{"record":{"id":"93f15c3c4d1e8fc1","repo":"vectordotdev/vector","slug":"key-must-be-a-string","errorCode":null,"errorMessage":"key must be a string","messagePattern":"key must be a string","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/vector-vrl/functions/src/set_secret.rs","lineNumber":9,"sourceCode":"use vector_vrl_category::Category;\nuse vrl::prelude::*;\n\nfn set_secret(\n    ctx: &mut Context,\n    key: Value,\n    secret: Value,\n) -> std::result::Result<Value, ExpressionError> {\n    let key_str = key.as_str().expect(\"key must be a string\");\n    let secret_str = secret.as_str().expect(\"secret must be a string\");\n\n    ctx.target_mut()\n        .insert_secret(key_str.as_ref(), secret_str.as_ref());\n    Ok(Value::Null)\n}\n\n#[derive(Clone, Copy, Debug)]\npub struct SetSecret;\n\nimpl Function for SetSecret {\n    fn identifier(&self) -> &'static str {\n        \"set_secret\"\n    }\n\n    fn usage(&self) -> &'static str {\n        \"Sets the given secret in the event.\"\n    }","sourceCodeStart":1,"sourceCodeEnd":27,"githubUrl":"https://github.com/vectordotdev/vector/blob/3708c39b12a93212ed8b8d7510b4cc7769cb5864/lib/vector-vrl/functions/src/set_secret.rs#L1-L27","documentation":"set_secret(key, secret) stores a secret in the target's secret store; the helper starts with key.as_str().expect(\"key must be a string\") (lib/vector-vrl/functions/src/set_secret.rs). The parameter is declared BYTES and VRL's compiler rejects non-string keys at compile time, so this expect is an internal defensive invariant against the compiled contract being broken.","triggerScenarios":"Executing set_secret with a key Value of a non-bytes kind at runtime — impossible through a normally compiled VRL program (set_secret(1, \"x\") is a compile error); reachable only via compiler regressions, mismatched vector-vrl versions, or direct helper invocation outside the compile pipeline.","commonSituations":"Embedding VRL without compilation; mixed crate versions in custom builds; VRL compiler development and fuzzing.","solutions":["Keep vector-vrl crates version-aligned with the VRL compiler in your dependency tree","Write set_secret(\"name\", value) with literal or statically-typed bytes keys","Run programs via Program/compiled handles so kind checks happen first","File an issue with the program text if a released Vector build hits this panic"],"exampleFix":"# before (vrl)\nset_secret(key, \"value\")   # key: any\n\n# after (vrl)\nset_secret(to_string!(key), \"value\")","handlingStrategy":"type-guard","validationCode":"# Statically type the key before the call\nset_secret(to_string!(key), secret_value)","typeGuard":"fn is_bytes(v: &vrl::value::Value) -> bool {\n    matches!(v, vrl::value::Value::Bytes(_))\n}","tryCatchPattern":null,"preventionTips":["Use literal key names for secrets (\"api_key\")","Run vector validate on configs containing set_secret","Never invoke VRL function helpers directly in embedding code"],"tags":["vector","vrl","type-invariant","secrets","panic","internal"],"backgroundTag":"type-invariant-violation","analyzedSha":"3708c39b12a93212ed8b8d7510b4cc7769cb5864","analyzedAt":"2026-08-20T07:02:18.786Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}