picoclaw/.jules/sentinel.md

2025-02-28 - [Medium] Fix Missing HTTP Server Timeouts

Vulnerability: Go's standard http.ListenAndServe and unconfigured http.Server instances lack default timeouts for reading headers, reading bodies, and writing responses. Learning: These default settings leave the application vulnerable to resource exhaustion and Denial of Service (DoS) attacks, such as Slowloris, because malicious clients can slowly send data and tie up server connections indefinitely. Prevention: Always instantiate http.Server explicitly and set ReadHeaderTimeout, ReadTimeout, WriteTimeout, and (optionally) IdleTimeout to reasonable values based on the expected request sizes and latencies.