bottle/gorm/axum/actix-web/gin/fiber: CWE-407 scan; 0 new defects, 4 CLEAN

bottle: CLEAN — routing uses dict (O(1)), plugin dedup via set(), template cache via dict
gorm: CLEAN — ReorderModels uses map[string]bool, schema uses pre-built field maps
axum: CLEAN — MethodFilter is bitmask O(1), protocols use BTreeSet, no hot-path Vec::contains
actix-web: CLEAN — logger uses HashSet, accept-encoding uses HashSet, introspection is startup-only
gin: no new defects beyond gin-0001 (existing)
fiber: no new defects beyond fiber-0001 (existing)

defects/actix-web/patch/CLEAN.md

@@ -1,12 +1,36 @@
-# CLEAN — actix-web
+# CWE-407 Scan — actix-web (Rust web framework)
 
-Scanned 2026-03-29 for CWE-407 (algorithmic complexity).
+**Result: CLEAN**
+**Date: 2026-03-30**
+**Repo:** https://github.com/actix/actix-web (depth=1)
+
+## Scan Summary
+
+Scanned actix-web (actix-web, actix-http, actix-router) for O(N²) list membership
+patterns: Vec::contains in hot paths, visited/seen accumulation, linear dedup.
 
 ## Findings
 
-- `actix-web/src/middleware/logger.rs` — `exclude` is `HashSet<String>`: O(1) per-request lookup. CLEAN.
-- `actix-web/src/http/header/accept_encoding.rs` — `supported_set` collected as `HashSet<&Encoding>` before iteration. CLEAN.
-- `actix-web/src/introspection.rs` — `update_unique` uses `Vec::contains()` for HTTP methods/guards/patterns, but these lists are bounded to <10 items each and only called once at app startup (route registration), not per request. Not actionable.
-- All other `contains()` calls use bitflags, ranges, or string substring checks — not collection membership.
+No CWE-407 defects found.
 
-**Result: No actionable CWE-407 defects.**
+### Key paths examined
+
+| Path | Pattern | Verdict |
+|------|---------|---------|
+| `middleware/logger.rs` | `exclude: HashSet<String>` — O(1) path exclusion per request | CLEAN |
+| `http/header/accept_encoding.rs` | `supported_set: HashSet<_>` — O(1) encoding negotiation | CLEAN |
+| `actix-http/src/requests/head.rs` | `Flags` bitflags — O(1) | CLEAN |
+| `introspection.rs` `update_unique()` | `Vec::contains` but only called at route registration (startup), not per-request | CLEAN* |
+| `actix-router/src/router.rs` | Linear scan over routes — O(R) per request, bounded, not O(N²) | CLEAN |
+
+*Note: `introspection.rs` `update_unique<T>` and `externals.contains()` call
+`Vec::contains` inside loops, but this only runs during application startup (route
+registration phase), not during request handling. The vectors hold HTTP method names
+and route pattern strings — typically O(10) elements. Not a runtime hot path.
+
+### Why actix-web is clean
+
+Per-request hot paths use bitflags and `HashSet` for all membership tests. The one
+`Vec::contains` pattern in `introspection.rs` is confined to startup-time route
+registration and operates on vectors bounded by the number of HTTP methods (9) and
+route patterns defined by the user.

defects/axum/patch/CLEAN.md

@@ -1,12 +1,31 @@
-# CLEAN — axum
+# CWE-407 Scan — axum (Rust web framework)
 
-Scanned 2026-03-29 for CWE-407 (algorithmic complexity).
+**Result: CLEAN**
+**Date: 2026-03-30**
+**Repo:** https://github.com/tokio-rs/axum (depth=1)
+
+## Scan Summary
+
+Scanned axum (axum, axum-core, axum-extra, axum-macros) for O(N²) list membership
+patterns: Vec::contains in loops, visited/seen accumulation, linear dedup.
 
 ## Findings
 
-- `axum/src/extract/ws.rs` — `sec_websocket_protocol: BTreeSet<HeaderValue>`. CLEAN.
-- `axum/src/routing/method_filter.rs` — `MethodFilter` is a `u16` bitfield; `.contains()` is a bitwise AND. CLEAN.
-- `axum/src/routing/method_routing.rs` — `endpoint_filter` is `MethodFilter` bitfield. CLEAN.
-- All other `contains()` calls are substring checks on strings. CLEAN.
+No CWE-407 defects found.
 
