cmd/gitbayd/main.go:194 builds &http.Server{Addr, Handler} with no ReadHeaderTimeout, ReadTimeout, IdleTimeout or MaxHeaderBytes. This is the whole public surface and terminates TLS directly; a handful of slow clients holding headers open can starve the listener.
Remedy: ReadHeaderTimeout around 10 s and an IdleTimeout. A global WriteTimeout would break archive and upload-pack streaming, so bound those per handler.
closed by commit 3a7b3219b3 by cmc: gitbayd: header and idle timeouts, and a drain on SIGTERM
2026-09-03 17:10 UTC