Error handling and recovery
Outbound call without a timeout
A hung third-party request holds the connection and the user until the platform kills it.
Termsfault injection (making a dependency fail on purpose in staging to see what the user and the logs show) · API (the interface other software calls; tested directly, without the UI in between) · webhook (a message a provider such as Stripe sends to your server when something happens, like a payment)
mediumseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
Default HTTP clients wait indefinitely; timeouts are an explicit parameter. The 15-app study found every agent produced server-side request forgery, another sign that outbound calls are generated without constraints.
Five coding agents built 15 identical applications from the same prompts; the applications contained 69 vulnerabilities in total, every agent produced at least one server-side request forgery, none of the 15 applications had CSRF protection or security headers, and every login page shipped without rate limiting or account lockout.
Source: Tenzai, 2026-01 · verified 2026-09-21
How we detect it
Point the integration at an endpoint that never responds.
Checklist items that catch it
External calls have timeouts and bounded retries
manual Review each outbound call site for a timeout and a retry limit; confirm with a stalled-endpoint test.
Every outbound call has a timeout under 30 seconds and at most 3 retries with backoff, or a documented exception.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
More in error handling and recovery
- high
- medium
- medium
- medium
- medium
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.