harden: add resource limit in client.py (gitlab.bandit.B113)

[anupamme]

The application was found using the requests module without configuring a timeout value for connections. This could lead to uncontrolled resource consumption where the application could run out of socket descriptors, effectively causing a Denial of Service (DoS). To remediate this issue, pass in a timeout= argument to each requests call. Example using a timeout for an HTTP GET request: # Issue a GET request to https://example.com with a timeout of 10 seconds response = requests.get('https://example.com', timeout=10) # Work with the response object # .... For more information on using the requests module see: - https://requests.readthedocs.io/en/latest/api/. This is defence-in-depth at src/bespokelabs/curator/client.py:72 rather than a vulnerability I can show is exploitable here — it makes the failure mode explicit and bounded. Close it freely if the pattern is intentional.

Reference: CWE-400

What changed

• src/bespokelabs/curator/client.py

Verification

No automated check could be run against this repository, so this change is unverified beyond review. Please treat it as a suggestion.

---

Automated security fix by OrbisAI Security

[entelligence-ai-pr-reviews]

EntelligenceAI PR Summary

Added a 30-second timeout to the session-creation HTTP POST in client.py, mitigating unbounded connection waits and the associated resource-exhaustion risk flagged by Bandit B113.

---

Review Scorecard

Dimension	Rating	Basis
Code Quality	●●●●● 5/5 — Excellent	no critical/significant findings — rated Excellent
Blast Radius	Low	changed symbols are referenced only within their own file(s); no high-impact surface touched, 1 file(s) / ~2 line(s) changed (size only — not a blast signal)
Merge Confidence	●●●●● 5/5 — Safe to Merge	code quality 5/5 × Low blast radius

Safe to merge with a low blast radius; code quality rated Excellent (5/5): the review found nothing to flag.

Key Findings:

• No critical or significant issues found

Evaluated against

• 1/1 changed files reviewed
• criteria: correctness, security & access control, robustness & error handling, concurrency & data integrity, repo conventions / steering docs
• steering docs: none found in repo

[entelligence-ai-pr-reviews]

Walkthrough

This update adds a 30-second timeout to session creation requests, preventing the client from blocking indefinitely when the session service is unresponsive while preserving existing response handling and session initialization behavior.

Changes

Files

• src/bespokelabs/curator/client.py

Updated create_session to pass a 30-second timeout to the requests.post call used for session creation. Existing response processing and session initialization logic remain unchanged.