Cops: There's a fault in my vault! [closed]

Question

In this game of cops and robbers, each cop will make a vault: a program that stores a secret, and requires a key to unlock. The robbers should find a way to get the vault to reveal its secret without knowing the key.

Cop rules

Cops will write two short segments of code:

• A vault, which takes a key and secret, then allows a robber to guess the key
  • One way to do this would be to use a class, which is constructed with a key and secret, and has a method to enter guesses into
  • The poster should specify a certain set of valid keys and secrets, such as 32 bit integers or strings (note that, unless you add code to prevent it, robbers can still input things that aren't in that set as part of their crack)
  • When a correct guess is made, the vault should return the secret. Otherwise, it should return nothing or a deterministic value that isn't a valid secret
  • Can not rely on cryptographic functions, or any system that can only (realistically) be defeated by brute forcing a value
  • Any code necessary to create an instance of the vault does not count toward the byte count (such as let vault = faulty_vault("key", "secret");
• A fault, which makes the vault reveal its secret
  • Should work for all keys and secrets
  • Should follow the robber rules

Cop submissions should contain the following information:

• The name of the language used
• The byte count
• The format of the keys and secret
• The maximum number of guesses needed for the fault (to prevent brute forcing)
• The code for the vault

Robber rules

Robbers will post their cracking attempts as answers in a separate thread, located here.

• Should work for all keys and secrets
• Should require the same number or fewer guesses as the cop's fault, to prevent brute forcing
• Does not need to be the same as the cop's intended fault
• Multiple cracks may be made for the same cop, as long as they use different methods

Example

Cop:

Javascript (V8), too many bytes

Maximum 2 guesses.

Keys and secrets may be any string

function faulty_vault(key, secret) {
    return function(guess) {
        if (guess.constructor != String)
            return;

        if (guess == key || typeof(guess) != "string") // Second condition is impossible...right?
            return secret;
    };
}

Robber:

Javascript (V8)

Uses 1 guess

// Assumes vault instance is in variable "vault"

var not_a_string = new String("typeof thinks this isn't a string");
vault(not_a_string);

The winner is the shortest cop not cracked after seven days (safe). Good luck!