{"record":{"id":"1c5c8f2302113aaa","repo":"windmill-labs/windmill","slug":"variable-remotepath-is-currently-secret-and-wil","errorCode":null,"errorMessage":"Variable ${remotePath} is currently secret and will be downgraded to non-secret: its value will be stored in plaintext","messagePattern":"Variable (.+?) is currently secret and will be downgraded to non-secret: its value will be stored in plaintext","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/src/commands/variable/variable.ts","lineNumber":301,"sourceCode":"    })\n  ) {\n    if (\n      !opts.yes &&\n      !(await Confirm.prompt({\n        message: `Variable already exist, do you want to update its value?`,\n        default: true,\n      }))\n    ) {\n      return;\n    }\n    if (isSecret === false) {\n      const existing = await wmill.getVariable({\n        workspace: workspace.workspaceId,\n        path: remotePath,\n        decryptSecret: false,\n      });\n      if (existing.is_secret) {\n        log.warn(\n          colors.yellow(\n            `Variable ${remotePath} is currently secret and will be downgraded to non-secret: its value will be stored in plaintext`\n          )\n        );\n      }\n    }\n    log.info(colors.bold.yellow(\"Updating variable...\"));\n    await wmill.updateVariable({\n      workspace: workspace.workspaceId,\n      path: remotePath,\n      alreadyEncrypted: false, // value from CLI is always plaintext\n      requestBody: {\n        value,\n        ...(isSecret !== undefined ? { is_secret: isSecret } : {}),\n        ...(opts.description !== undefined\n          ? { description: opts.description }\n          : {}),\n      },","sourceCodeStart":283,"sourceCodeEnd":319,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/cli/src/commands/variable/variable.ts#L283-L319","documentation":"Downgrade warning during variable add/update: the remote variable is currently secret, but the pushed definition has is_secret=false, so after the update its value will be stored in plaintext on the server. Shown after the update confirmation; the operation proceeds unless the user aborts.","triggerScenarios":"Thrown at cli/src/commands/variable/variable.ts:301 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Keep the variable secret in the pushed YAML to avoid plaintext storage","If plaintext is acceptable, no action — the warning is informational","Rotate the value afterwards if accidental exposure is a concern"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}