# dgl — CWE-407 Scan: CLEAN

Scanned: 2026-03-29

## Scope

- `python/dgl/traversal.py` — BFS/DFS: delegates to C++ backend, no Python-level visited list
- `python/dgl/nn/pytorch/explain/subgraphx.py` — MCTS node selection: no visited list
- `python/dgl/graphbolt/impl/ondisk_dataset.py` — dataset loading: no graph traversal
- `python/dgl/graphbolt/internal/utils.py` — utility functions: no membership checks
- `python/dgl/nn/pytorch/network_emb.py` — random walk sampling: delegates to C++

## Verdict

No CWE-407 (algorithmic complexity / quadratic membership check) defects found.
Core graph traversal (BFS, DFS, topological sort) is implemented in the C++
backend. Python-level code uses no list-based visited/seen patterns in hot
paths.