openai SDK dependency chain CWE-407 scan: all 5 targets CLEAN

openai-python, httpx, pydantic, tiktoken, openai-node — no CWE-407 defects.
All targets use proper dict/set/frozenset for membership tests in hot paths.

defects/openai-python/CLEAN.md

@@ -0,0 +1,26 @@
+# openai-python: CLEAN
+
+CWE-407 scan: 2026-03-30
+
+Source: https://github.com/openai/openai-python (depth=1)
+
+## Scan scope
+
+- `src/openai/` — 1073 Python files
+- Focus: API client model list membership, retry logic dedup, streaming chunk dedup, tool call assembly membership, batch request dedup, file upload dedup
+- Keywords: `in list`, `.index(`, `if x in`, nested for loops
+
+## Findings
+
+No CWE-407 defects found.
+
+- Streaming delta accumulator (`lib/streaming/_deltas.py`) uses dict-based `acc` — O(1) lookup
+- Tool call done tracking (`lib/streaming/chat/_completions.py:593`) uses `set[int]` — correct
+- `get_input_tool_by_name` is O(T) linear scan per call but not nested in a loop; bounded by tool count (typically < 10)
+- `_base_client.py:451` creates `lower_custom_headers` list but only does 2 constant `in` checks — not O(N^2)
+- `_validators.py` has O(A^2) in `additional_column_validator` but A is bounded by DataFrame columns (typically < 10)
+- All dedup and membership patterns use dict/set/frozenset throughout
+
+## Verdict
+
+CLEAN — well-engineered SDK with proper data structure choices throughout.