🛡️ Sentinel: [MEDIUM] Add timeouts to external fetch calls

[felirami]

User description

🚨 Severity: MEDIUM
💡 Vulnerability: External fetch calls in src/lib/network.ts and src/lib/snap-market.ts lacked explicit timeouts. Since the native fetch API doesn't time out by default, this could lead to server resource exhaustion and hanging requests if the external node or market API hangs.
🎯 Impact: Application hanging, server resource exhaustion resulting in Denial of Service.
🔧 Fix: Added signal: AbortSignal.timeout(...) to the vulnerable fetch calls using appropriate timeout lengths.
✅ Verification: Ran npm run lint, npm run typecheck, and npm run build locally.

Recorded this learning in .jules/sentinel.md as per the protocol.

---

PR created automatically by Jules for task 12643229377380962784 started by @felirami

---

Note

Low Risk
Small, localized hardening of outbound HTTP with existing error handling; no auth, data model, or API contract changes.

Overview
Adds explicit fetch timeouts on two server-side external HTTP calls that previously could hang indefinitely: getNetworkStatus() in network.ts now uses AbortSignal.timeout(NODE_PROBE_TIMEOUT_MS), and getSnapMarketData() in snap-market.ts uses a new 10s MARKET_FETCH_TIMEOUT_MS with the same pattern (aligned with existing checkNodeHealth() behavior).

Documents the incident and prevention rule in .jules/sentinel.md, and adds plan.md describing the vulnerability and fix steps.

^{Reviewed by Cursor Bugbot for commit 8f05c39. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

CodeAnt-AI Description

Stop external requests from hanging indefinitely

What Changed

• Added a hard timeout to the network status request so it fails instead of waiting forever
• Added a 10-second timeout to the market data request so slow external responses do not block the app
• Recorded the timeout rule and this fix in the project security notes, with a short plan for the change

Impact

✅ Fewer hanging server requests
✅ Lower risk of resource exhaustion from slow external APIs
✅ Clearer failures when upstream services stop responding

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Note

Add explicit timeouts to external fetch calls in getNetworkStatus and getSnapMarketData

• Adds signal: AbortSignal.timeout(NODE_PROBE_TIMEOUT_MS) to the fetch in src/lib/network.ts, causing getNetworkStatus to return ok: false on timeout instead of hanging.
• Adds a new MARKET_FETCH_TIMEOUT_MS = 10_000 constant and applies it to the Dexscreener fetch in src/lib/snap-market.ts, causing getSnapMarketData to return ok: false on timeout.
• Behavioral Change: both functions now abort and return errors after their respective timeouts rather than waiting indefinitely.

^{Macroscope summarized 8f05c39.}

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hypersnaporg	Ready	Preview, Comment	Jun 19, 2026 9:15pm

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8f05c39. Configure here.}

[cursor]

Market timeout errors unnormalized

Low Severity

This PR adds AbortSignal.timeout to getSnapMarketData, but its catch block still sets error from the raw Error message. The paired change in getNetworkStatus uses the same timeout and maps aborts to "Timed out" via errorMessage, so /api/snap-market and SSR market data can report opaque abort strings while network status reports a stable label for the same failure.

 

^{Reviewed by Cursor Bugbot for commit 8f05c39. Configure here.}