# qBittorrent — CWE-407 Scan Result: CLEAN

Scanned: 2026-03-30
Target: qBittorrent (C++/Qt)
Source: https://github.com/qbittorrent/qBittorrent

## Scope

- `src/base/bittorrent/` — session, torrent impl, tracker, peer management
- `src/base/rss/` — RSS auto-downloader, parser, feed management
- `src/base/search/` — search plugin manager
- `src/gui/` — transfer list, tracker list, tag/category filtering
- `src/webui/` — API controllers, sync controller

## Finding

CLEAN. qBittorrent uses appropriate data structures throughout:

- **Tags**: `OrderedSet<Tag>` (std::set) — O(log N) membership
- **Categories**: `QHash<QString, CategoryOptions>` — O(1) membership
- **Torrents**: `QHash<TorrentID, TorrentImpl*>` — O(1) lookup
- **Banned IPs**: sorted `QStringList` but only accessed from user actions, not hot paths
- **Trackers**: `QHash`/`QSet` for tracker host dedup in filter widgets
- **RSS article IDs**: `QSet<QString>` — O(1) dedup
- **Search disabled plugins**: `QStringList` with O(N) contains, but N < 50 always

No QList/QVector linear membership test found in any hot loop or
per-packet/per-torrent-update path.
