CWE-407 array scans exist but bounded by Bitcoin consensus (p2ms max n=20, taptree max depth 128). No adversarial scaling possible. No intertangle, leaked context, logged secrets, or thundering herd.