diff --git a/defects/am-monitor/CLEAN.md b/defects/am-monitor/CLEAN.md
new file mode 100644
index 000000000..b1249aa5c
--- /dev/null
+++ b/defects/am-monitor/CLEAN.md
@@ -0,0 +1,22 @@
+# am-monitor — CWE-407 Scan Result: CLEAN
+
+**Project:** APMonitor — on-premises network monitoring (single Python file, YAML config, SNMP/HTTP/ping/TCP/UDP/QUIC checks, RRD graphs)
+**Source:** /home/fox/git/APMonitor (fox's project, Commons Clause + GPLv3)
+**Scanner:** CWE-407 exhaustive keyword scan
+**Date:** 2026-03-30
+**Result:** CLEAN — no algorithmic complexity defects found
+
+## Scan Details
+
+Scanned `APMonitor.py` (3717 lines) for linear membership tests inside loops (O(N^2) patterns).
+
+### Key Findings
+
+- **monitor_names** (line 480): Already uses `set()` for duplicate name detection — O(1) membership.
+- **all_indices** (line 2822): Uses `set()` union for port change detection — O(1) membership.
+- **snmp_monitors** (line 3272): Uses `dict` for SNMP monitor deduplication — O(1) lookup.
+- **interfaces** (lines 1544, 1570, 1598): Uses `dict` keyed by interface index — O(1) lookup.
+- All `in` checks against lists are on small constant-size collections (boolean values, monitor types, HTTP methods, file extensions) — bounded, not CWE-407.
+- No growing lists are used for membership tests inside loops.
+
+The codebase demonstrates good data structure choices throughout — sets and dicts where membership tests occur in loops.