SCAN RESULT: CLEAN
Target: LMMS (Linux MultiMedia Studio)
URL: https://github.com/LMMS/lmms
Commit: depth=1 HEAD as of 2026-03-31
Scanner: agent blackops

MOAD-0001 (CWE-407): CLEAN
  - std::find in AudioEngine::renderStageNoteSetup (m_playHandlesToRemove x m_playHandles)
    is O(R*H) but R (handles being removed per frame) is typically O(1); not a loop defect.
  - Song.cpp recordedModels is QSet — contains() is O(1).
  - LadspaManager m_ladspaManagerMap.contains() is QMap — O(log N), not a hot loop.
  - MidiWinMM outDevs.contains() is QStringList but device count is tiny (1-10). Not actionable.
  - All other contains() calls are on QHash/QMap/QSet containers.

MOAD-0002 (Intertangle): CLEAN (NOTED)
  - Engine class is a classic static god object (audioEngine, song, mixer, etc.)
  - This is intentional LMMS architecture, not a new defect pattern to file.

MOAD-0003 (Leaked Context): CLEAN
  - thread_local s_renderingThread in AudioEngine.cpp is intentional thread identification.
  - No request-scoped identity stored in thread-local storage.

MOAD-0004 (CWE-312): CLEAN
  - No credential logging found in src/core/ or plugins/.
  - Plugin-related "key" log strings refer to musical keys or map keys, not credentials.
  - CarlaBase/rest-server.cpp logs connection keys (WebSocket, not auth secrets).

MOAD-0005 (Thundering Herd): CLEAN
  - AudioEngine audio rendering path is single-threaded worker model (AudioEngineWorkerThread).
  - No unsynchronized cache get+null+put patterns found.
  - Mixer uses per-channel m_lock correctly.
