{"record":{"id":"71b88373cda0aa81","repo":"netbirdio/netbird","slug":"invalid-pin-must-be-exactly-6-digits-71b883","errorCode":null,"errorMessage":"invalid pin: must be exactly 6 digits","messagePattern":"invalid pin: must be exactly 6 digits","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"client/cmd/expose.go","lineNumber":123,"sourceCode":"\t}\n\tif port == 0 || port > 65535 {\n\t\treturn 0, fmt.Errorf(\"invalid port number: must be between 1 and 65535\")\n\t}\n\n\tif !isProtocolValid(exposeProtocol) {\n\t\treturn 0, fmt.Errorf(\"unsupported protocol %q: must be http, https, tcp, udp, or tls\", exposeProtocol)\n\t}\n\n\tif isClusterProtocol(exposeProtocol) {\n\t\tif exposePin != \"\" || exposePassword != \"\" || len(exposeUserGroups) > 0 {\n\t\t\treturn 0, fmt.Errorf(\"auth flags (--with-pin, --with-password, --with-user-groups) are not supported for %s protocol\", exposeProtocol)\n\t\t}\n\t} else if cmd.Flags().Changed(\"with-external-port\") {\n\t\treturn 0, fmt.Errorf(\"--with-external-port is not supported for %s protocol\", exposeProtocol)\n\t}\n\n\tif exposePin != \"\" && !pinRegexp.MatchString(exposePin) {\n\t\treturn 0, fmt.Errorf(\"invalid pin: must be exactly 6 digits\")\n\t}\n\n\tif cmd.Flags().Changed(\"with-password\") && exposePassword == \"\" {\n\t\treturn 0, fmt.Errorf(\"password cannot be empty\")\n\t}\n\n\tif cmd.Flags().Changed(\"with-user-groups\") && len(exposeUserGroups) == 0 {\n\t\treturn 0, fmt.Errorf(\"user groups cannot be empty\")\n\t}\n\n\treturn port, nil\n}\n\nfunc isProtocolValid(exposeProtocol string) bool {\n\tswitch strings.ToLower(exposeProtocol) {\n\tcase \"http\", \"https\", \"tcp\", \"udp\", \"tls\":\n\t\treturn true\n\tdefault:","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/expose.go#L105-L141","documentation":"The --with-pin value does not match pinRegexp (^\\d{6}$): the PIN must be exactly six digits. The check runs only when a pin was supplied; an empty value means the flag was not used and is fine.","triggerScenarios":"`--with-pin 12345` (5 digits), `--with-pin 1234567` (7 digits), `--with-pin 12a456` (non-digit), `--with-pin '123 456'` (embedded space from shell splitting).","commonSituations":"Muscle memory from 4-digit device PINs; passing an alphanumeric password to --with-pin when --with-password was intended; quotes lost in scripts.","solutions":["Use exactly six digits: `--with-pin 123456`","For an arbitrary secret, use `--with-password <secret>` instead of --with-pin"],"exampleFix":"# before\nnetbird expose --with-pin s3cret 8080\n\n# after\nnetbird expose --with-password s3cret 8080","handlingStrategy":"validation","validationCode":"if pinFlag != \"\" && !regexp.MustCompile(`^\\d{6}$`).MatchString(pinFlag) {\n\tlog.Fatalf(\"pin must be exactly 6 digits, got %q (for arbitrary secrets use --with-password)\", pinFlag)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Reserve --with-pin for exactly six digits; anything else belongs in --with-password","Quote the value in scripts so shell splitting cannot alter it","Do not pad or truncate device PINs to fit; the format is fixed"],"tags":["cli","validation","pin","regex","netbird-cli"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}