# UNDF: UNDF-2026-000000376
# deno — CLEAN

**Scanned:** 2026-03-27
**Files checked:**
- `runtime/permissions/lib.rs` (9194 lines) — permission descriptor dedup
- `runtime/worker.rs` (1347 lines) — worker setup

## Result

No CWE-407 defects found.

The permission system (`UnaryPermissionSet`, `DescriptorPermissionMap`) uses
Rust's `IndexSet` / `HashSet` / `BTreeMap` throughout for O(1) membership
checks.  The `descriptors.iter().any(...)` calls in `is_flag_denied` and
`insert_granted` are single O(N) passes with no outer loop driving them into
O(N²) territory — they are invoked once per permission query, not once per
element in a collection being iterated.

No linear dedup inside a loop pattern was identified.
