# cayley — CWE-407 Scan Result: CLEAN

Scanned: 2026-03-29

## Scope

- `graph/iterator/recursive.go` — `Recursive.Next`: uses `map[interface{}]seenAt` for visited
  tracking. The `seen[key]` lookup is O(1) hash map. BFS/DFS traversal is O(V+E). Correct.
- `graph/iterator/fixed.go` — `Fixed.Contains`: linear scan over fixed set, but only used for
  small seed sets, not in an outer loop.
- All `Contains` methods in iterator package: graph iterator interface, not list-membership
  inside outer traversal loops.

## Verdict

No CWE-407 defects found. Cayley's recursive graph iterator uses a proper `map[interface{}]seenAt`
hash map for cycle detection and visited-node tracking.