# dendrite — CWE-407 Scan: CLEAN

Scanned: 2026-03-29

## Scope

- `roomserver/internal/query/query.go` — GetAuthChain: `authEventsMap = make(map[string]gomatrixserverlib.PDU)` (map-based dedup)
- `roomserver/internal/helpers/auth.go` — GetAuthEvents, loadAuthEvents: map-based
- `roomserver/internal/input/input_events.go` — fetchAuthEvents: map-based
- Federation auth chain traversal throughout: all use Go `map[string]T` for O(1) key lookup

## Verdict

No CWE-407 (algorithmic complexity / quadratic membership check) defects found.
All room auth chain and event DAG traversal in Dendrite uses Go `map` for O(1)
deduplication. No slice-based linear scans in hot traversal paths.