# pygame — CWE-407 Scan Result: CLEAN

**Scanned:** 2026-03-30
**Scope:** Python layer (`src_py/`), Cython layer (`src_c/cython/`), event C layer (`src_c/event.c`)

## Findings

No CWE-407 defects found in the runtime Python/Cython/C layers.

### Why pygame is clean

- `AbstractGroup` uses `dict` (`spritedict`) for all sprite membership — O(1) `in` checks.
- `Sprite.__g` is a `set` — O(1) group membership.
- Event blocking (`set_blocked`/`get_blocked`) uses SDL's native `SDL_EventState` array — O(1).
- `LayeredUpdates` uses `_spritelayers` dict for layer lookups — O(1).
- `sysfont` module uses `dict` for font registry — O(1).
- `OrderedUpdates._spritelist.remove()` is O(N) but is a single-shot operation, not nested.

The build infrastructure (`buildconfig/`) contains some list membership patterns but these
run once at build time, not in game loops, and are not relevant to runtime complexity.