{"record":{"id":"525fdf9b69242ddd","repo":"moonD4rk/HackBrowserData","slug":"security-command-timed-out-after-s","errorCode":null,"errorMessage":"security command timed out after %s","messagePattern":"security command timed out after (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"masterkey/retriever_darwin.go","lineNumber":140,"sourceCode":"\t}\n\n\tkey, err := r.retrieveKeyOnce(storage)\n\tr.cache[storage] = securityResult{key: key, err: err}\n\treturn key, err\n}\n\nfunc (r *SecurityCmdRetriever) retrieveKeyOnce(storage string) ([]byte, error) {\n\tctx, cancel := context.WithTimeout(context.Background(), securityCmdTimeout)\n\tdefer cancel()\n\n\tvar stdout, stderr bytes.Buffer\n\tcmd := exec.CommandContext(ctx, \"security\", \"find-generic-password\", \"-wa\", strings.TrimSpace(storage)) //nolint:gosec\n\tcmd.Stdout = &stdout\n\tcmd.Stderr = &stderr\n\n\tif err := cmd.Run(); err != nil {\n\t\tif errors.Is(ctx.Err(), context.DeadlineExceeded) {\n\t\t\treturn nil, fmt.Errorf(\"security command timed out after %s\", securityCmdTimeout)\n\t\t}\n\t\t// `security` exits non-zero with empty stderr when the user denies the prompt or mistypes;\n\t\t// surface that instead of the cryptic \"exit status 128 ()\".\n\t\tstderrStr := strings.TrimSpace(stderr.String())\n\t\tif stderrStr == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"security command: %w (likely keychain access denied or wrong password)\", err)\n\t\t}\n\t\treturn nil, fmt.Errorf(\"security command: %w (%s)\", err, stderrStr)\n\t}\n\tif stderr.Len() > 0 {\n\t\treturn nil, fmt.Errorf(\"keychain: %s\", strings.TrimSpace(stderr.String()))\n\t}\n\n\tsecret := bytes.TrimSpace(stdout.Bytes())\n\tif len(secret) == 0 {\n\t\treturn nil, fmt.Errorf(\"keychain: empty secret for %s\", storage)\n\t}\n","sourceCodeStart":122,"sourceCodeEnd":158,"githubUrl":"https://github.com/moonD4rk/HackBrowserData/blob/0503d04d7a8d0379d060268a74f1b149e5a0aad5/masterkey/retriever_darwin.go#L122-L158","documentation":"The retriever shells out to `security find-generic-password -wa <storage>` with a context deadline; when cmd.Run fails because the context deadline was exceeded, it returns \"security command timed out after %s\" with the timeout duration. This replaces the raw context error with an actionable message.","triggerScenarios":"retrieveKeyOnce invoked with a context whose deadline elapses before the `security` command finishes; the keychain access prompt is shown and unanswered until the timeout fires.","commonSituations":"The user ignored or never saw the macOS keychain-access permission dialog, a headless/SSH session where the dialog can't be rendered, or an unusually slow system.","solutions":["Re-run interactively and accept the keychain access prompt for the calling binary","Pre-authorize the tool in Keychain Access (Access Control tab) so no prompt appears","Increase the deadline in the context passed to the retriever if the timeout is too short","Use the KeychainPasswordRetriever instead, which unlocks the keychain directly without prompting"],"exampleFix":"// before\nctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)\n// after\nctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)","handlingStrategy":"retry","validationCode":"if _, err := exec.LookPath(\"security\"); err != nil {\n\treturn errors.New(\"security CLI not available\")\n}\nif deadline, ok := ctx.Deadline(); ok && time.Until(deadline) < 5*time.Second {\n\treturn errors.New(\"context deadline too short for keychain prompt\")\n}","typeGuard":"func isSecurityTimeout(err error) bool {\n\treturn err != nil && strings.Contains(err.Error(), \"timed out after\")\n}","tryCatchPattern":"key, err := r.RetrieveKey(hints)\nif err != nil && strings.Contains(err.Error(), \"security command timed out\") {\n\t// prompt was likely unanswered; retry with longer deadline or password retriever\n\tkey, err = passwordRetriever.RetrieveKey(hints)\n}","preventionTips":["Give the context a generous deadline so the user can answer the prompt","Run interactively at least once to accept the access prompt","Prefer KeychainPasswordRetriever in headless environments"],"tags":["macos","keychain","timeout","subprocess","context"],"backgroundTag":"request-timeout","analyzedSha":"0503d04d7a8d0379d060268a74f1b149e5a0aad5","analyzedAt":"2026-09-06T13:38:28.707Z","contentChangedAt":"2026-09-06T13:38:28.707Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}