# Metabase — CWE-407 Scan Result: CLEAN

**Date:** 2026-03-30
**Target:** Metabase (Clojure + TypeScript/JS frontend)
**Source:** https://github.com/metabase/metabase (depth=1)

## Scan Summary

Metabase's Clojure backend makes exemplary use of persistent hash sets and maps
for membership testing throughout. Key observations:

- `graph/core.cljc` uses `LinkedHashSet` (.contains is O(1)) for graph traversal
- Permission checks use `contains?` on maps/sets (O(1))
- Dashboard/query code uses `(into #{} ...)` before membership tests
- Chain filter dedup uses `clojure.set` operations
- Frontend `.includes()` calls are on small UI-bound arrays (parameters, form fields)

No linear-scan membership test inside a loop found at scale.

## Areas Scanned

- `src/metabase/graph/core.cljc` -- graph walking, transitive closure
- `src/metabase/security/`, `src/metabase/permissions/` -- permission models
- `src/metabase/dashboards*/` -- dashboard card/parameter dedup
- `src/metabase/parameters/chain_filter/` -- join deduplication
- `src/metabase/sync/` -- database sync
- `src/metabase/query_processor/` -- query processing pipeline
- `enterprise/backend/src/` -- enterprise features
- `frontend/src/metabase/dashboard/` -- frontend selectors

## Verdict

CLEAN -- no CWE-407 defects found.