# Apache Pinot — CWE-407 Scan Result: CLEAN

Scanned 2026-03-29. No new O(N²) list membership defects found.

Verified:
- `SpecialOperations.isFinite`: uses `HashSet<State>` for path and visited — O(1)
- `DispatchablePlanVisitor._visited`: uses `Set.add()` for dedup — O(1)
- `GroupedStages`: uses `SortedSet<MailboxSendNode>` (TreeSet) — O(log N)
- `PinotInstanceRestletResource.visitedInstances`: is `HashSet<String>` — O(1)