# Dask — CWE-407 Scan: CLEAN

**Date:** 2026-03-29 (re-scanned; original 2026-03-27)
**Target:** dask/dask (Version 2026.3.0)
**Files scanned:**
- `dask/order.py` — task ordering algorithm
- `dask/optimization.py` — graph fusion, visited nodes
- `dask/base.py` — tokenization, key deduplication
- `dask/_task_spec.py` — task specification graph traversal
- `dask/local.py` — local scheduler
- `dask/blockwise.py` — blockwise layer fusion
- `dask/graph_manipulation.py` — graph cloning / rebinding

## Verdict: CLEAN

All `not in` membership tests in hot graph traversal paths are against
`set`, `dict`, or `frozenset` containers providing O(1) average membership:

- `order.py:237` — `item in result` — dict
- `order.py:325` — `key in runnable_hull or key in result` — set, dict
- `order.py:374` — `path[-2] not in result` — dict
- `order.py:581` — `item in result` — dict
- `optimization.py:62` — `d not in seen` — set
- `optimization.py:156` — `child not in unfusible` — set
- `optimization.py:215` — `key not in fused` — set
- `optimization.py:349` — `key not in output` — set/dict
- `optimization.py:577` — `v not in rdeps` — dict
- `local.py:182` — `key in seen` — set
- `local.py:309` — `dep not in results` — dict
- `blockwise.py:1123` — `layer in seen` — set
- `blockwise.py:1389` — `x in seen` — dict
- `graph_manipulation.py:299` — `layer in omit_layers` — set comprehension
- `base.py:490` — `tok not in repack_dsk` — dict

The only `if x in [...]` patterns found are against constant-size literal
lists (e.g. `mode in ["edge", "linear_ramp"]`, `kind in [p.POSITIONAL_OR_KEYWORD, ...]`)
— these are not hot-path O(N) issues.

No CWE-407 defects found.