# grafana — CWE-407 Scan Result: CLEAN

Scanned 2026-03-29.

## Findings

`FolderTree.Contains` uses a map index (O(1)). `ResourcePermission.Contains` is
O(|Actions| × |targetActions|) but both are small fixed permission sets (< 20 items)
and the function is not called in a tight loop over large collections.

`ManagedRoutes.Contains` is a linear scan but is not called in an outer loop.

`Wildcards.Contains` walks a sorted slice of wildcard scopes — bounded by the number
of resource permission types (< 50).

**Verdict: CLEAN** — no CWE-407 defects warranting a patch.