User-triggered code paths have infinite-loop guards

Recursive functions without base cases or depth limits crash on cyclic data structures and blow the call stack on deeply nested inputs. CWE-674 (Uncontrolled Recursion) and CWE-835 (Loop with Unreachable Exit Condition) both apply. In a user-facing API, an attacker who can control a tree or graph structure — JSON, AST, category hierarchy, file system path — can trigger a stack overflow that crashes the Node process for all users. Even without adversarial input, an AI-generated recursive function that processes database-fetched hierarchical data will eventually encounter a self-referencing node in production and take down the server.

Add a depth parameter with a hard limit to every recursive function. Throw an explicit error rather than returning silently, so the guard failure is visible in logs.

const MAX_DEPTH = 100

function processNode(node: TreeNode, depth = 0): ProcessedNode {
  if (depth > MAX_DEPTH) {
    throw new Error(`processNode: max depth ${MAX_DEPTH} exceeded — possible cycle`)
  }
  return {
    ...node,
    children: node.children.map(child => processNode(child, depth + 1)),
  }
}

For graph traversal (not trees), add a visited: Set<string> parameter and check visited.has(node.id) before recursing. This catches cycles that a depth limit alone would miss.