# helm — CWE-407 Scan Result: CLEAN

Scanned: 2026-03-29

## Scope

- `internal/resolver/resolver.go` — dependency resolution: iterates once over `reqs` slice,
  does O(1) map lookups into `repoIndex.Entries`. No nested loops over deps.
- `pkg/action/dependency.go` — `dependencyStatus`: inner `for _, item := range parent.Dependencies()`
  is a bounded per-row search, not called in a hot path (only for `helm dep list` display).
- `internal/chart/v3/dependency.go` — data struct only, no algorithms.
- All `slices.Contains` call sites: on small bounded lists (schemes, protocols, extensions,
  hook policies). None inside per-chart or per-dep loops.

## Verdict

No CWE-407 defects found. The `dependencyStatus` O(D) scan per row is only used in the
human-readable `helm dep list` command output path, not in the hot dependency-resolution loop.