# UNDF: UNDF-2026-000000394
# fish — CLEAN

## Scan Date

2026-03-27

## Files Scanned

- `src/complete.rs` (completion dedup, wrap targets)
- `src/exec.rs` (process execution)

## Findings

No CWE-407 defects found. Fish shell has been rewritten in Rust and uses
appropriate data structures throughout.

### Completion dedup (`unique_completions_retaining_order`)

Uses `HashSet::insert()` for O(1) per-element dedup — correct.

### Completion tombstones (`COMPLETION_TOMBSTONES`)

`BTreeSet<WString>` — O(log N) lookup — not O(N). Correct.

### Wrap targets (`complete_add_wrapper`)

`Vec::contains()` on per-command wrapper list. The list is bounded by the
number of wraps registered for a single command (typically 1-5). Not a
cross-product loop. Correct.

### Verdict

CLEAN — no algorithmic complexity defects in scanned code paths.