# Rails — CWE-407 Diamond Traversal Scan: CLEAN

Scanned: 2026-03-30

## Files examined

- `activesupport/lib/active_support/concern.rb` — `append_features`/`prepend_features` use `base < self` guard before processing dependencies; prevents re-inclusion
- `railties/lib/rails/initializable.rb` — `ancestors.reverse_each` iterates Ruby's linearized MRO (C3, no duplicates); not recursive
- `activemodel/lib/active_model/translation.rb` — `lookup_ancestors` calls `ancestors.select {...}` which is a flat MRO traversal
- `activerecord/lib/arel/visitors/visitor.rb` — `object.class.ancestors.find {...}` is a flat MRO traversal

## Result

No diamond recursion defects found. Rails uses Ruby's built-in `ancestors` (which returns the
C3-linearized MRO with no duplicates) rather than manually recursing through `__bases__`
equivalents. `ActiveSupport::Concern` is properly guarded against diamond re-inclusion via
the `base < self` subclass check.