# etcd — CWE-407 Deep Scan: CLEAN

**Date:** 2026-03-30
**Scanned areas:**
- server/auth/ — interval tree (adt.IntervalTree) for permission checking, O(log N)
- server/lease/ — map[LeaseID]*Lease and map[LeaseItem]LeaseID for O(1) lookup
- server/storage/mvcc/ — watcherSet (map[*watcher]struct{}), interval tree for key ranges
- server/storage/backend/ — bucketBuffer.dedupe() uses sort+unique O(N log N)
- server/etcdserver/api/membership/ — map[types.ID]*Member and map[types.ID]bool
- server/etcdserver/api/v3rpc/watch.go — map-based watch ID tracking
- server/etcdserver/api/v2store/ — set.StringSet (map-backed) for readonlySet
- server/proxy/grpcproxy/ — map[*watchBroadcast]struct{} and map[*watcher]*watchBroadcast
- client/v3/ — no linear membership patterns

**Conclusion:** etcd uses maps, interval trees, and proper O(1)/O(log N) data structures
throughout its hot paths. The only `slices.Contains` calls are in startup/config code
with small fixed-size inputs. No CWE-407 defects found.