minio: 3 CWE-407 defects; etcd: CLEAN (deeper scan)

minio-0001: healingTracker.isHealed() slices.Contains O(B×H) MEDIUM 25x
minio-0002: isBucketDecommissioned() slices.Contains O(P×D) MEDIUM 24x
minio-0003: isGroupDescEqual/isUserInfoEqual slices.Contains O(M²) MEDIUM 13x
etcd: maps + interval trees throughout; no CWE-407 defects found

defects/etcd/patch/CLEAN.md

@@ -0,0 +1,17 @@
+# etcd — CWE-407 Deep Scan: CLEAN
+
+**Date:** 2026-03-30
+**Scanned areas:**
+- server/auth/ — interval tree (adt.IntervalTree) for permission checking, O(log N)
+- server/lease/ — map[LeaseID]*Lease and map[LeaseItem]LeaseID for O(1) lookup
+- server/storage/mvcc/ — watcherSet (map[*watcher]struct{}), interval tree for key ranges
+- server/storage/backend/ — bucketBuffer.dedupe() uses sort+unique O(N log N)
+- server/etcdserver/api/membership/ — map[types.ID]*Member and map[types.ID]bool
+- server/etcdserver/api/v3rpc/watch.go — map-based watch ID tracking
+- server/etcdserver/api/v2store/ — set.StringSet (map-backed) for readonlySet
+- server/proxy/grpcproxy/ — map[*watchBroadcast]struct{} and map[*watcher]*watchBroadcast
+- client/v3/ — no linear membership patterns
+
+**Conclusion:** etcd uses maps, interval trees, and proper O(1)/O(log N) data structures
+throughout its hot paths. The only `slices.Contains` calls are in startup/config code
+with small fixed-size inputs. No CWE-407 defects found.