kubo (Go IPFS implementation) — CLEAN across all 5 MOADs

Scanned: 2026-03-31
Source: ~/git/kubo (depth=1 clone from https://github.com/ipfs/kubo)
Files: 520 Go source files

MOAD-0001 (CWE-407): CLEAN
  - cid.Set (hash-based) used for GC mark set, pin dedup, refs visited
  - map[string]struct{} used for bootstrap dedup, address filter dedup, announce dedup
  - map[string]int used for refs seen tracking
  - slices.Contains only on fixed-size config lists (5 method names, 4 container inits)
  - Nested loop in filtersRemove (swarm.go) is one-shot CLI config command, trivially small N

MOAD-0002 (Intertangle): No patchable defect
  - IpfsNode is a large god object (30+ fields) but architectural, uses fx DI

MOAD-0003 (Leaked Context): CLEAN
  - No context.WithValue abuse found
  - Uses fx dependency injection for component wiring

MOAD-0004 (Logged Secret): CLEAN
  - Swarm key fingerprint (hash) logged, not key itself
  - API keys passed but never logged
  - HTTPHeaders logged contain only CORS config

MOAD-0005 (Thundering Herd): CLEAN
  - sync.Once for autoconf client singleton
  - fx dependency injection for initialization
  - No unsynchronized cache patterns