{"record":{"id":"16670af8b234ef7d","repo":"santifer/career-ops","slug":"a16z-speedrun-talent-url-must-use-https-url","errorCode":null,"errorMessage":"a16z-speedrun-talent: URL must use HTTPS: ${url}","messagePattern":"a16z-speedrun-talent: URL must use HTTPS: (.+?)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"providers/a16z-speedrun-talent.mjs","lineNumber":46,"sourceCode":"const PER_PAGE = 50;\nconst DEFAULT_MAX_PAGES = 6; // × PER_PAGE = the 300-job default scan\n// Runaway bound, not a coverage target: iteration already stops at the\n// feed's reported total_pages (or a short page), so on an honest feed the\n// cap costs nothing and full-board sweeps keep working as the board grows.\n// It only bites a misbehaving feed or an absurd max_pages entry — so it\n// sits well above plausible board size (~353 pages / ~17.6k jobs as of\n// 2026-08), same policy as workday.mjs's cap.\nconst MAX_PAGES_CAP = 1000;\n\n/** @param {string} url */\nfunction assertFeedUrl(url) {\n  let parsed;\n  try {\n    parsed = new URL(url);\n  } catch {\n    throw new Error(`a16z-speedrun-talent: invalid URL: ${url}`);\n  }\n  if (parsed.protocol !== 'https:') throw new Error(`a16z-speedrun-talent: URL must use HTTPS: ${url}`);\n  if (parsed.hostname !== TRUSTED_HOST) {\n    throw new Error(`a16z-speedrun-talent: untrusted hostname \"${parsed.hostname}\" — must be ${TRUSTED_HOST}`);\n  }\n  return url;\n}\n\n/** Resolve the page cap: a positive integer `max_pages` on the entry, capped. */\nfunction resolveMaxPages(entry) {\n  const v = entry?.max_pages;\n  if (Number.isInteger(v) && v > 0) return Math.min(v, MAX_PAGES_CAP);\n  return DEFAULT_MAX_PAGES;\n}\n\n/** Optional server-side query: `q:` on the entry, else joined `keywords:`. */\nfunction resolveQuery(entry) {\n  if (typeof entry?.q === 'string' && entry.q.trim()) return entry.q.trim();\n  if (Array.isArray(entry?.keywords) && entry.keywords.length > 0) {\n    const joined = entry.keywords.filter((k) => typeof k === 'string' && k.trim()).join(' ').trim();","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/santifer/career-ops/blob/9b17a8ac97b398a496b38e423ae24e433b43254f/providers/a16z-speedrun-talent.mjs#L28-L64","documentation":"After parse, assertFeedUrl() requires the protocol be exactly 'https:'. Non-https schemes are rejected as a transport-security / SSRF control because the feed is fetched server-side. This fires for http://, ftp://, file://, data://, etc.","triggerScenarios":"The feed URL uses http:// or another non-https scheme — typically FEED_BASE set to the http variant of the a16z endpoint.","commonSituations":"FEED_BASE copied from an old http bookmark; local dev http mirror used as the feed.","solutions":["Switch the scheme to https — use 'https://speedrun.a16z.com/api/talent' (or the documented https endpoint).","For a local non-https test mirror, mock fetchJson in tests instead of pointing the provider at http."],"exampleFix":"// before\nconst FEED_BASE = 'http://speedrun.a16z.com/api/talent';\n\n// after\nconst FEED_BASE = 'https://speedrun.a16z.com/api/talent';","handlingStrategy":"validation","validationCode":"function isHttpsUrl(u) {\n  try { return new URL(u).protocol === 'https:'; } catch { return false; }\n}\nif (!isHttpsUrl(FEED_BASE)) throw new Error('a16z feed URL must be https');","typeGuard":"/** @param {unknown} u @returns {u is string} */\nfunction isHttpsUrlString(u) {\n  if (typeof u !== 'string') return false;\n  try { return new URL(u).protocol === 'https:'; } catch { return false; }\n}","tryCatchPattern":"try { assertFeedUrl(url); } catch (err) {\n  if (/must use HTTPS/.test(err.message)) console.error('a16z feed must be https.');\n  throw err;\n}","preventionTips":["CI-enforce https for all provider feed constants.","Never use http:// mirrors for server-side fetches."],"tags":["a16z","https","ssrf-guard","provider","security","url"],"backgroundTag":null,"analyzedSha":"9b17a8ac97b398a496b38e423ae24e433b43254f","analyzedAt":"2026-08-13T00:48:39.135Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}