Timeout configured on all HTTP requests

HTTP requests without timeouts block indefinitely when a server stops responding without closing the TCP connection — a common failure mode in cloud environments during rolling restarts or network partitions. CWE-400 (uncontrolled resource consumption) applies: a single hung request holds a thread, connection slot, or serverless concurrency unit until the platform forcibly kills it — typically after 30+ seconds. At scale, simultaneous slow requests exhaust your connection pool entirely, making the application unresponsive for all users.

Set explicit timeouts on every HTTP client. Use AbortController for native fetch; set timeout on axios instances. Never rely on platform-level request timeouts alone.

// lib/fetch.ts — fetch with timeout
export async function fetchWithTimeout(
  url: string,
  options: RequestInit = {},
  timeoutMs = 10_000
): Promise<Response> {
  const controller = new AbortController()
  const id = setTimeout(() => controller.abort(), timeoutMs)
  try {
    return await fetch(url, { ...options, signal: controller.signal })
  } finally {
    clearTimeout(id)
  }
}

Default to 10 seconds for user-facing requests, 30 seconds for background jobs. Document the timeout value alongside each integration so it's visible during code review.