{"record":{"id":"2d7e667e6a28c4ff","repo":"projectdiscovery/nuclei","slug":"could-not-marshal-inline-secrets-w","errorCode":null,"errorMessage":"could not marshal inline secrets: %w","messagePattern":"could not marshal inline secrets: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nuclei/main.go","lineNumber":894,"sourceCode":"// Returns the path to the temp file or empty string if no secrets found.\nfunc processInlineSecretsFromProfile(profilePath string, options *types.Options) (string, error) {\n\tdata, err := os.ReadFile(profilePath)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"could not read profile file: %w\", err)\n\t}\n\n\tvar profile profileSecrets\n\tif err := yaml.Unmarshal(data, &profile); err != nil {\n\t\treturn \"\", fmt.Errorf(\"could not parse profile YAML: %w\", err)\n\t}\n\n\tif profile.Secrets == nil {\n\t\treturn \"\", nil\n\t}\n\n\tsecretsData, err := yaml.Marshal(profile.Secrets)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"could not marshal inline secrets: %w\", err)\n\t}\n\n\ttempDir := filepath.Join(os.TempDir(), \"nuclei-secrets\")\n\tif err := os.MkdirAll(tempDir, 0700); err != nil {\n\t\treturn \"\", fmt.Errorf(\"could not create temp directory: %w\", err)\n\t}\n\n\ttempFile, err := os.CreateTemp(tempDir, \"inline-secrets-*.yaml\")\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"could not create temp secrets file: %w\", err)\n\t}\n\tdefer func() {\n\t\t_ = tempFile.Close()\n\t}()\n\n\tif _, err := tempFile.Write(secretsData); err != nil {\n\t\t_ = tempFile.Close()\n\t\t_ = os.Remove(tempFile.Name())","sourceCodeStart":876,"sourceCodeEnd":912,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/cmd/nuclei/main.go#L876-L912","documentation":"yaml.Marshal of the extracted `secrets:` value failed (cmd/nuclei/main.go:894) while preparing the temporary secrets file. Because the section was decoded into interface{}, this only occurs when the data contains node shapes yaml.v3 cannot encode — typically complex mapping keys (sequences/mappings used as keys). The wrapped %w error names the exact marshal fault; it is rare.","triggerScenarios":"A secrets section using complex keys (e.g. `? [a,b]: value`), merge keys/anchors producing exotic node types, or other structures the encoder refuses.","commonSituations":"Over-creative hand-written secrets YAML converted from JSON or other tooling; copy-paste of example configs with unusual key styles.","solutions":["Simplify the secrets section to plain string-keyed maps and lists","Remove complex keys, merge keys (<<), and anchors from the secrets block","Move secrets to a standalone secrets file passed via the secrets-file option instead of inline in the profile"],"exampleFix":"# before\nsecrets:\n  ? [aws, key]\n  : value\n\n# after\nsecrets:\n  - id: aws_key\n    value: value","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"secretsData, err := yaml.Marshal(profile.Secrets)\nif err != nil {\n    return fmt.Errorf(\"inline secrets use unsupported YAML shapes (complex keys?): %w\", err)\n}","preventionTips":["Keep the secrets section to plain string-keyed maps and lists","Avoid merge keys, anchors, and complex keys in secret blocks","Prefer a dedicated secrets file over inline secrets for exotic structures"],"tags":["go","nuclei","yaml","configuration","secrets"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}