# Rhythmbox - CWE-407 Scan Result: CLEAN

Scanned: 2026-03-30
Source: https://github.com/GNOME/rhythmbox (depth=1)

## Scan Summary

Rhythmbox uses GLib hash tables throughout for membership testing:

- **Database entries**: `g_hash_table` for entry storage and lookup
- **Property model**: `g_hash_table` (reverse_map) + `g_sequence` (balanced tree) for properties
- **Keyword tracking**: `g_hash_table` for keyword-to-entry mapping
- **Playlist membership**: `g_hash_table` via `rb_playlist_source_location_in_map`
- **Changed entries**: `g_hash_table` for tracking changes
- **Import dedup**: `g_hash_table` for added/deleted entry tracking

The `rb_string_list_contains` calls (linear GList scan) are used only for
mount-point lists which are bounded to a handful of entries (typically 2-5
filesystem mount points).

The `g_list_find` calls in display-page-model operate on DnD target atom
lists (bounded by GTK target types, ~10 max).

No CWE-407 defects found.