santifer/career-ops · error · Error

landingjobs: URL must use HTTPS: ${url}

Error message

landingjobs: URL must use HTTPS: ${url}

What it means

Thrown by assertLandingUrl() when the URL parses but its protocol is not https:. The landing.jobs provider pins all requests to HTTPS as an SSRF guard; an http:// URL (or any other scheme) is rejected before any network call.

Source

Thrown at providers/landingjobs.mjs:28

// NOTE: the v1 feed carries no company-name field — the employer slug only
// appears in the posting URL path (`https://landing.jobs/at/<slug>/<job>`), so
// `company` is derived best-effort from that slug (humanized) and falls back to
// the portal entry name. The whole active set is returned in one call.
//
// Wire in via a `job_boards:` entry with `provider: landingjobs`.

const FEED_URL = 'https://landing.jobs/api/v1/jobs';
const TRUSTED_HOST = 'landing.jobs';

/** @param {string} url */
function assertLandingUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`landingjobs: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`landingjobs: URL must use HTTPS: ${url}`);
  if (parsed.hostname !== TRUSTED_HOST) {
    throw new Error(`landingjobs: untrusted hostname "${parsed.hostname}" — must be ${TRUSTED_HOST}`);
  }
  return url;
}

// NaN-safe Date.parse.
function toEpochMs(value) {
  if (typeof value !== 'string' || !value) return undefined;
  const parsed = Date.parse(value);
  return Number.isNaN(parsed) ? undefined : parsed;
}

/**
 * Derive a best-effort company name from a Landing.jobs posting URL.
 * Posting URLs are `https://landing.jobs/at/<slug>/<job>`; the `<slug>` is
 * humanized (hyphens/underscores → spaces, title-cased). Returns '' when the
 * URL is not the expected `/at/<slug>/…` shape. Exported for unit tests.

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. Change the protocol in the api/careers_url field to https://.
2. Re-run the scan to confirm the guard no longer trips.

Example fix

# before
acme:
  provider: landingjobs
  api: http://landing.jobs/api/v1/jobs

# after
acme:
  provider: landingjobs
  api: https://landing.jobs/api/v1/jobs

function isHttps(url) {
  try { return new URL(url).protocol === 'https:'; } catch { return false; }
}

/** @param {string} url @returns {boolean} */
function isHttpsUrl(url) {
  try { return new URL(url).protocol === 'https:'; } catch { return false; }
}

When it happens

Trigger: An api/careers_url entry using http:// instead of https://; a constructed URL that inherited a non-https scheme from user input.

Common situations: A legacy or hand-edited entry that used http; a copy-paste from a source that normalized to http.

Related errors

• landingjobs: invalid URL: ${url}
• flowxtra: untrusted hostname "${parsed.hostname}" — must be
• gem: invalid URL: ${url}
• gem: URL must use HTTPS: ${url}
• gem: untrusted hostname "${parsed.hostname}" — must be one o

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/2120e26f3df6d891. Report an issue: GitHub.