{"record":{"id":"fe2c8c3e5f23b34e","repo":"iflytek/astron-agent","slug":"published-legacy-tenant-credentials-cannot-be-used","errorCode":null,"errorMessage":"published legacy tenant credentials cannot be used","messagePattern":"published legacy tenant credentials cannot be used","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"core/tenant/config/bootstrap_credentials.go","lineNumber":79,"sourceCode":"// bootstrap credential consumer.\nfunc (credentials TenantBootstrapCredentials) Validate() error {\n\tif credentials.TenantID != BootstrapTenantID {\n\t\treturn fmt.Errorf(\n\t\t\t\"TENANT_ID must remain %s because persisted bootstrap data refers to it\",\n\t\t\tBootstrapTenantID,\n\t\t)\n\t}\n\tif err := validateCredential(\"TENANT_KEY\", credentials.APIKey); err != nil {\n\t\treturn err\n\t}\n\tif err := validateCredential(\"TENANT_SECRET\", credentials.Secret); err != nil {\n\t\treturn err\n\t}\n\tif credentials.APIKey == credentials.Secret {\n\t\treturn errors.New(\"TENANT_KEY and TENANT_SECRET must be distinct values\")\n\t}\n\tif credentials.APIKey == LegacyTenantKey || credentials.Secret == LegacyTenantSecret {\n\t\treturn errors.New(\"published legacy tenant credentials cannot be used\")\n\t}\n\treturn nil\n}\n\nfunc credentialFromEnvironmentOrFile(valueEnvironment, fileEnvironment string) (string, error) {\n\tif value := strings.TrimSpace(os.Getenv(valueEnvironment)); value != \"\" {\n\t\tif err := validateCredential(valueEnvironment, value); err != nil {\n\t\t\treturn \"\", err\n\t\t}\n\t\treturn value, nil\n\t}\n\n\tfileName := strings.TrimSpace(os.Getenv(fileEnvironment))\n\tif fileName == \"\" {\n\t\treturn \"\", fmt.Errorf(\"%s or %s is required\", valueEnvironment, fileEnvironment)\n\t}\n\tvalue, err := readCredentialFile(fileName)\n\tif err != nil {","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/core/tenant/config/bootstrap_credentials.go#L61-L97","documentation":"Validate() rejects the hardcoded legacy tenant credentials (LegacyTenantKey / LegacyTenantSecret) that were once published publicly. Using them would be a security hole, so bootstrap fails fast if either TENANT_KEY or TENANT_SECRET equals a known legacy value.","triggerScenarios":"Validate is invoked by LoadTenantBootstrapCredentials / reconcileTenantBootstrap / parseMysqlConfig and finds credentials.APIKey == LegacyTenantKey or credentials.Secret == LegacyTenantSecret.","commonSituations":"Deployments that were never rotated after the legacy credentials were published, infrastructure-as-code still referencing the old well-known values, or copied example configs from old docs/READMEs.","solutions":["Rotate to newly generated, secret values for TENANT_KEY and TENANT_SECRET","Search deployment manifests/secrets for the legacy values and replace them everywhere","Restart the tenant service and confirm bootstrap succeeds with the new credentials"],"exampleFix":"# before\nTENANT_KEY=<published-legacy-key>\n# after\nTENANT_KEY=$(openssl rand -hex 24)","handlingStrategy":"validation","validationCode":"legacy := []string{config.LegacyTenantKey, config.LegacyTenantSecret}\nfor i, v := range []string{os.Getenv(\"TENANT_KEY\"), os.Getenv(\"TENANT_SECRET\")} {\n    for _, l := range legacy {\n        if v == l {\n            return fmt.Errorf(\"credential %d uses a published legacy value; rotate it\", i)\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":"if _, err := config.LoadTenantBootstrapCredentials(ctx); err != nil {\n    if strings.Contains(err.Error(), \"legacy\") {\n        logger.Fatal(\"rotate legacy tenant credentials before deploying\")\n    }\n    return err\n}","preventionTips":["Rotate credentials on a schedule; never reuse example/doc values","Scan IaC repos for published legacy secrets","Treat any appearance of legacy values as a security incident"],"tags":["security","credentials","deprecated","tenant"],"backgroundTag":"invalid-config-value","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}