santifer/career-ops · error · Error

teamtailor: URL must use HTTPS: ${url}

Error message

teamtailor: URL must use HTTPS: ${url}

What it means

assertFeedUrl's second check rejects any URL whose protocol is not 'https:'. It fires after a successful parse but before the hostname check. Teamtailor feeds are HTTPS-only by policy; combined with redirect:'error' on the fetch this prevents protocol-downgrade SSRF.

Source

Thrown at providers/teamtailor.mjs:40

// never fetched.

const TEAMTAILOR_HOST_RE = /^([a-z0-9](?:[a-z0-9-]*[a-z0-9])?)\.teamtailor\.com$/i;

/**
 * Validate a feed URL before fetching. Always HTTPS-only. The hostname is
 * pinned to `*.teamtailor.com` for auto-detected entries; an explicit
 * `provider: teamtailor` entry may use its configured branded host.
 * @param {string} url
 * @param {{ explicit?: boolean }} [opts]
 */
function assertFeedUrl(url, { explicit = false } = {}) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`teamtailor: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`teamtailor: URL must use HTTPS: ${url}`);
  if (!explicit && !TEAMTAILOR_HOST_RE.test(parsed.hostname)) {
    throw new Error(`teamtailor: untrusted hostname "${parsed.hostname}" — must be <slug>.teamtailor.com (or set "provider: teamtailor" to use a branded careers domain)`);
  }
  return url;
}

// Derive the RSS feed URL from a tracked_companies entry by normalizing any
// path on the configured host to /jobs.rss. Auto-detection (explicit=false)
// only claims *.teamtailor.com hosts; an explicit `provider: teamtailor` entry
// (explicit=true) may use a branded careers host. Returns null otherwise.
/**
 * @param {import('./_types.js').PortalEntry} entry
 * @param {{ explicit?: boolean }} [opts]
 */
function resolveFeedUrl(entry, { explicit = false } = {}) {
  const raw = entry?.api || entry?.careers_url || '';
  if (typeof raw !== 'string' || !raw) return null;
  let parsed;

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. Change the scheme to https://
2. Confirm the host serves https (Teamtailor always does)
3. Re-run the scan

Example fix

# before
careers_url: http://acme.teamtailor.com
# after
careers_url: https://acme.teamtailor.com

function isHttps(v) {
  try { return new URL(v).protocol === 'https:'; } catch { return false; }
}
if (!isHttps(entry.api || entry.careers_url)) {
  console.warn(`${entry.name}: teamtailor feed URL must use https://`);
}

When it happens

Trigger: The feed URL is a valid http:// URL (e.g. http://acme.teamtailor.com/jobs.rss). The provider refuses to fetch over plain http.

Common situations: An old bookmark or a careers_url copied from a non-secure referrer.

Related errors

• solidjobs: URL must use HTTPS: ${url}
• teamtailor: invalid URL: ${url}
• teamtailor: untrusted hostname "${parsed.hostname}" — must b
• glints: invalid URL: ${url}
• glints: URL must use HTTPS: ${url}

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/96703fc23c83815f. Report an issue: GitHub.