# bevy — CLEAN

Scanned 2026-03-30. No CWE-407 defects warranting a patch.

Bevy's engineering choices specifically prevent O(N²) patterns:
- ECS schedule tracking: `FixedBitSet` throughout — O(1) contains
- Asset system: `HashSet<AssetPath>` — O(1)
- Plugin deduplication: `HashSet<String>` / `TypeIdMap` (HashMap) — O(1)
- Query/filter building: `FixedBitSet` — O(1)
- GLTF loader: `HashSet` for animation_roots, visited, etc.

Marginal candidates all bounded by hardware constants or startup-time:
- `bevy_render/slab_allocator.rs:904`: `Vec.iter().position()` in cleanup path; S,V typically 1–5
- `bevy_app/plugin_group.rs:300`: `Vec<TypeId>.iter().find()` on duplicate plugins; startup-only
- `bevy_picking/hover.rs:139`: `Vec<PointerId>.contains()` in retain; P ≤ ~11 hardware pointers