CLEAN — CWE-407 scan 2026-03-31. Kodi uses proper containers (maps, sets, unordered_map.contains()) throughout. Only 11 files use std::find, all on small fixed-size collections. WSDiscovery IP dedup is O(N^2) but network discovery is bounded to ~100 devices max. No significant MOAD-0001 defects found.
