Background jobs have explicit retry caps

Background jobs without retry caps are poison-message traps: any job that fails consistently due to a logic bug, bad data, or downstream API change will be retried indefinitely by BullMQ (default: unlimited), Agenda, and similar libraries. CWE-770 describes the outcome — unbounded retries consume Redis storage (the job stays in the failed set), worker CPU (each retry fires job processing logic), and can trigger cascading failures if the job calls external APIs. The retry storm also obscures monitoring: a dead-letter queue that fills silently hides the bug that caused the original failure, delaying the production fix.

Set attempts and backoff at every queue.add() call site. Three attempts with exponential backoff gives transient-failure recovery without burning resources on permanent failures.

// Bad: no cap — retries forever
await queue.add('send-welcome', { userId })

// Good: 3 attempts, exponential backoff
await queue.add('send-welcome', { userId }, {
  attempts: 3,
  backoff: { type: 'exponential', delay: 2000 },
  removeOnComplete: { count: 100 },
  removeOnFail: { count: 50 },
})

Also configure the Worker's failed event listener so failures route to Sentry or your alerting stack — removeOnFail alone causes silent discard, which is the opposite of visibility.