# matrix-js-sdk — CWE-407 Scan Result: CLEAN

Scanned: 2026-03-30
Source: https://github.com/matrix-org/matrix-js-sdk (depth=1)

## Scan Coverage
- `src/models/room.ts` — room timeline, member list, thread notifications
- `src/models/room-state.ts` — member filtering
- `src/sync.ts` — sync processing, toDevice event handling
- `src/filter-component.ts` — event filter evaluation
- `src/client.ts` — client-level operations
- `src/models/event-timeline-set.ts` — timeline event dedup
- `src/crypto/` — device tracking, key verification

## Findings
All `.includes()` / `.indexOf()` calls found are on:
- Small constant arrays (enum value checks, 2-5 elements)
- `functionalMembers` (service member IDs, typically 0-2)
- `excludedIds` (small exclusion lists)
- `cancelledKeyVerificationTxns` (bounded by single sync response)

No O(N^2) patterns found in hot paths. The codebase correctly uses
Map/Set for large collections and only uses Array.includes() on small,
bounded arrays.