# Haystack - CWE-407 Scan Result: CLEAN

Scanned: 2026-03-30
Target: https://github.com/deepset-ai/haystack (depth=1)
Focus: pipeline component dedup, document store dedup, retriever result dedup, node connection membership

## Findings

No CWE-407 defects found. The codebase uses appropriate data structures throughout:

- Pipeline scheduler uses `set()` for `scheduled_components` (async_pipeline.py:214)
- Breakpoint validation uses `set()` for component validation (breakpoint.py:97,100)
- Document store uses `dict` for ID lookups (in_memory/document_store.py)
- Embedding dedup uses `dict` for `doc_ids_to_embeddings`
- Graph nodes/edges use NetworkX dict-based adjacency
- `model_names` equivalent lookups use dict views

The deepset team has made good data structure choices. No linear-scan-in-loop patterns found on any hot path.