Retries use exponential backoff

Fixed-interval or immediate retries during an ESP outage or rate-limit window cause all five retry attempts to fire within seconds. The ESP rejects each one, the job exhausts its retry budget, and the send permanently fails — even though the ESP would have recovered in minutes if the worker had waited. CWE-770 covers allocation of resources without limits; CWE-400 covers resource exhaustion. Exponential backoff is the documented mitigation: it gives transient faults time to resolve without burning retry budget, and it is required by every major ESP's developer guidelines for handling 429 and 5xx responses.

Set backoff: { type: 'exponential', delay: 2000 } on BullMQ job options, and cap the maximum delay in the worker's backoff strategy:

await emailQueue.add('send', jobData, {
  attempts: 5,
  backoff: { type: 'exponential', delay: 2000 }
})

// Optional: custom strategy with 10-minute cap
const worker = new Worker('email', processEmail, {
  connection,
  settings: {
    backoffStrategy: (attemptsMade) =>
      Math.min(2000 * Math.pow(2, attemptsMade - 1), 600_000)
  }
})

For rate-limit (429) responses, add explicit detection in the error handler and override the delay to at least the Retry-After value returned by the ESP.