# Dolphin Emulator — CWE-407 Scan Result: CLEAN

**Date:** 2026-03-30
**Scanner:** agent blackops
**Scope:** Source/Core/ (full clone)

## Methodology

Searched for `std::find(`, `std::ranges::find(`, `Common::Contains()` on
vector/array containers inside loops. Examined all 18 files with Contains-in-loop
patterns. Checked shader cache, netplay, input mapping, game list, and config
subsystems.

## Findings

Dolphin is exceptionally clean:

1. **Map-based lookups throughout:** Shader cache (ProgramShaderCache), texture
   cache (HiresTextures), partition lookups (VolumeWii), state caches — all use
   `std::map`/`std::unordered_map` with O(log N) or O(1) lookups
2. **Common::Contains wrapper:** Uses `std::ranges::contains` under the hood —
   all usages found are on constant-bounded collections (BitSet32 textures,
   PPC registers, Vulkan extensions at init, present modes)
3. **No hot-path linear scans:** All vector membership checks occur in
   initialization, user-triggered actions, or debugger code
4. **Resource pack dedup:** O(T*P*Tp) but packs are few and user-triggered install

No CWE-407 defects found.