-**Result: No actionable CWE-407 defects.**
+### Key paths examined
+
+| Path | Pattern | Verdict |
+|------|---------|---------|
+| `routing/method_filter.rs` | `MethodFilter` is a `u16` bitmask — `contains()` is O(1) bitwise AND | CLEAN |
+| `extract/ws.rs` | `sec_websocket_protocol: BTreeSet<HeaderValue>` — O(log N) | CLEAN |
+| `routing/method_routing.rs:885` | `endpoint_filter.contains(filter)` — bitmask, O(1) | CLEAN |
+| `response/sse.rs` | `EventFlags` bitflags — O(1) | CLEAN |
+| `axum-extra/routing/typed.rs` | `String::contains('?')` — substring check, not collection | CLEAN |
+
+### Why axum is clean
+
+Axum uses bitmask flags (`MethodFilter`, `EventFlags`) for all method/flag membership
+checks — O(1). WebSocket protocol set uses `BTreeSet` (O(log N)). No `Vec::contains`
+call in a hot per-request path was found. The framework follows idiomatic Rust
+conventions throughout.

defects/bottle/patch/CLEAN.md

@@ -1,15 +1,31 @@
-# bottle — CWE-407 Scan: CLEAN
+# CWE-407 Scan — bottle (Python micro web framework)
 
-Scanned: 2026-03-29
+**Result: CLEAN**
+**Date: 2026-03-30**
+**Repo:** https://github.com/bottlepy/bottle (depth=1)
 
-## Scope
+## Scan Summary
 
-- `bottle.py` — Route.all_plugins(): dedup via `unique = set()`
-- Plugin installation/removal: list traversal with no membership dedup inside
-  hot loops
-- Route matching: trie-based router, no list membership checks
+Scanned `bottle.py` (single-file framework) for O(N²) list membership patterns:
+visited/seen list accumulation, `not in list` guards inside loops, and plugin/route dedup.
 
-## Verdict
+## Findings
 
-No CWE-407 (algorithmic complexity / quadratic membership check) defects found.
-Plugin name deduplication uses `set`. No visited/seen lists in traversal paths.
+No CWE-407 defects found.
+
+### Key paths examined
+
+| Path | Pattern | Verdict |
+|------|---------|---------|
+| `Router.match()` | Static routes use `dict` (O(1)), dynamic routes use combined regex | CLEAN |
+| `Route.all_plugins()` | Dedup via `unique = set()` + `unique.add(name)` | CLEAN |
+| `Bottle._mount_app()` | `self._mounts.append(app)` with no inner loop membership check | CLEAN |
+| `SimpleTemplate._include()` | `self.cache[_name]` dict lookup for template inclusion | CLEAN |
+| `_NamespacedImporter.load_module()` | `sys.modules` dict check — O(1) | CLEAN |
+| `Bottle.remove_hook()` | `func in self._hooks[name]` single scan to remove — not in a loop | CLEAN |
+
+### Why bottle is clean
+
+Bottle's routing layer uses Python `dict` for static routes (O(1) lookup). Dynamic routes
+are compiled into combined regexes. Plugin deduplication uses a `set()`. Template inclusion
+uses a per-template dict cache. No accumulating visited-list inside an outer loop was found.

defects/gorm/patch/CLEAN.md

@@ -0,0 +1,34 @@
+# CWE-407 Scan — gorm (Go ORM)
+
+**Result: CLEAN**
+**Date: 2026-03-30**
+**Repo:** https://github.com/go-gorm/gorm (depth=1)
+
+## Scan Summary
+
+Scanned gorm for O(N²) list membership patterns across: schema parsing, migrator,
+callbacks (query, preload, associations, create, update, delete), clause building,
+and utility functions.
+
+## Findings
+
+No CWE-407 defects found.
+
+### Key paths examined
+
+| Path | Pattern | Verdict |
+|------|---------|---------|
+| `migrator.ReorderModels()` | Dedup via `orderedModelNamesMap = map[string]bool{}` | CLEAN |
+| `schema/schema.go` | Field lookups via `FieldsByName`, `FieldsByDBName` maps | CLEAN |
+| `utils.Contains()` | Linear scan, but only called on small config slices (CreateClauses, etc.) | CLEAN |
+| `callbacks/preload.go` | Identity maps using `utils.ToStringKey()` as map key | CLEAN |
+| `callbacks/associations.go` | `cacheKey` map for relationship value dedup | CLEAN |
+| `schema/field.go` | `TagSettings map[string]string` — O(1) tag lookup | CLEAN |
+
+### Why gorm is clean
+
+The migrator's topology sort (`ReorderModels`) uses a `map[string]bool` for
+visited tracking — O(1) per lookup, O(V) total. Schema field and relationship
+lookups use pre-built maps. The `utils.Contains` helper is only called on
+small, configuration-time string slices (typically 1–3 elements: RETURNING clauses).
+No accumulating visited-list inside an outer loop was found.