# Julia — CWE-407 Deeper Scan: CLEAN (beyond julia-0001/julia-0002)

## Scan Date
2026-03-29

## Areas Scanned

### 1. Compiler/src/ssair/slot2ssa.jl — visited/seen
- Lines 241, 672: `visited = BitSet()` — O(1) membership via bit-set.
- **Result:** CLEAN.

### 2. Compiler/src/ssair/passes.jl — seen
- Line 140: `seen = BitSet(block)` — O(1) membership.
- **Result:** CLEAN.

### 3. Compiler/src/optimize.jl — visited
- Line 574: `visited = BitSet((bb,))` — O(1) membership.
- **Result:** CLEAN.

### 4. base/precompilation.jl — visited
- Line 595: `visited::Set{PkgId}` — O(1) membership in `_visit_indirect_deps!`.
- **Result:** CLEAN.

### 5. base/loading.jl — module loading graph
- `loaded_modules` is `Dict{PkgId,Module}` — O(1) lookups throughout.
- **Result:** CLEAN.

### 6. base/show.jl — seen
- Line 777: `seen = IdSet()` — O(1) membership.
- **Result:** CLEAN.

### 7. base/Enums.jl — seen
- Line 161: `seen = Set{Symbol}()` — O(1) membership.
- **Result:** CLEAN.

### 8. src/subtype.c / src/typemap.c — C-level type dispatch
- No linear-scan visited/seen arrays. Subtype checking uses a bits-stack, not a list.
- **Result:** CLEAN.

## Conclusion

No CWE-407 defects found beyond julia-0001 (isrelocatable) and julia-0002 (reinfer BFS).
All traversal dedup in the Julia Compiler and base library uses `Set`, `IdSet`, `BitSet`,
`Dict`, or `IdDict` — all O(1) membership.
