# nifi — CWE-407 Scan Result: CLEAN

Scanned 2026-03-29.

## Findings

`StandardControllerServiceReference.findRecursiveReferences` uses `HashSet<ControllerServiceNode>`
as the visited guard — O(1) lookup. All `contains()` calls on `missingComponentIds`,
`versionedClientIds`, etc. operate on `Set<String>` (HashSet-backed) or `List<String>`
with small bounded sizes (reporting tasks, registry clients — typically < 50).

`AbstractPolicyBasedAuthorizer` calls `policy.getUsers().contains(...)` but `getUsers()`
returns a `Set<String>` per policy (confirmed by interface contract).

No graph traversal with ArrayList visited sets found.

**Verdict: CLEAN** — no CWE-407 defects warranting a patch.