[ci skip] codex 5.3 review

internal/secrets/secrets.go

@@ -5,6 +5,7 @@ import (
 	"crypto/cipher"
 	"crypto/rand"
 	"encoding/base64"
+	"fmt"
 	"io"
 	"log/slog"
 )
@@ -68,6 +69,9 @@ func (s *Secrets) Decrypt(base64CipherText string) ([]byte, error) {
 
 	// Extract the nonce from the ciphertext
 	nonceSize := gcm.NonceSize()
+	if len(cipherText) < nonceSize {
+		return nil, fmt.Errorf("ciphertext is too short")
+	}
 	nonce, cipherText := cipherText[:nonceSize], cipherText[nonceSize:]
 
 	// Decrypt the ciphertext