santifer/career-ops · error · Error

a16z-speedrun-talent: untrusted hostname "${parsed.hostname}

Error message

a16z-speedrun-talent: untrusted hostname "${parsed.hostname}" — must be ${TRUSTED_HOST}

What it means

The final feed-URL guard pins the hostname to TRUSTED_HOST (the a16z speedrun talent API host). Any other hostname is rejected as an SSRF allowlist violation — the provider only ever fetches from its one known feed host.

Source

Thrown at providers/a16z-speedrun-talent.mjs:48

// Runaway bound, not a coverage target: iteration already stops at the
// feed's reported total_pages (or a short page), so on an honest feed the
// cap costs nothing and full-board sweeps keep working as the board grows.
// It only bites a misbehaving feed or an absurd max_pages entry — so it
// sits well above plausible board size (~353 pages / ~17.6k jobs as of
// 2026-08), same policy as workday.mjs's cap.
const MAX_PAGES_CAP = 1000;

/** @param {string} url */
function assertFeedUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`a16z-speedrun-talent: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`a16z-speedrun-talent: URL must use HTTPS: ${url}`);
  if (parsed.hostname !== TRUSTED_HOST) {
    throw new Error(`a16z-speedrun-talent: untrusted hostname "${parsed.hostname}" — must be ${TRUSTED_HOST}`);
  }
  return url;
}

/** Resolve the page cap: a positive integer `max_pages` on the entry, capped. */
function resolveMaxPages(entry) {
  const v = entry?.max_pages;
  if (Number.isInteger(v) && v > 0) return Math.min(v, MAX_PAGES_CAP);
  return DEFAULT_MAX_PAGES;
}

/** Optional server-side query: `q:` on the entry, else joined `keywords:`. */
function resolveQuery(entry) {
  if (typeof entry?.q === 'string' && entry.q.trim()) return entry.q.trim();
  if (Array.isArray(entry?.keywords) && entry.keywords.length > 0) {
    const joined = entry.keywords.filter((k) => typeof k === 'string' && k.trim()).join(' ').trim();
    if (joined) return joined;
  }

View on GitHub (pinned to 9b17a8ac97)

Solutions

Confirm TRUSTED_HOST at the top of providers/a16z-speedrun-talent.mjs matches the real API host and set FEED_BASE to that exact host.
Do not use subdomain variants unless TRUSTED_HOST is updated to allow them (by design it stays a single tight host).

Example fix

// before
const TRUSTED_HOST = 'a16z.com'; // wrong — that is the marketing site
const FEED_BASE = `https://${TRUSTED_HOST}/api/talent`;

// after — the real API host
const TRUSTED_HOST = 'speedrun.a16z.com';
const FEED_BASE = `https://${TRUSTED_HOST}/api/talent`;

Defensive patterns

Strategy: validation

Validate before calling

const TRUSTED_HOST = 'speedrun.a16z.com';
function isTrustedFeedUrl(u) {
  try {
    const p = new URL(u);
    return p.protocol === 'https:' && p.hostname === TRUSTED_HOST;
  } catch { return false; }
}
if (!isTrustedFeedUrl(FEED_BASE)) throw new Error('a16z feed host not trusted');

Type guard

/** @param {unknown} u @param {string} host @returns {u is string} */
function isTrustedHostUrl(u, host) {
  if (typeof u !== 'string') return false;
  try { return new URL(u).hostname === host; } catch { return false; }
}

Try / catch

try { assertFeedUrl(url); } catch (err) {
  if (/untrusted hostname/.test(err.message)) console.error('a16z feed host must be', TRUSTED_HOST);
  throw err;
}

Prevention

Keep TRUSTED_HOST allowlisted and lint against silent widening.
Pair with redirect:'error' on fetch (this provider does) to close the redirect-SSRF vector.

When it happens

Trigger: The parsed URL hostname differs from TRUSTED_HOST: a wrong subdomain (e.g. 'www.' variant), a different domain, or an internal host/IP a redirect or tampered constant tried to reach. Server-side redirects are already blocked by redirect:'error', so this catches a directly-misconfigured host.

Common situations: FEED_BASE edited to the marketing-site host instead of the API host; TRUSTED_HOST not updated after upstream renamed their API host; subdomain mismatch.

Related errors

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/7f8a80765fc731ed. Report an issue: GitHub.