# UNDF: UNDF-2026-000000358
## Buck2 — CWE-407 Scan Result: CLEAN

Scanned: `app/buck2_build_api/src/`, `app/buck2_query/src/`, `app/buck2_query_impls/src/`,
         `app/buck2_node/src/` (depth=1 clone, 2026-03-27)

### Patterns checked

| Location | Type | Verdict |
|----------|------|---------|
| `query/traversal.rs` L102/109/119 | `visited.contains()` | CLEAN — `std::collections::HashSet` with `StarlarkHasherBuilder` |
| `query/graph/visited.rs` | `Visited.contains()` | CLEAN — custom hash-set wrapper |
| `transitive_set_iterator.rs` | `self.seen.contains()` | CLEAN — `HashSet<ValueIdentity, BuckHasherBuilder>` |
| `build_api/state.rs` | `executed_actions.contains()` | CLEAN — `buck2_hash::BuckHashSet<ActionKey>` |
| `action_executor.rs` | `result_output_paths.contains()` | CLEAN — `HashSet<&BuildArtifactPath>` |
| `query/graph/dfs.rs` | `visited.contains()` | CLEAN — custom O(1) visited tracker |

### Key finding

Buck2's Rust codebase consistently uses `HashSet` (or `BuckHashSet` / `ReferenceOpenHashSet`
wrappers) for all visited-node tracking in build-graph traversal. No `Vec::contains()`
patterns were found in hot graph-traversal paths. Buck2 is architecturally clean with
respect to CWE-407.

No CWE-407 defects found.