game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems

defects/koa/unit/KoaTest.java

@@ -0,0 +1,20 @@
+package unit;
+
+/**
+ * Koa CWE-407 scan result: CLEAN.
+ *
+ * Scanned: lib/ (application.js, context.js, request.js, response.js, only.js,
+ *          is-stream.js, search-params.js)
+ *
+ * Two hits reviewed:
+ *   request.js:262  host.includes('@')        — String method, not Array. Not CWE-407.
+ *   request.js:355  methods.indexOf(this.method) — Fixed 6-element literal array,
+ *                   O(6)=O(1) in practice, not inside a loop. Not CWE-407.
+ *
+ * See: docs/tickets/koa-0001-clean.md
+ */
+public class KoaTest {
+    public static void main(String[] args) {
+        System.out.println("Koa CLEAN — no CWE-407 defects. No benchmarks to run.");
+    }
+}