crowdsecurity/crowdsec · error

unable to load appsec-config %s : %s

Error message

unable to load appsec-config %s : %s

What it means

AppsecConfig.Load resolves an appsec config by name from the hub and loads its installed local file via LoadByPath. If the installed file fails to load for any reason (unreadable, invalid YAML, bad hooks — everything from LoadByPath), the error is wrapped with the config's local path. Note it uses %s (not %w) for the inner error, so errors.Is/As chains are broken here.

Source

Thrown at pkg/appsec/appsec.go:883

		return PhaseHooks{}, wrap(err)
	}

	if out.OnMatch, err = buildHookList(ctx, onMatch, hookOnMatch, patcher); err != nil {
		return PhaseHooks{}, wrap(err)
	}

	return out, nil
}

func (wc *AppsecConfig) Load(configName string, hub *cwhub.Hub) error {
	item := hub.GetItem(cwhub.APPSEC_CONFIGS, configName)

	if item != nil && item.State.IsInstalled() {
		wc.Logger.Infof("loading %s", item.State.LocalPath)

		err := wc.LoadByPath(item.State.LocalPath)
		if err != nil {
			return fmt.Errorf("unable to load appsec-config %s : %s", item.State.LocalPath, err)
		}

		return nil
	}

	return fmt.Errorf("no appsec-config found for %s", configName)
}

func (wc *AppsecConfig) Build(ctx context.Context, hub *cwhub.Hub) (*AppsecRuntimeConfig, error) {
	ret := &AppsecRuntimeConfig{Logger: wc.Logger.WithField("component", "appsec_runtime_config")}

	ret.RequestValidator = apivalidation.NewRequestValidator(wc.Logger.WithField("component", "api_validator"))

	if wc.BouncerBlockedHTTPCode == 0 {
		wc.BouncerBlockedHTTPCode = http.StatusForbidden
	}

	if wc.BouncerPassedHTTPCode == 0 {

View on GitHub (pinned to 909b515798)

Solutions

1. Read the inner error after the path for the specific cause (parse error line, missing hook, expr failure)
2. Run cscli appsec-configs update/install to restore an unmodified copy of the hub config
3. Fix the custom YAML at the printed LocalPath (valid keys, valid on_success, compilable filters)
4. Avoid editing hub-managed files in place; put overrides in a separate custom config

Example fix

// before (edited hub file)
filters: ["broken expr here("]
// after
cscli appsec-configs install crowdsecurity/virtual-patching -f  # restore pristine file

When it happens

Trigger: Load(configName, hub) where the hub item is installed but its LocalPath file fails LoadByPath: missing file, YAML parse error, unknown key, invalid on_success, expr compile failure.

Common situations: Hub-installed appsec config edited in place and broken; partial hub install; loading a config name whose files were removed; a custom appsec-config committed to the hub folder with a syntax error.

Understand the failure class

Background: "Config file not found": what it means and how to fix it in docker-sync, Maven, Vagrant, Turborepo and other tools — this error's family across 60 libraries.

Related errors

• appsec rule name is empty for %s
• no appsec_config provided
• ref cannot be empty
• on_challenge hooks are only valid in-band, not under outofba
• on_challenge_submit hooks are only valid in-band, not under

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/2129245abf3f55d0. Report an issue: GitHub.