santifer/career-ops · error · Error

workable: URL must use HTTPS: ${url}

Error message

workable: URL must use HTTPS: ${url}

What it means

SSRF guard: the URL parsed but its protocol is not https. Built Workable URLs always use https, so this only fires if a maintainer edits widgetUrlFor/feedUrlFor to an http URL.

Source

Thrown at providers/workable.mjs:116

// Process-wide serialization: apply.workable.com fronts every tenant on the
// same host, so this process never needs more than one in-flight request to
// it at a time.
let workableQueue = Promise.resolve();
function serialized(fn) {
  const result = workableQueue.then(fn, fn);
  workableQueue = result.then(() => undefined, () => undefined);
  return result;
}

function assertWorkableUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`workable: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`workable: URL must use HTTPS: ${url}`);
  if (!ALLOWED_WORKABLE_HOSTS.has(parsed.hostname)) {
    throw new Error(`workable: untrusted hostname "${parsed.hostname}" — must be one of: ${[...ALLOWED_WORKABLE_HOSTS].join(', ')}`);
  }
  return url;
}

/**
 * Extract the account slug from a tracked_companies entry's careers_url.
 * @returns {string|null}
 */
export function resolveWorkableSlug(entry) {
  const raw = entry && typeof entry.careers_url === 'string' ? entry.careers_url : '';
  if (!raw) return null;
  let parsed;
  try {
    parsed = new URL(raw);
  } catch {
    return null;

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. Restore https in widgetUrlFor and feedUrlFor.

Example fix

// before
const feedUrlFor = (slug) => `http://apply.workable.com/${slug}/jobs.md`;
// after
const feedUrlFor = (slug) => `https://apply.workable.com/${slug}/jobs.md`;

for (const tpl of [widgetUrlFor, feedUrlFor]) {
  const u = new URL(tpl("acme"));
  if (u.protocol !== "https:") throw new Error("workable: template must be https");
}

const isHttps = (s) => { try { return new URL(s).protocol === "https:"; } catch { return false; } };

When it happens

Trigger: A maintainer sets a Workable URL template to http:// during debugging and forgets to revert; a bad merge.

Common situations: Debugging change not reverted; bad merge.

Related errors

• weworkremotely: URL must use HTTPS: ${url}
• workable: invalid URL: ${url}
• workable: untrusted hostname "${parsed.hostname}" — must be
• wttj: URL must use HTTPS: ${url}
• weworkremotely: invalid URL: ${url}

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/1c52a8e34844ec00. Report an issue: GitHub.