# UNDF: UNDF-2026-000000353
# beam — CLEAN

Scanned:
- `sdks/java/core` — transforms, values, construction graph, PipelineValidator
- `runners/core-java` — SimplePushbackSideInputDoFnRunner, SideInputHandler, WatermarkManager, TimerUpdate
- `runners/direct-java` — KeyedPValueTrackingVisitor, EvaluationContext, SideInputContainer, DirectRunner
- `runners/flink` — FlinkRunner, SideInputInitializer, FlinkStateInternals
- `runners/spark` — SparkSideInputReader, CachedSideInputReader
- `runners/google-cloud-dataflow-java` — DataflowRunner (experiments List.contains — but O(4) fixed-length, not a loop)
- `sdks/python/apache_beam/transforms/` — Python transforms

All `contains()` calls in hot paths use HashSet, ImmutableSet, or operate on trivially small
fixed-length lists (experiment flags, ~4 items). No CWE-407 defects found.