security command: %w (likely keychain access denied or wrong

Error message

security command: %w (likely keychain access denied or wrong password)

What it means

The `security` command exited non-zero with an empty stderr, which typically means the user denied the keychain-access prompt or mistyped their password; the raw exec error (e.g. "exit status 128") is wrapped as "security command: %w (likely keychain access denied or wrong password)" to make the cause clear.

Source

Thrown at masterkey/retriever_darwin.go:146

func (r *SecurityCmdRetriever) retrieveKeyOnce(storage string) ([]byte, error) {
	ctx, cancel := context.WithTimeout(context.Background(), securityCmdTimeout)
	defer cancel()

	var stdout, stderr bytes.Buffer
	cmd := exec.CommandContext(ctx, "security", "find-generic-password", "-wa", strings.TrimSpace(storage)) //nolint:gosec
	cmd.Stdout = &stdout
	cmd.Stderr = &stderr

	if err := cmd.Run(); err != nil {
		if errors.Is(ctx.Err(), context.DeadlineExceeded) {
			return nil, fmt.Errorf("security command timed out after %s", securityCmdTimeout)
		}
		// `security` exits non-zero with empty stderr when the user denies the prompt or mistypes;
		// surface that instead of the cryptic "exit status 128 ()".
		stderrStr := strings.TrimSpace(stderr.String())
		if stderrStr == "" {
			return nil, fmt.Errorf("security command: %w (likely keychain access denied or wrong password)", err)
		}
		return nil, fmt.Errorf("security command: %w (%s)", err, stderrStr)
	}
	if stderr.Len() > 0 {
		return nil, fmt.Errorf("keychain: %s", strings.TrimSpace(stderr.String()))
	}

	secret := bytes.TrimSpace(stdout.Bytes())
	if len(secret) == 0 {
		return nil, fmt.Errorf("keychain: empty secret for %s", storage)
	}

	return darwinParams.deriveKey(secret), nil
}

// DefaultRetrievers wires the macOS V10 chain (the only tier Chromium uses here), first success wins:
//  1. GcoredumpRetriever        — CVE-2025-24204 exploit (root only)
//  2. KeychainPasswordRetriever — direct unlock, skipped when password is empty

View on GitHub (pinned to 0503d04d7a)

Solutions

Re-run and click "Always Allow" on the keychain access prompt
Pre-authorize the binary in Keychain Access > login > Access Control
Ensure the keychain is unlocked (`security unlock-keychain`) before running
Switch to KeychainPasswordRetriever with the login password to avoid prompts entirely

Example fix

// before
// relying on security CLI prompt
cmd := exec.CommandContext(ctx, "security", "find-generic-password", "-wa", storage)
// after
// use direct keychain unlock, no interactive prompt
r := &masterkey.KeychainPasswordRetriever{Password: loginPassword}
key, err := r.RetrieveKey(hints)

Defensive patterns

Strategy: try-catch

Validate before calling

cmd := exec.Command("security", "show-keychain-info")
if err := cmd.Run(); err != nil {
	return errors.New("keychain is locked; unlock before retrieval")
}

Type guard

func isAccessDenied(err error) bool {
	return err != nil && strings.Contains(err.Error(), "likely keychain access denied")
}

Try / catch

key, err := r.RetrieveKey(hints)
if err != nil && strings.Contains(err.Error(), "access denied or wrong password") {
	return nil, fmt.Errorf("user denied keychain prompt: %w", err)
}

Prevention

Add the binary to keychain Access Control so prompts are auto-approved
Avoid running unattended with the security CLI retriever
Unlock the keychain programmatically before calling the retriever

When it happens

Trigger: cmd.Run() returns an error, ctx.Err() is not DeadlineExceeded, and stderr.String() trims to empty — the classic deny-the-prompt or wrong-password case of the `security` CLI.

Common situations: User clicked "Deny" on the keychain access dialog, headless automation auto-denies prompts, or the keychain is locked and passwordless access fails silently.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/c9929a127d2e3ffe. Report an issue: GitHub.