windmill-labs/windmill · error

Variable ${remotePath} is currently secret and will be downg

Error message

Variable ${remotePath} is currently secret and will be downgraded to non-secret: its value will be stored in plaintext

What it means

Downgrade warning during variable add/update: the remote variable is currently secret, but the pushed definition has is_secret=false, so after the update its value will be stored in plaintext on the server. Shown after the update confirmation; the operation proceeds unless the user aborts.

Source

Thrown at cli/src/commands/variable/variable.ts:301

    })
  ) {
    if (
      !opts.yes &&
      !(await Confirm.prompt({
        message: `Variable already exist, do you want to update its value?`,
        default: true,
      }))
    ) {
      return;
    }
    if (isSecret === false) {
      const existing = await wmill.getVariable({
        workspace: workspace.workspaceId,
        path: remotePath,
        decryptSecret: false,
      });
      if (existing.is_secret) {
        log.warn(
          colors.yellow(
            `Variable ${remotePath} is currently secret and will be downgraded to non-secret: its value will be stored in plaintext`
          )
        );
      }
    }
    log.info(colors.bold.yellow("Updating variable..."));
    await wmill.updateVariable({
      workspace: workspace.workspaceId,
      path: remotePath,
      alreadyEncrypted: false, // value from CLI is always plaintext
      requestBody: {
        value,
        ...(isSecret !== undefined ? { is_secret: isSecret } : {}),
        ...(opts.description !== undefined
          ? { description: opts.description }
          : {}),
      },

View on GitHub (pinned to e474e8803c)

Solutions

1. Keep the variable secret in the pushed YAML to avoid plaintext storage
2. If plaintext is acceptable, no action — the warning is informational
3. Rotate the value afterwards if accidental exposure is a concern

When it happens

Trigger: Thrown at cli/src/commands/variable/variable.ts:301 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/1c5c8f2302113aaa. Report an issue: GitHub.