# Apache Kylin — CWE-407 Scan Result: CLEAN

Scanned 2026-03-29. No new O(N²) list membership defects found.

Verified:
- `CuboidStats.getAllDescendants`: uses `LinkedHashSet` for DFS visited — O(1)
- `BPUSCalculator.selected`: uses `Set<BigInteger>` — O(1)
- `AclTCR.Column`: is a `TreeSet<String>` — O(log N)
- `OlapContext.allColumns`: is a `HashSet<TblColRef>` — O(1)