# X_SECRETS_PLAINTEXT_INVALID

## Means

the decrypted secrets are not a flat map of env values

## Typical cause

an `x secrets edit` buffer saved as something other than one flat JSON object, a key that is not an environment variable name, or an empty value. Refused before sealing, so a file that opens always installs

## Fix

`x secrets edit` — the buffer is `{"SESSION_SECRET": "s3cr3t"}`

[Encrypted secrets](/error-codes#encrypted-secrets)