Build1 publisher2 min readPublished
Matching known job titles caught the four ATS boards a slug guess attributed to the wrong company
A developer building an index across 2,127 companies found that guessing a job-board slug from a company name lands on a live board belonging to someone else about as often as it lands on the right one.
The Engineer · Build desk
What happened
- Greenhouse, Lever and Ashby all answer unauthenticated job-board requests keyed on a per-company slug, so the cheap way to build a company-to-board map is to lowercase the name, strip the punctuation and try it.
- Across the first 654 companies of a 2,127-company index, 26% had a board that could be found by guessing, and only 47% of those boards survived verification.
- The candidate slug airspace returns HTTP 200 and 15 open jobs from Greenhouse's board API, and none of that data belongs to Airspace Link.
- The first verification step, which compared the company name against the hostedUrl in each job record, reported 8 of 8 confirmed and waved through all four known false positives.
- Greenhouse's board endpoint returns the owner in a name field, so comparing that against the company name works on one of the three systems and not the other two.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- exposure An index built on discovery alone publishes one employer's open roles under another employer's name, and the HTTP 200 that does it is indistinguishable from a correct hit.
- constraint With only Greenhouse naming the owner, the evidence has to come from outside the board, so you need at least one independently known job per company before any hit can be trusted.
- decision Two signals that both produce false negatives force a three-valued pipeline: confirmed, rejected, and unknown rows parked in a candidates file until more known titles arrive.
- cost Probing an unfiltered company list spends most of the request budget on employers who do not run any of these three systems, against a host that asks for one request a second.
The check that passed those four boards compared the company name against the `hostedUrl` field Lever returns in each job record. For company "JumpCloud" and `jobs.lever.co/jumpcloud/...`, it matches [10]. It matches because the URL contains the slug the prober just guessed, so the comparison tests the guess against itself.
Ashby's nearest thing to an owner field is `team`, which on the board being checked read "Construction" [8]. Lever's `categories` object gives commitment, department, location and team [9]. So the verification signal has to come from the job list. Normalise titles by lowercasing and stripping everything that is not a letter or a digit, then intersect the board's titles with titles you already know that employer is hiring for from some other source [12]. That caught all four: `greenhouse/airspace` lists 15 jobs, and the backend role seen at Airspace Link is not among them [13].
The title match fails in the other direction too. `greenhouse/shopmy` did not match, and that board is named "ShopMy"; the remote board that supplied the known titles was still advertising a role the ATS board no longer carried [14]. The developer's ordering is name first where the ATS gives one, title match where it does not, and a third state where neither fires, with those rows written to a candidates file that a later pass with more known titles can promote [15].
Now the coverage that survives. On the first 654 companies, 26% had a findable board and 47% of those passed verification [4]. Multiply the two: 0.26 x 0.47, about 12% of the list ends with a board you can attribute [1]. Discovery alone would report 26%.
The hit rate is a claim about one particular company list. The developer measured 67% on a sample and watched it fall to roughly 10% on the full run, because the sample had been filtered to engineering roles, which is the population that runs an ATS [18]. For a 26% discovery rate to transfer, a company list has to be skewed the same way, toward employers who use one of these three systems.
Two host details set the pace. `api.lever.co` publishes `Crawl-delay: 1`, and a single global 0.15-second pause put roughly four requests a second on it [16], four times the rate Lever asks for [2]. Read the host you are actually hitting: `jobs.ashbyhq.com/robots.txt` disallows `/api/`, while `api.ashbyhq.com` is a different host and serves no robots.txt at all [17].
What to watch
- Whether Ashby or Lever add an organisation field to their posting APIs, which would make name comparison usable on all three systems.
- Whether the 26% findable and 47% verified split holds across the rest of the 2,127-company index as the list broadens past engineering-heavy employers.
- Whether api.ashbyhq.com starts serving a robots.txt or published rate guidance for its posting API.