superset+metabase: CWE-407 scan — 3 defects in Superset, Metabase CLEAN

Superset:
- superset-0001: SecurityManager._get_pvms_from_builtin_role pvm list dedup O(Regex*PVMs*R) HIGH 8x
- superset-0002: DashboardDAO.update_native_filters_config filter dedup O(M*U) MEDIUM 40x
- superset-0003: import_datasource metric/column dedup O(N^2) list rebuild MEDIUM 68x

Metabase: CLEAN — Clojure backend uses sets/maps throughout for membership tests

defects/metabase/patch/CLEAN.md

@@ -0,0 +1,33 @@
+# Metabase — CWE-407 Scan Result: CLEAN
+
+**Date:** 2026-03-30
+**Target:** Metabase (Clojure + TypeScript/JS frontend)
+**Source:** https://github.com/metabase/metabase (depth=1)
+
+## Scan Summary
+
+Metabase's Clojure backend makes exemplary use of persistent hash sets and maps
+for membership testing throughout. Key observations:
+
+- `graph/core.cljc` uses `LinkedHashSet` (.contains is O(1)) for graph traversal
+- Permission checks use `contains?` on maps/sets (O(1))
+- Dashboard/query code uses `(into #{} ...)` before membership tests
+- Chain filter dedup uses `clojure.set` operations
+- Frontend `.includes()` calls are on small UI-bound arrays (parameters, form fields)
+
+No linear-scan membership test inside a loop found at scale.
+
+## Areas Scanned
+
+- `src/metabase/graph/core.cljc` -- graph walking, transitive closure
+- `src/metabase/security/`, `src/metabase/permissions/` -- permission models
+- `src/metabase/dashboards*/` -- dashboard card/parameter dedup
+- `src/metabase/parameters/chain_filter/` -- join deduplication
+- `src/metabase/sync/` -- database sync
+- `src/metabase/query_processor/` -- query processing pipeline
+- `enterprise/backend/src/` -- enterprise features
+- `frontend/src/metabase/dashboard/` -- frontend selectors
+
+## Verdict
+
+CLEAN -- no CWE-407 defects found.