---
title: "MGS2011: secret too short to mask"
description: Informational notice that a value read through a secret provider is too short for magus to redact, so it will appear verbatim in captured output and logs.
tags:
  [MGS2011, secrets, redaction, provider, security, logging]
---

# MGS2011: secret too short to mask

A value read through `magus\secret.read` is shorter than four characters,
so magus did NOT register it for redaction. The value is returned to the
magusfile normally; only its protection is declined.

```text
[MGS2011] secret "PIN" is shorter than 4 characters, so its value is NOT
redacted from magus output
```

## Why

Redaction is literal substring replacement over everything magus persists:
captured output, the raw log, the output store, the journal, and every log
format. A two- or three-character value occurs constantly in ordinary text,
so masking every occurrence would shred the logs you need while protecting
something that was almost certainly never a credential. A build log reading
`gr*** a t***le` is worse than useless.

magus therefore declines, and says so. It used to decline in silence, which
left the caller with no way to discover that a value they treated as secret
had nothing behind it.

This notice is informational, not an error. The read succeeded.

## Resolution

Pick whichever applies:

- **It is not really a credential.** A short flag, a version, a boolean.
  Read it with `os\env` instead; `secret.read` implies a protection it will
  not get here, and using it teaches the next reader the wrong thing.
- **It IS a credential.** Rotate it to something longer. A credential short
  enough to trip this is short enough to guess, and no build tool can fix
  that. Four characters is the floor for masking, not a recommendation.
- **You cannot change it.** Then treat its appearance in output as expected.
  Keep it out of anything that echoes: pass it through
  [`--mount=type=secret`](../../../concepts/secrets.md) for a container
  build, or hand it to the tool on stdin rather than as an argument.

## What magus does not claim

Registering a value for redaction is not protection - it is tidying. Even a
long secret is only masked where magus can match it literally: a child that
re-encodes it in a form magus does not register, or splits it across two
writes, defeats the match. See
[concepts/secrets](../../../concepts/secrets.md) for the full list of
limits, and for why the point of the feature is blast radius and dwell time
rather than secrecy.