# consul — CWE-407 Scan Result: CLEAN

Scanned: 2026-03-29

## Scope

- `agent/consul/discoverychain/` — service discovery chain compilation: uses
  `map[string]struct{}` for visited sets and a proper `stringStack` (slice with Push/Pop).
  No O(N²) membership checks.
- `agent/structs/` — config entry validation: uses `map[string]bool` / `map[string]struct{}`
  for seen-address dedup.
- `agent/xds/` — Envoy cluster/listener building: uses `map[string]struct{}` for dedup.
- `internal/go-sso/` — `StrListContains` usage: only called on small, bounded slices (3-element
  localhost list, short allowed-URI lists). Not inside a loop.
- `lib/stringslice/Contains` — all call sites checked; none inside an outer loop over the same
  or related collection.

## Verdict

No CWE-407 defects found. Consul's service graph and discovery chain use proper hash-set
visited structures throughout.