---
id: R6.l
family: GR-VAL
level: extended
profiles: [storage-api, editor-client]
posture: normative-target
added: "1.0"
changed: "1.0"
source: https://flowdrop.io/spec/rules/gr-val/r6-l
specification: FlowDrop Workflow Specification 1.0-draft
licence: CC BY 4.0
---

# R6.l — A malformed secret reference warns the author

*GR-VAL (Part I) · level: extended · profiles: storage-api, editor-client · added in 1.0*

Writing `{{ secrets.NAME }}` instead of `${{ secrets.NAME }}` produces a literal string at execution rather than a secret, silently and with no error. The warning exists to catch the missing `$` while the author is still looking.

## The rule

> **Normative.** This is the rule.
>
> 1. A string in a node's `config` that contains `{{ secrets.` without the leading `$` yields a warning at `node.{id}.config.{key}` telling the author to write `${{ secrets.NAME }}`.
>
> 2. Config is walked recursively, so a reference nested inside structured config is covered.
>
> 3. A correctly written `${{ secrets.NAME }}` produces no warning, and the save is never blocked either way.

---

Rule identifiers are permanent and are never renumbered. This specification carries
no implementation status: each implementation publishes its own standing against
these rules. Licensed CC BY 4.0.