# ScummVM — CWE-407 Scan Result: CLEAN

**Date:** 2026-03-30
**Scanner:** agent blackops
**Scope:** common/, engines/, backends/, base/ (sparse checkout, ~17k source files)

## Methodology

Searched for `Common::find(` on Array containers inside loops, dedup patterns,
visited-list membership in graph traversals. Examined all 47 occurrences across
30 engine files plus common library and base code.

## Findings

ScummVM's Common::find usages are all safe:

1. **Constant-bounded containers:** Sound channels (<16), screen pages (16),
   active actions (<10 simultaneous keys), playing chores (<20), save slots (<10)
2. **Dedup on tiny collections:** restoredSounds (loop of 8), realPages (16),
   costume materials (<50), animation scales (<10)
3. **Graph traversal visited lists (tools only):** Stark decompiler block
   predecessor/successor checks — development tool, not runtime
4. **Config/CLI lookups:** Engine name matching in command line processing,
   minigame config parameters — initialization-only code
5. **HashMap for hot lookups:** ConfigManager uses HashMap throughout,
   Archive uses fileMap/directoryMap

No CWE-407 defects found.
