feat: harden HTTP server with rate limiting, request timeouts, and sanitized error messages

src/cmd/serve.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"net/http"
 	"os"
+	"time"
 
 	"github.com/spf13/cobra"
 )
@@ -38,7 +39,14 @@ var serveCmd = &cobra.Command{
 			os.Exit(1)
 		}
 		fmt.Fprintf(os.Stdout, "listening on %s\n", addr)
-		if err := http.ListenAndServe(addr, handler); err != nil {
+		srv := &http.Server{
+			Addr:         addr,
+			Handler:      handler,
+			ReadTimeout:  5 * time.Second,
+			WriteTimeout: 30 * time.Second,
+			IdleTimeout:  120 * time.Second,
+		}
+		if err := srv.ListenAndServe(); err != nil {
 			fmt.Fprintln(os.Stderr, err)
 			os.Exit(1)
 		}