Third-party SDK clients are constructed once (singleton)
Why it matters
SDK clients like new Stripe(), new OpenAI(), and new PrismaClient() initialize internal HTTP connection pools, TLS handshake state, and retry logic at construction time. Constructing them inside a request handler means that work — including a TCP connection establishment — happens on every request, adding 20–100ms of latency and preventing connection reuse. For Prisma specifically, constructing a new PrismaClient per request is the documented anti-pattern that causes connection pool exhaustion (each instance opens its own pool of connections, and serverless invocations can open hundreds of pools simultaneously, hitting the database's max_connections limit).
Severity rationale
Low because per-request SDK construction primarily causes latency degradation and connection pool waste rather than immediate data loss or financial exposure.
Remediation
Move SDK construction to module scope in a dedicated singleton file. Export the instance, not the class. In src/lib/stripe.ts:
import Stripe from 'stripe'
// Constructed once when the module is first imported
export const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!, {
apiVersion: '2025-01-27.acacia',
timeout: 10000,
})
For Prisma in a serverless environment, use the globalThis singleton pattern from the Prisma docs to avoid creating multiple instances across hot-reload cycles in development:
import { PrismaClient } from '@prisma/client'
const globalForPrisma = globalThis as unknown as { prisma: PrismaClient }
export const prisma = globalForPrisma.prisma ?? new PrismaClient()
if (process.env.NODE_ENV !== 'production') globalForPrisma.prisma = prisma
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Hidden Cost Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · performance-efficiency
Taxons
History
- 2026-04-18·v1.0.0·Initial import from ai-slop-cost-bombs·automated