santifer/career-ops · error · Error

a16z-speedrun-talent: URL must use HTTPS: ${url}

Error message

a16z-speedrun-talent: URL must use HTTPS: ${url}

What it means

After parse, assertFeedUrl() requires the protocol be exactly 'https:'. Non-https schemes are rejected as a transport-security / SSRF control because the feed is fetched server-side. This fires for http://, ftp://, file://, data://, etc.

Source

Thrown at providers/a16z-speedrun-talent.mjs:46

const PER_PAGE = 50;
const DEFAULT_MAX_PAGES = 6; // × PER_PAGE = the 300-job default scan
// Runaway bound, not a coverage target: iteration already stops at the
// feed's reported total_pages (or a short page), so on an honest feed the
// cap costs nothing and full-board sweeps keep working as the board grows.
// It only bites a misbehaving feed or an absurd max_pages entry — so it
// sits well above plausible board size (~353 pages / ~17.6k jobs as of
// 2026-08), same policy as workday.mjs's cap.
const MAX_PAGES_CAP = 1000;

/** @param {string} url */
function assertFeedUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`a16z-speedrun-talent: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`a16z-speedrun-talent: URL must use HTTPS: ${url}`);
  if (parsed.hostname !== TRUSTED_HOST) {
    throw new Error(`a16z-speedrun-talent: untrusted hostname "${parsed.hostname}" — must be ${TRUSTED_HOST}`);
  }
  return url;
}

/** Resolve the page cap: a positive integer `max_pages` on the entry, capped. */
function resolveMaxPages(entry) {
  const v = entry?.max_pages;
  if (Number.isInteger(v) && v > 0) return Math.min(v, MAX_PAGES_CAP);
  return DEFAULT_MAX_PAGES;
}

/** Optional server-side query: `q:` on the entry, else joined `keywords:`. */
function resolveQuery(entry) {
  if (typeof entry?.q === 'string' && entry.q.trim()) return entry.q.trim();
  if (Array.isArray(entry?.keywords) && entry.keywords.length > 0) {
    const joined = entry.keywords.filter((k) => typeof k === 'string' && k.trim()).join(' ').trim();

View on GitHub (pinned to 9b17a8ac97)

Solutions

  1. Switch the scheme to https — use 'https://speedrun.a16z.com/api/talent' (or the documented https endpoint).
  2. For a local non-https test mirror, mock fetchJson in tests instead of pointing the provider at http.

Example fix

// before
const FEED_BASE = 'http://speedrun.a16z.com/api/talent';

// after
const FEED_BASE = 'https://speedrun.a16z.com/api/talent';
Defensive patterns

Strategy: validation

Validate before calling

function isHttpsUrl(u) {
  try { return new URL(u).protocol === 'https:'; } catch { return false; }
}
if (!isHttpsUrl(FEED_BASE)) throw new Error('a16z feed URL must be https');

Type guard

/** @param {unknown} u @returns {u is string} */
function isHttpsUrlString(u) {
  if (typeof u !== 'string') return false;
  try { return new URL(u).protocol === 'https:'; } catch { return false; }
}

Try / catch

try { assertFeedUrl(url); } catch (err) {
  if (/must use HTTPS/.test(err.message)) console.error('a16z feed must be https.');
  throw err;
}

Prevention

When it happens

Trigger: The feed URL uses http:// or another non-https scheme — typically FEED_BASE set to the http variant of the a16z endpoint.

Common situations: FEED_BASE copied from an old http bookmark; local dev http mirror used as the feed.

Related errors

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/16670af8b234ef7d. Report an issue: GitHub.