{"record":{"id":"9ed2957c6ed8f74b","repo":"ruvnet/ruflo","slug":"invalid-min-length","errorCode":"INVALID_MIN_LENGTH","errorMessage":"Minimum password length must be at least 8 characters","messagePattern":"Minimum password length must be at least 8 characters","errorType":"exception","errorClass":"PasswordHashError","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/security/src/password-hasher.ts","lineNumber":121,"sourceCode":"      rounds: config.rounds ?? 12,\n      minLength: config.minLength ?? 8,\n      maxLength: config.maxLength ?? 128,\n      requireUppercase: config.requireUppercase ?? true,\n      requireLowercase: config.requireLowercase ?? true,\n      requireDigit: config.requireDigit ?? true,\n      requireSpecial: config.requireSpecial ?? false,\n    };\n\n    // Validate configuration\n    if (this.config.rounds < 10 || this.config.rounds > 20) {\n      throw new PasswordHashError(\n        'Bcrypt rounds must be between 10 and 20 for security and performance balance',\n        'INVALID_ROUNDS'\n      );\n    }\n\n    if (this.config.minLength < 8) {\n      throw new PasswordHashError(\n        'Minimum password length must be at least 8 characters',\n        'INVALID_MIN_LENGTH'\n      );\n    }\n  }\n\n  /**\n   * Validates password against configured requirements.\n   *\n   * @param password - The password to validate\n   * @returns Validation result with errors if any\n   */\n  validate(password: string): PasswordValidationResult {\n    const errors: string[] = [];\n\n    if (!password) {\n      errors.push('Password is required');\n      return { isValid: false, errors };","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/security/src/password-hasher.ts#L103-L139","documentation":"The second constructor-time check in PasswordHasher: minLength < 8 throws PasswordHashError INVALID_MIN_LENGTH. This is the policy floor for passwords the hasher will accept (the validate() method enforces it per password); configuring it lower would let weak passwords through the module's own guarantees.","triggerScenarios":"new PasswordHasher({ minLength: 6 }) to satisfy a legacy 6-char policy; config reuse from a system whose minimum predates modern guidance; a zero/undefined value coercing low during config merges.","commonSituations":"Migrating from an old auth system with a 6-char minimum; product requirements clashing with the floor; env-driven config not validated before use.","solutions":["Set minLength >= 8 (8 is the default), or omit the field","If a legacy 6-char policy exists, raise the policy — don't lower the hasher","Validate merged config objects once at startup so the throw carries full context"],"exampleFix":"// before\nnew PasswordHasher({ minLength: 6 });\n\n// after\nnew PasswordHasher({ minLength: 8 });","handlingStrategy":"validation","validationCode":"if (cfg.minLength !== undefined && cfg.minLength < 8) {\n  throw new Error(`minLength must be >= 8, got ${cfg.minLength} — raise the policy instead`);\n}\nnew PasswordHasher(cfg);","typeGuard":"function isPasswordHashError(e: unknown, code?: string): boolean {\n  return e instanceof Error && e.name === 'PasswordHashError'\n    && (code === undefined || (e as { code?: string }).code === code);\n}","tryCatchPattern":"try {\n  return new PasswordHasher(cfg);\n} catch (e) {\n  if (isPasswordHashError(e, 'INVALID_MIN_LENGTH')) {\n    return new PasswordHasher({ ...cfg, minLength: 8 });\n  }\n  throw e;\n}","preventionTips":["Raise legacy 6-char policies to 8 rather than lowering the hasher floor","Validate merged auth config once at startup with full deployment context","Omit minLength to accept the default instead of copying stale numbers forward"],"tags":["security","password-policy","configuration","validation"],"backgroundTag":"config-validation-failed","analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-08-22T09:17:25.309Z"}