# CLEAN — Apache Beam
Scanned 2026-03-29 for CWE-407.

## Scope

- `sdks/java/core/src/main/java` — PCollection DAG, PTransform graph, GreedyStageFuser
- `runners/core-java/src/main/java` — InMemoryStateInternals, SimplePushbackSideInputDoFnRunner, WatermarkHold
- `runners/google-cloud-dataflow-java/src/main/java` — DataflowRunner, DataflowPipelineTranslator
- `runners/google-cloud-dataflow-java/worker/src/main/java` — WindmillOrderedList
- `runners/jet/src/main/java` — DAGBuilder

## Findings

| Location | Pattern | Type | Result |
|----------|---------|------|--------|
| `GreedyStageFuser` | `fusedCollections.contains` / `materializedPCollections.contains` | `LinkedHashSet` | CLEAN |
| `DAGBuilder.sideInputCollections` | `contains` per edge | `HashSet<String>` | CLEAN |
| `WindmillOrderedList.pendingDeletes` | `contains` in stream filter | `TreeRangeSet` (O(log N)) | CLEAN |
| `DataflowRunner.experiments` | `experiments.contains(...)` | `List<String>` — called at job-submission time (once), not in hot loop | LOW — startup only |
| `InMemoryStateInternals.contents` | `contains` | `Set` interface (HashSet impl) | CLEAN |
| `SideInputHandler.readyWindows` | `contains` | `CopyOnWriteArraySet` | CLEAN |

The `DataflowRunner.experiments` pattern makes several `List<String>.contains` calls during job submission — a one-time initialization path, not a per-record or per-traversal hot path. Not actionable as CWE-407.

**Result: No actionable CWE-407 defects.**
