# CLEAN — Google Guice
Scanned 2026-03-29 for CWE-407 (algorithmic complexity).

## Scope
Module scanned: core/src (binding processor, injection point resolution, type listener store,
provision listener store, cycle-detecting lock, annotations).

## Findings

### MembersInjectorStore — alreadySeenListeners.contains()
`alreadySeenListeners` is declared `Set<TypeListener> alreadySeenListeners = Sets.newHashSet()`.
O(1) membership checks. Clean.

### BindingSourceRestriction — currentModulePermits.contains()
`currentModulePermits` is `ImmutableSet<Class<? extends Annotation>>`. O(1). Clean.

### AbstractBindingProcessor — FORBIDDEN_TYPES.contains()
`FORBIDDEN_TYPES` is an `ImmutableSet`. O(1). Clean.

### ProvisionListenerCallbackStore — INTERNAL_BINDINGS.contains()
`INTERNAL_BINDINGS` is an `ImmutableSet<Key<?>>`. O(1). Clean.

### InjectorJitBindingData — failedJitBindings.contains(), bannedKeys.contains()
Both fields are `Set` implementations. Clean.

## Result
**CLEAN. No actionable CWE-407 defects found in Google Guice.**