", secret)   # secret: any\n\n# after (vrl)\nset_secret(\"api_key\", to_string!(secret))","handlingStrategy":"type-guard","validationCode":"# Coerce the secret value to bytes before storing\nset_secret(\"name\", to_string!(secret_value))","typeGuard":"fn is_bytes(v: &vrl::value::Value) -> bool {\n    matches!(v, vrl::value::Value::Bytes(_))\n}","tryCatchPattern":null,"preventionTips":["Ensure secret sources (env, files) are read as strings in VRL","Compile-check the remap program before rollout","Keep vector-vrl versions consistent"],"tags":["vector","vrl","type-invariant","secrets","panic","internal"],"backgroundTag":"type-invariant-violation","analyzedSha":"3708c39b12a93212ed8b8d7510b4cc7769cb5864","analyzedAt":"2026-08-20T07:02:18.786Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}