game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems

defects/express/unit/ExpressTest.java

@@ -0,0 +1,20 @@
+package unit;
+
+/**
+ * Express.js CWE-407 scan result: CLEAN.
+ *
+ * Scanned: lib/ (application.js, express.js, request.js, response.js, utils.js, view.js)
+ * No Array.includes(), Array.indexOf(), Array.find(), or Array.findIndex() calls found
+ * inside loops with growing collections.
+ *
+ * All indexOf() hits in lib/ are String.prototype.indexOf() on single strings
+ * (content-type delimiters, param separators, host parsing). These are O(string_length),
+ * not O(collection_size), and are not inside collection-growing loops.
+ *
+ * See: docs/tickets/express-0001-clean.md
+ */
+public class ExpressTest {
+    public static void main(String[] args) {
+        System.out.println("Express.js CLEAN — no CWE-407 defects. No benchmarks to run.");
+    }
+}