# zulip — CWE-407 Scan: CLEAN

Scanned: 2026-03-29

## Scope

- `zerver/lib/thumbnail.py` — `seen_thumbnails`: `set()` based (line 939 context: set())
- `zerver/lib/onboarding.py` — `seen_topics = set()` (line 561)
- Message thread traversal, user group membership, notification dispatch: checked

## Verdict

No CWE-407 (algorithmic complexity / quadratic membership check) defects found.
All deduplication uses `set`. No list-based visited/seen patterns in message
threading, group membership, or notification hot paths.
