# samza — CWE-407 Scan Result: CLEAN

Scanned 2026-03-29.

## Findings

`JobGraph.findReachable()` and `topologicalSort()` use `HashSet<JobNode>` for visited
tracking. `JobNode.findReachableOperators()` uses `Set<OperatorSpec>` (HashSet).
`PollingScanDiskSpaceMonitor.getSpaceUsed()` uses `Set<Path>` (HashSet).
`GroupByContainerIds.group()` uses `Set<TaskName>` (HashSet) for `assignedTasks`.
`IntermediateStreamManager` uses `Set<StreamSet>` (HashSet) for `processedStreamSets`.

No ArrayList-based visited/seen patterns found.

**Verdict: CLEAN** — no CWE-407 defects warranting a patch.