OpenRA — ALL 5 MOADs CLEAN

Target: https://github.com/OpenRA/OpenRA (C# RTS game engine)
Scanned: 2026-03-31
Files: 1509 .cs files

MOAD-0001 (CWE-407): CLEAN
  OpenRA is exceptionally well-optimized for collection membership:
  - FrozenSet<string> used throughout for config-driven type checks
    (AirUnitsTypes, NavalUnitsTypes, ExcludeFromSquadsTypes, ProtectionTypes,
    CaptorTypes, VeinholeActors, AllowedTerrainTypes, etc.)
  - HashSet<Actor> for activeUnits, reserves, selection actors
  - HashSet<CPos> for veinholeCells, accessibleCells, DisabledSpawnPoints
  - Binary search in TraitDictionary for actor-trait lookups
  - CellLayer bounds checks (not list membership) for Map.Contains()
  - PERF comments throughout showing developer awareness of hot paths
  - Only List.Contains found on small, bounded collections (rolloverActors,
    controlGroups with <50 user-selected units, Repairers with <4 players)

MOAD-0002 (Intertangle): CLEAN
  Trait-based entity component system. State attached to actors via traits,
  not shared through global mutable state. Static caches (ChromeProvider,
  ChromeMetrics, TextNotificationsManager) are UI singletons with
  initialization-time or single-writer patterns.

MOAD-0003 (Leaked Context): CLEAN
  Single ThreadLocal<PerfTimer> used for diagnostic performance profiling
  (PerfTimer.cs), not request-scoped identity. Game logic runs on a single
  thread.

MOAD-0004 (CWE-312): CLEAN
  Server logs fingerprints (public identifiers), profile names, UIDs, and
  endpoints. No private keys, passwords, auth tokens, or signatures are
  logged. AuthSignature and AuthToken are verified but never written to logs.

MOAD-0005 (Thundering Herd): CLEAN
  Game logic is single-threaded. Multi-threaded subsystems (graphics,
  sound, network) use proper lock() synchronization (85 lock sites across
  20 files). ConcurrentCache for thread-safe caching. GetOrAdd pattern
  used on single-threaded game logic paths only.