ruvnet/ruflo · error · CredentialGeneratorError

INVALID_SECRET_LENGTH

INVALID_SECRET_LENGTH

Error message

Secret length must be at least 32 characters

What it means

The third leg of validateConfig(): secretLength < 32 throws CredentialGeneratorError INVALID_SECRET_LENGTH. This governs signing secrets/HMAC material, where 32 bytes of entropy is the standard minimum for modern security claims.

Source

Thrown at v3/@claude-flow/security/src/credential-generator.ts:139

   * Validates configuration parameters.
   */
  private validateConfig(): void {
    if (this.config.passwordLength < 16) {
      throw new CredentialGeneratorError(
        'Password length must be at least 16 characters',
        'INVALID_PASSWORD_LENGTH'
      );
    }

    if (this.config.apiKeyLength < 32) {
      throw new CredentialGeneratorError(
        'API key length must be at least 32 characters',
        'INVALID_API_KEY_LENGTH'
      );
    }

    if (this.config.secretLength < 32) {
      throw new CredentialGeneratorError(
        'Secret length must be at least 32 characters',
        'INVALID_SECRET_LENGTH'
      );
    }
  }

  /**
   * Generates a cryptographically secure random string using rejection sampling
   * to eliminate modulo bias.
   *
   * @param length - Length of the string to generate
   * @param charset - Character set to use
   * @returns Random string
   */
  private generateSecureString(length: number, charset: string): string {
    const charsetLength = charset.length;
    const result = new Array(length);

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Set secretLength >= 32, or omit it for the built-in default
2. Give secrets their own config field rather than sharing the password length
3. If a consumer caps secret size, fix that consumer — short HMAC secrets are a real vulnerability

Example fix

// before
new CredentialGenerator({ secretLength: 24 });

// after
new CredentialGenerator({ secretLength: 32 });

const MIN_SECRET = 32;
if (cfg.secretLength !== undefined && cfg.secretLength < MIN_SECRET) {
  throw new Error(`secretLength must be >= ${MIN_SECRET}, got ${cfg.secretLength}`);
}
new CredentialGenerator(cfg);

function isCredentialGeneratorError(e: unknown, code?: string): boolean {
  return e instanceof Error && e.name === 'CredentialGeneratorError'
    && (code === undefined || (e as { code?: string }).code === code);
}

try {
  return new CredentialGenerator(cfg);
} catch (e) {
  if (isCredentialGeneratorError(e, 'INVALID_SECRET_LENGTH')) {
    return new CredentialGenerator({ ...cfg, secretLength: 32 });
  }
  throw e;
}

When it happens

Trigger: new CredentialGenerator({ secretLength: 24 }); a shared config object reused for passwords, keys, and secrets with one short length field; downgrading secret length to match an external system's input limit.

Common situations: One-size config objects applied to all three credential kinds; porting configs from tools with weaker defaults; a downstream system rejecting long secrets and prompting a reduction.

Understand the failure class

Background: Config validation failed: what "invalid value for {key}" and settings-rejection errors mean across 19 open-source libraries — this error's family across 19 libraries.

Related errors

• ProofChain requires an explicit signingKey — hardcoded defau
• INVALID_PASSWORD_LENGTH
• INVALID_API_KEY_LENGTH
• INVALID_ROUNDS
• INVALID_MIN_LENGTH

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/0ac714c19acd0eae. Report an issue: GitHub.