diff --git a/docs/source/conf.py b/docs/source/conf.py
index 1017016..91e1031 100644
--- a/docs/source/conf.py
+++ b/docs/source/conf.py
@@ -224,7 +224,7 @@
 
 # Example configuration for intersphinx: refer to the Python standard library.
 intersphinx_mapping = {
-    'https://docs.python.org/3/': None,
+    "python": ('https://docs.python.org/3/', None),
     'rdflib': ('https://rdflib.readthedocs.io/en/latest/', None),
     'pandas': ('https://pandas.pydata.org/pandas-docs/dev', None),
 }
diff --git a/src/pystow/impl.py b/src/pystow/impl.py
index 9b47164..32cc5f0 100644
--- a/src/pystow/impl.py
+++ b/src/pystow/impl.py
@@ -257,7 +257,7 @@ def ensure_untar(
             return unzipped_path
         unzipped_path.mkdir(exist_ok=True, parents=True)
         with tarfile.open(path) as tar_file:
-            tar_file.extractall(unzipped_path, **(extract_kwargs or {}))
+            tar_file.extractall(unzipped_path, **(extract_kwargs or {}))  # noqa:S202
         return unzipped_path
 
     def ensure_gunzip(
diff --git a/src/pystow/utils.py b/src/pystow/utils.py
index dff1809..d7a24dc 100644
--- a/src/pystow/utils.py
+++ b/src/pystow/utils.py
@@ -138,13 +138,13 @@ def get_hexdigests_remote(
     :param hexdigests_remote:
         The expected hexdigests as (algorithm_name, url to file with expected hex digest) pairs.
     :param hexdigests_strict:
-        Set this to false to stop automatically checking for the `algorithm(filename)=hash` format
+        Set this to alse to stop automatically checking for the `algorithm(filename)=hash` format
     :returns:
         A mapping of algorithms to hexdigests
     """
     rv = {}
     for key, url in (hexdigests_remote or {}).items():
-        text = requests.get(url).text
+        text = requests.get(url, timeout=15).text
         if not hexdigests_strict and "=" in text:
             text = text.rsplit("=", 1)[-1].strip()
         rv[key] = text
@@ -362,7 +362,7 @@ def download(
             kwargs.setdefault("stream", True)
             # see https://requests.readthedocs.io/en/master/user/quickstart/#raw-response-content
             # pattern from https://stackoverflow.com/a/39217788/5775947
-            with requests.get(url, **kwargs) as response, path.open("wb") as file:
+            with requests.get(url, **kwargs) as response, path.open("wb") as file:  # noqa:S113
                 logger.info(
                     "downloading (stream=%s) with requests from %s to %s",
                     kwargs["stream"],
@@ -802,7 +802,7 @@ def get_commit(org: str, repo: str, provider: str = "git") -> str:
         lines = (line.strip().split("\t") for line in output.decode("utf8").splitlines())
         rv = next(line[0] for line in lines if line[1] == "HEAD")
     elif provider == "github":
-        res = requests.get(f"https://api.github.com/repos/{org}/{repo}/branches/master")
+        res = requests.get(f"https://api.github.com/repos/{org}/{repo}/branches/master", timeout=15)
         res_json = res.json()
         rv = res_json["commit"]["sha"]
     else:
diff --git a/tests/test_utils.py b/tests/test_utils.py
index ddc0edd..ba198c4 100644
--- a/tests/test_utils.py
+++ b/tests/test_utils.py
@@ -81,7 +81,7 @@ def test_file_values(self):
             (TEST_TXT_WRONG_MD5, "yolo"),
         ]:
             with self.subTest(name=url.name):
-                self.assertEqual(value, requests.get(url.as_uri()).text)
+                self.assertEqual(value, requests.get(url.as_uri(), timeout=15).text)
 
     def test_mkdir(self):
         """Test for ensuring a directory."""