windmill-labs/windmill · error

Secret value looks already-encrypted; pushing it as-is. If i

Error message

Secret value looks already-encrypted; pushing it as-is. If it is a plaintext secret, re-run with --plain-secrets so it gets encrypted.

What it means

Heuristic branch in variable push: --plain-secrets was not passed and the secret's value matches the shape of workspace ciphertext (looksLikeWorkspaceCiphertext), so it is pushed verbatim as already-encrypted instead of being encrypted server-side. The warning flags the risk that a plaintext secret merely looking like ciphertext would be stored unencrypted.

Source

Thrown at cli/src/commands/variable/variable.ts:239

  // A secret value in a single-file push is authored by the user and is
  // therefore plaintext that must be encrypted server-side — unless it has the
  // shape of workspace ciphertext (a value round-tripped from `sync pull`).
  // Pushing plaintext as already-encrypted would brick the variable. An explicit
  // --plain-secrets always forces the plaintext (encrypt) path.
  let plainSecrets = opts.plainSecrets ?? false;
  if (opts.plainSecrets === undefined && local.is_secret) {
    if (!looksLikeWorkspaceCiphertext(local.value)) {
      log.info(
        colors.yellow(
          "Secret value is not in encrypted form; pushing as plaintext to be encrypted server-side (pass --plain-secrets to silence)."
        )
      );
      plainSecrets = true;
    } else {
      // The value has the shape of workspace ciphertext, so it's stored as-is.
      // A plaintext secret that coincidentally looks like ciphertext (e.g. a
      // base64 token) would be stored unreadable, so surface the assumption.
      log.warn(
        "Secret value looks already-encrypted; pushing it as-is. If it is a plaintext secret, re-run with --plain-secrets so it gets encrypted."
      );
    }
  }

  await pushVariable(
    workspace.workspaceId,
    remotePath,
    undefined,
    local,
    plainSecrets,
    undefined,
    true // single-file push is authoritative: allow secret->non-secret downgrade
  );
  log.info(colors.bold.underline.green(`Variable ${remotePath} pushed`));
}

async function add(

View on GitHub (pinned to e474e8803c)

Solutions

  1. If the value is plaintext, re-run the push with --plain-secrets so it gets encrypted
  2. If it genuinely is ciphertext round-tripped from `sync pull`, no action needed
  3. Avoid hand-writing secret values that mimic ciphertext formats
Defensive patterns

Strategy: fallback

When it happens

Trigger: Thrown at cli/src/commands/variable/variable.ts:239 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/eccea988ebb230f5. Report an issue: GitHub.