{"record":{"id":"b19a6911d2bc0bc8","repo":"onetimesecret/onetimesecret","slug":"site-secret-not-set-or-empty","errorCode":null,"errorMessage":"site.secret not set or empty","messagePattern":"site\\.secret not set or empty","errorType":"validation","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"lib/onetime/initializers/configure_familia.rb","lineNumber":81,"sourceCode":"        previous.each do |prev|\n          keys[content_tag(prev)] = Onetime::KeyDerivation.derive_base64(prev, :familia_enc)\n        end\n\n        current_tag       = content_tag(secret_key)\n        keys[current_tag] = Onetime::KeyDerivation.derive_base64(secret_key, :familia_enc)\n        [keys, current_tag]\n      end\n\n      # Content-addressed envelope version tag for a secret: :\"r<first-8-hex>\"\n      # of its :key_verifier derivation (same purpose the boot verifier uses,\n      # so tag and stored verifier stay derivable from one another).\n      def self.content_tag(secret)\n        :\"r#{Onetime::KeyDerivation.derive_hex(secret, :key_verifier)[0, 8]}\"\n      end\n\n      def execute(_context)\n        secret_key = OT.conf.dig('site', 'secret')\n        raise 'site.secret not set or empty' if secret_key.to_s.empty?\n\n        uri = OT.conf.dig('redis', 'uri') || ''\n\n        # Strip surrounding quotes that may have been introduced via ENV var\n        # misconfiguration (e.g., REDIS_URL=\"redis://...\" instead of REDIS_URL=redis://...)\n        # This prevents URI::InvalidURIError: bad URI (is not URI?)\n        uri = uri.to_s.strip.gsub(/\\A[\"']|[\"']\\z/, '')\n\n        # Early validation: Check if Redis URI is properly configured\n        raise_error = if uri.empty?\n          OT.boot_logger.fatal '[configure_familia] Invalid URI'\n        elsif uri.include?('CHANGEME')\n          OT.boot_logger.warn \"[configure_familia] WARNING: Redis password is 'CHANGEME'\"\n        end\n\n        raise Onetime::Problem, \"Redis URI not configured (#{uri})\" if raise_error\n\n        # Test environment safety: Ensure tests use port 2163","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/onetimesecret/onetimesecret/blob/f81295e41bc3e808a3dd2cbea03ef65401a662e4/lib/onetime/initializers/configure_familia.rb#L63-L99","documentation":"Error \"site.secret not set or empty\" thrown in onetimesecret/onetimesecret.","triggerScenarios":"Thrown at lib/onetime/initializers/configure_familia.rb:81 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set site.secret in the configuration (or the matching environment variable) before starting the app."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"f81295e41bc3e808a3dd2cbea03ef65401a662e4","analyzedAt":"2026-08-23T21:13:10.635Z","schemaVersion":2},"datasetVersion":"2026-08-24T02:17:37.098Z"}