How to spot missing network timeouts in code review
An outbound call without a timeout waits as long as the other side lets it. When a partner API hangs, every request that calls it hangs too, until the server runs out of workers or connections. Nothing in the diff looks wrong, because the bug is a missing argument.
What it looks like in a diff
An HTTP call with no timeout set, on a client whose default is to wait without limit. Python's requests has no default timeout, and neither does Node's axios (its default is 0, no limit); other clients differ, so check the default of the one in the diff rather than assuming.
Look at where the call sits. In a request handler, a slow dependency becomes a slow or stuck response for the user. Also check that a deadline passed into the function (a context, an abort signal) actually reaches the call, rather than being accepted as a parameter and ignored.
Questions to ask in review
- Which calls in this diff leave the process (HTTP, database, queue, cache)?
- What does each client do by default when the other side never answers?
- Is the timeout short enough for the request it sits in?
- What happens to the user's request when the call times out?
How to word the comment
Name the input, the path it takes and what goes wrong, then the fix. For example (on an imagined PR, not one from the library):
This fetches the forecast with no timeout, so if the weather API stops answering, every page that shows the widget waits with it. Set a short timeout (two or three seconds) and render the page without the widget when it fires.
Practise on real PRs
As of October 2026, the DiffDojo library has 4 live PRs that plant missing timeouts, across 4 stacks. They are not listed here: a PR you open knowing its bug teaches less. Each review is graded on whether you find the bug and explain it.