openai-python, httpx, pydantic, tiktoken, openai-node — no CWE-407 defects. All targets use proper dict/set/frozenset for membership tests in hot paths.
