kdenlive+audacity: 5-MOAD scan complete; kdenlive-0009 MOAD-0005 new defect

kdenlive: all 5 MOADs scanned.
- MOAD-0001: 8 pre-existing CWE-407 patches confirmed, no new sites found.
- MOAD-0002: pCore god object (3704 refs) noted as Intertangle observation.
- MOAD-0003: CLEAN (thread_local is execution guard, not request identity).
- MOAD-0004: CLEAN (no credential logging).
- MOAD-0005 NEW: buildLumaThumbs() called via QtConcurrent::run() writes
  to MainWindow::m_lumacache (QMap, not thread-safe) without mutex while UI
  widgets read/write the same map from the main thread — data race on project
  load. Patch: add QMutex, wrap all m_lumacache access sites.

audacity: all 5 MOADs scanned.
- MOAD-0001: 2 pre-existing CWE-407 patches confirmed, no new sites found.
- MOAD-0002 through MOAD-0005: CLEAN.

9/9 KdenliveTest PASS (added kdenlive-0009 MOAD-0005 threading test).

defects/audacity/patch/audacity-SCAN-2026-03-31.md

@@ -0,0 +1,51 @@
+# Audacity — Full 5-MOAD Scan 2026-03-31
+
+Source: https://github.com/audacity/audacity (depth=1, HEAD ~2026-03)
+
+## MOAD-0001 (CWE-407) — 2 defects total (both pre-existing)
+
+Pre-existing patches (audacity-0001, audacity-0002 already exist):
+- 0001: TrackeditActionsController selectedTracks std::find in 7 track loop methods
+- 0002: WaveTrack::CanOffsetClips() movingClips std::find in clip iteration loop
+
+No new CWE-407 defects found in this scan pass.
+
+Additional patterns reviewed and dismissed:
+- `au3/libraries/au3-registries/Registry.cpp:260` — InsertNewItemUsingPreferences
+  calls std::find on saved preference ordering, but this runs once per plugin
+  registration at startup, not in a hot per-frame/per-event loop. Not actionable.
+- `au3/libraries/au3-cloud-audiocom/TaskExecutionService.cpp:242` — mProcessedTasks
+  capped at 100 items, single-threaded, not a scaling issue.
+- `au3/libraries/au3-effects/EffectOutputTracks.cpp:86` — GetMatchingInput scans
+  mOMap once per effect application, not in an inner loop. Not actionable.
+
+## MOAD-0002 (Intertangle) — CLEAN
+
+No single god-object equivalent to kdenlive's pCore found. Services are injected
+via muse::Inject dependency injection. Subsystems communicate through interfaces,
+not shared mutable global state.
+
+## MOAD-0003 (Leaked Context) — CLEAN
+
+No `thread_local` or `QThreadStorage` variables found in `src/`. The au3 libraries
+use mutex-protected state (confirmed in `recentfilescontroller.cpp` where
+`m_thumbnailCacheMutex` is used correctly).
+
+## MOAD-0004 (CWE-312 Logged Secret) — CLEAN
+
+OAuth implementation reviewed:
+- `au3cloud/internal/oauthhttpserverreplyhandler.cpp`: `LOGW() << "Invalid request: " << url`
+  fires when an unexpected path is received on the local callback server. The OAuth
+  `code` and `state` params in the URL would only be logged if the path didn't match
+  the registered callback path — which means normal OAuth flow is not logged. Low
+  risk, error path only.
+- `au3cloud/internal/au3cloudservice.cpp`: buildOAuthRequestURL includes
+  client_secret in the URL but this is only passed to platformInteractive()->openUrl()
+  (the system browser), never logged.
+- No `LOGD`/`LOGI` calls found that output access_token or refresh_token.
+
+## MOAD-0005 (Thundering Herd) — CLEAN
+
+`src/project/internal/recentfilescontroller.cpp` thumbnail cache uses
+`m_thumbnailCacheMutex` (std::mutex) correctly at every access site.
+No other cache get+null+compute+put patterns found without synchronization.