santifer/career-ops · error · Error

lever: untrusted hostname "${parsed.hostname}" — must be one

Error message

lever: untrusted hostname "${parsed.hostname}" — must be one of: ${[...ALLOWED_LEVER_HOSTS].join(', ')}

What it means

Third guard in assertLeverUrl: parsed.hostname must be in ALLOWED_LEVER_HOSTS ({'api.lever.co','api.eu.lever.co'}). The message lists both permitted hosts. This is the SSRF allowlist — it stops a config from directing the fetch at an arbitrary host.

Source

Thrown at providers/lever.mjs:20

/** @typedef {import('./_types.js').Provider} Provider */

// Lever provider — hits the public postings endpoint.
// Auto-detects from careers_url via jobs.(eu.)?lever.co/<slug>.
// Handles both explicit `api:` URLs and auto-detection from `careers_url`.

const ALLOWED_LEVER_HOSTS = new Set(['api.lever.co', 'api.eu.lever.co']);

/** @param {string} url */
function assertLeverUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`lever: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`lever: URL must use HTTPS: ${url}`);
  if (!ALLOWED_LEVER_HOSTS.has(parsed.hostname))
    throw new Error(`lever: untrusted hostname "${parsed.hostname}" — must be one of: ${[...ALLOWED_LEVER_HOSTS].join(', ')}`);
  return url;
}

/** @param {import('./_types.js').PortalEntry} entry */
function resolveApiUrl(entry) {
  // Explicit api: wins — lets an entry keep a human-facing corporate
  // careers_url (e.g. https://www.coalfire.com/careers) while still pinning
  // the Lever postings board (mirrors greenhouse's api: precedence).
  if (entry.api) {
    assertLeverUrl(entry.api);
    return entry.api;
  }
  let url;
  try {
    url = new URL(entry.careers_url || '');
  } catch {
    return null;
  }

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. Point api: at https://api.lever.co/v0/postings/<slug> (or api.eu.lever.co for EU boards).
2. If using careers_url auto-detection, confirm it derives an api.* host; otherwise set api: explicitly.
3. If Lever adds a new regional API host, extend ALLOWED_LEVER_HOSTS after verifying it is official.

Example fix

// before
api: https://jobs.lever.co/acme

// after
api: https://api.lever.co/v0/postings/acme

import { URL } from 'node:url';
const ALLOWED = new Set(['api.lever.co', 'api.eu.lever.co']);
export function isTrustedLeverHost(value) {
  try { return ALLOWED.has(new URL(value).hostname); } catch { return false; }
}

/** @param {string} url */
function isLeverApiHost(url) {
  try { return new URL(url).hostname === 'api.lever.co' || new URL(url).hostname === 'api.eu.lever.co'; } catch { return false; }
}

try {
  assertLeverUrl(url);
} catch (err) {
  if (err.message.includes('untrusted hostname')) console.error(`[security] ${err.message}`);
  throw err;
}

When it happens

Trigger: An HTTPS URL whose hostname is neither api.lever.co nor api.eu.lever.co — e.g. jobs.lever.co (the human-facing host, not the API), www.lever.co, api.lever.co.evil.com, or a corporate domain. The bad hostname is interpolated into the message.

Common situations: Config used the careers page host (jobs.lever.co) instead of the API host; a regional EU endpoint was spelled wrong; the entry points at a corporate front-end rather than the postings API.

Related errors

• larajobs: untrusted hostname "${parsed.hostname}" - must be
• manfred: untrusted hostname "${parsed.hostname}" — must be $
• Refusing non-HTTP(S) URL: ${url}
• arbeitnow: untrusted hostname "${parsed.hostname}" — must be
• ashby: untrusted hostname "${parsed.hostname}" — must be one

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/c3c69021a2cebbeb. Report an issue: GitHub.