See PHI766, which is roughly "allow builds to fail when they produce too much output".
See PHI533, which is roughly "allow builds to fail when a 'wait' after an HTTP request takes too long".
I'm pretty sure there's also an "ssh exec should have a timeout" task somewhere. It clearly should.
See T12701, about improving URL validation for "Make HTTP Request" steps. This is a relatively easy thing to tighten up.
See PHI875, which is roughly T10510. cURL timeouts are not configurable, and are reported to Harbormaster in a confusing way.