crowdsecurity/crowdsec · error

appsec datasource requires a hub. this is a bug, please repo

Error message

appsec datasource requires a hub. this is a bug, please report

What it means

The appsec acquisition Source's Configure() requires the Source struct to have been pre-initialized with a hub (the crowdsort local hub used to load appsec configs) before it can run. Configure() explicitly rejects a nil hub as an internal invariant: the datasource factory must call ConfigureCommonState or equivalent setup that injects the hub before Configure is invoked. If you see this, the acquisition wiring (not your YAML) is at fault.

Source

Thrown at pkg/acquisition/modules/appsec/config.go:189

			return nil, fmt.Errorf("unable to resolve appsec_config %q: %w", entry, err)
		}

		for _, name := range names {
			if _, ok := seen[name]; ok {
				continue
			}

			seen[name] = struct{}{}
			toLoad = append(toLoad, name)
		}
	}

	return toLoad, nil
}

func (w *Source) Configure(ctx context.Context, yamlConfig []byte, logger *log.Entry, _ metrics.AcquisitionMetricsLevel) error {
	if w.hub == nil {
		return errors.New("appsec datasource requires a hub. this is a bug, please report")
	}

	if w.lapiClientConfig == nil {
		return errors.New("appsec datasource requires a lapi client configuration. this is a bug, please report")
	}

	if err := w.UnmarshalConfig(yamlConfig); err != nil {
		return fmt.Errorf("unable to parse appsec configuration: %w", err)
	}

	if w.lapiClientConfig.Credentials == nil {
		return errors.New("missing lapi client credentials")
	}

	w.lapiURL = fmt.Sprintf("%sv1/decisions/stream", w.lapiClientConfig.Credentials.URL)
	w.AuthCache = NewAuthCache()

	w.logger = logger

View on GitHub (pinned to 909b515798)

Solutions

1. Report the bug to CrowdSec with logs and the acquisition config
2. If you are embedding the appsec datasource, ensure the Source is created through the normal datasource registry so the hub is injected before Configure() is called
3. Check you are running matching versions of crowdsec and the appsec plugin (a binary built from mismatched sources can skip initialization)

Example fix

// before (custom runner)
src := &appsec.Source{}
err := src.Configure(ctx, yaml, logger, metrics)
// after
src := &appsec.Source{}
if err := src.ConfigureCommonState(state); err != nil { return err } // sets hub, lapiClientConfig
err := src.Configure(ctx, yaml, logger, metrics)

if src.hub == nil { return fmt.Errorf("appsec source not initialized: hub missing") }
err := src.Configure(ctx, yaml, logger, metricsLevel)

func isUninitializedSourceErr(err error) bool { return err != nil && strings.Contains(err.Error(), "requires a hub") }

if err := src.Configure(ctx, cfg, logger, lvl); err != nil {
    if isUninitializedSourceErr(err) { /* report bug / fix wiring */ }
    return err
}

When it happens

Trigger: Source.Configure() is called on an appsec Source whose hub field was never set, i.e. the code path that constructs the datasource skipped ConfigureCommonState/hub injection. The error message itself says 'this is a bug, please report', so it arises from internal wiring, not user config.

Common situations: Seen during plugin development or custom acquisition runners that build an appsec Source manually and call Configure directly; also seen in tests (TestExclusion, TestDiscoveryPolling, etc.) or in the http-source setup path when the LAPI-side hub state is missing.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

• appsec datasource requires a lapi client configuration. this
• missing lapi client credentials
• client not initialized
• controller init: %w
• failed to generate initial challenge bundle: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/0dbf0f15f8bef5d2. Report an issue: GitHub.