openai SDK dependency chain CWE-407 scan: all 5 targets CLEAN

openai-python, httpx, pydantic, tiktoken, openai-node — no CWE-407 defects.
All targets use proper dict/set/frozenset for membership tests in hot paths.

defects/httpx/CLEAN.md

@@ -0,0 +1,28 @@
+# httpx: CLEAN
+
+CWE-407 scan: 2026-03-30
+
+Source: https://github.com/encode/httpx (depth=1)
+
+## Scan scope
+
+- `httpx/` — 23 Python files
+- Focus: header dedup, cookie jar membership, redirect chain dedup, transport pool membership, URL param dedup
+- Keywords: `in list`, `.index(`, nested for loops
+
+## Findings
+
+No CWE-407 defects found.
+
+- `Headers.__contains__` (line 346-348) creates a list and does linear scan — O(H) per call.
+  `Headers.update()` calls `if key in self` in a loop — technically O(K*H), but HTTP headers
+  are bounded (typically < 50) and this is a standard design for case-insensitive multidict.
+- `Headers.__setitem__` and `__delitem__` also do linear scans over the internal list,
+  but again bounded by header count.
+- Redirect chain bounded by `max_redirects` (default 20)
+- Cookie handling delegates to stdlib `CookieJar`
+- `QueryParams` backed by dict — O(1) lookup
+
+## Verdict
+
+CLEAN — all linear scans are on bounded collections (HTTP headers). No unbounded O(N^2) patterns.

defects/openai-node/CLEAN.md

@@ -0,0 +1,30 @@
+# openai-node: CLEAN
+
+CWE-407 scan: 2026-03-30
+
+Source: https://github.com/openai/openai-node (depth=1)
+
+## Scan scope
+
+- `src/` — 225 TypeScript files
+- Focus: streaming assembly, tool dedup, retry logic, `.includes()`, `.indexOf()`, `.find()`
+- Keywords: `.includes(`, `.indexOf(`, `.find(` in loops
+
+## Findings
+
+No CWE-407 defects found.
+
+- `lib/ChatCompletionStream.ts:306` — `tools?.find()` is O(T) but called once per tool call
+  completion (not per chunk), and T is bounded (typically < 10)
+- `lib/parser.ts:239,263` — same pattern, tool lookup by name, bounded
+- `lib/transform.ts:79` — `required.includes(key)` inside properties loop is O(P*R),
+  but called once during schema preparation with small JSON schemas
+- `internal/qs/utils.ts:228` — `refs.indexOf(val)` in BFS graph walk is O(N^2),
+  but this `compact()` function is **dead code** (exported but never imported by any module)
+- `_vendor/zod-to-json-schema/parsers/union.ts:47,78,83` — `.includes()` in reduce
+  but operating on Zod primitive types (bounded to ~7 types)
+
+## Verdict
+
+CLEAN — proper data structure choices throughout. The only O(N^2) pattern is in
+dead vendored code (qs compact function, never called).

defects/openai-python/CLEAN.md

@@ -0,0 +1,26 @@
+# openai-python: CLEAN
+
+CWE-407 scan: 2026-03-30
+
+Source: https://github.com/openai/openai-python (depth=1)
+
+## Scan scope
+
+- `src/openai/` — 1073 Python files
+- Focus: API client model list membership, retry logic dedup, streaming chunk dedup, tool call assembly membership, batch request dedup, file upload dedup
+- Keywords: `in list`, `.index(`, `if x in`, nested for loops
+
+## Findings
+
+No CWE-407 defects found.
+
+- Streaming delta accumulator (`lib/streaming/_deltas.py`) uses dict-based `acc` — O(1) lookup
+- Tool call done tracking (`lib/streaming/chat/_completions.py:593`) uses `set[int]` — correct
+- `get_input_tool_by_name` is O(T) linear scan per call but not nested in a loop; bounded by tool count (typically < 10)
+- `_base_client.py:451` creates `lower_custom_headers` list but only does 2 constant `in` checks — not O(N^2)
+- `_validators.py` has O(A^2) in `additional_column_validator` but A is bounded by DataFrame columns (typically < 10)
+- All dedup and membership patterns use dict/set/frozenset throughout
+
+## Verdict
+
+CLEAN — well-engineered SDK with proper data structure choices throughout.

defects/pydantic/CLEAN.md

@@ -0,0 +1,28 @@
+# pydantic: CLEAN
+
+CWE-407 scan: 2026-03-30
+
+Source: https://github.com/pydantic/pydantic (depth=1, v2.13.0b3)
+
+## Scan scope
+
+- `pydantic/` and `pydantic/_internal/` — Python source
+- Focus: field validator dedup, model field membership, schema generation visited set, discriminator scanning
+- Keywords: `in list`, `.index(`, nested for loops
+
+## Findings
+
+No CWE-407 defects found.
+
+- `_internal/_decorators.py:489-497` — duplicate field serializer check uses `seen: set[str]` — correct O(1)
+- `_internal/_generate_schema.py:2877-2885` — circular reference detection uses `visited: set[str]` — correct O(1)
+- `_internal/_generate_schema.py:231` — converts `fields` to `set()` before membership test — correct O(1)
+- `_internal/_utils.py:151-170` — `unique_list()` has O(N^2) pattern with list `.index()` + `not in`,
+  but this function is **dead code in v2** (only called from `v1/main.py` compat layer, not imported by v2)
+- Discriminated union handling uses dict-based lookups throughout
+- Schema generation uses proper set-based visited tracking
+
+## Verdict
+
+CLEAN — pydantic v2 uses sets/dicts appropriately for all membership tests in hot paths.
+The only O(N^2) function (`unique_list`) is dead code in v2.

defects/tiktoken/CLEAN.md

@@ -0,0 +1,26 @@
+# tiktoken: CLEAN
+
+CWE-407 scan: 2026-03-30
+
+Source: https://github.com/openai/tiktoken (depth=1)
+
+## Scan scope
+
+- `tiktoken/` — 6 Python files, `src/` — 2 Rust files
+- Focus: encoding registry membership, special token dedup, BPE merge list scanning
+- Keywords: `in list`, linear scans
+
+## Findings
+
+No CWE-407 defects found.
+
+- `registry.py` — all lookups use `dict` (ENCODINGS, ENCODING_CONSTRUCTORS) — O(1)
+- `core.py` — `special_tokens_set` is a `set[str]` (cached property) — O(1) membership
+- `core.py:116-119` — `disallowed_special` converted to `frozenset` before use — O(1) membership
+- BPE core is implemented in Rust (`src/lib.rs`) using `HashMap` — correct
+- No list-based membership tests anywhere in the Python layer
+
+## Verdict
+
+CLEAN — minimal, well-designed codebase. All membership tests use dict/set/frozenset.
+Core tokenizer logic in Rust with HashMap.