External API calls have an explicit timeout

A fetch call with no timeout is a connection that can remain open indefinitely if the upstream server is slow, overloaded, or adversarially slow. On serverless platforms, an open connection holds the function invocation alive until the platform's hard execution limit — 10 seconds on Vercel Hobby, 60 seconds on Pro — burning compute the entire time. CWE-400 (Uncontrolled Resource Consumption) applies: the user who triggered the request pays for exactly one slow upstream response, but a platform attack that sends many such requests exhausts the concurrency pool and causes 503s for all users. Explicit timeouts also force proper error handling — without them, timeout errors surface as generic network failures with no useful signal.

Pass AbortSignal.timeout(ms) as the signal option to every fetch call. Set timeouts appropriate to the SLA of the endpoint being called — 5 seconds is generous for most REST APIs.

// Bad: hangs until platform limit
const res = await fetch(url)

// Good: 5-second abort
const res = await fetch(url, {
  signal: AbortSignal.timeout(5000),
})
if (!res.ok) throw new Error(`Upstream ${res.status}: ${url}`)

For Axios in src/lib/http.ts, set a module-level default: axios.defaults.timeout = 5000. For SDK clients (OpenAI, Stripe), check the SDK's timeout constructor option and set it at singleton construction time.