# Presto CWE-407 Scan Result: CLEAN

## Scan Date
2026-03-30

## Scope
`presto-main-base/src/main/java/com/facebook/presto/`

## Findings

No CWE-407 defects found. Presto (Facebook fork) has largely migrated to `ImmutableSet` and
`HashSet` for membership-test hot paths.

### Key structures verified

| Structure | Location | Type | Status |
|-----------|----------|------|--------|
| `keysSeen` | `PlannerUtils.java:142` | `HashSet<>` | CLEAN |
| `typeOnlyCoercions` | `ExpressionAnalyzer.java:224` | `LinkedHashSet<>` | CLEAN |
| `groupingFields` | `AggregationAnalyzer.java:110` | `Set<FieldId>` | CLEAN |
| `usedColumnsSet` | `CteProjectionAndPredicatePushDown.java:320` | `HashSet<>` | CLEAN |
| `referencedOutputs` | `PruneValuesColumns.java:42` | `Set<>` (parameter) | CLEAN |
| `names` | `StatementAnalyzer.java:1488` | `HashSet<>` | CLEAN |
| `excludedNames` | `RowExpressionVariableInliner.java:33` | `HashSet<>` | CLEAN |
| `processedNodes` | `PlanNodeStatsSummarizer.java:101` | `HashSet<>` | CLEAN |