# UNDF: UNDF-2026-000000528
# samza — CLEAN

Scanned:
- `samza-core/src/main/java/org/apache/samza/execution/` — JobGraph, JobNode, IntermediateStreamManager
- `samza-core/src/main/java/org/apache/samza/container/grouper/` — GroupByContainerIds, SSPGrouperProxy, GroupByPartition
- `samza-core/src/main/java/org/apache/samza/clustermanager/` — StandbyContainerManager

JobGraph.topologicalSort() and findReachable() use `Set<JobNode> visited = new HashSet<>()` —
O(1) membership test. GroupByContainerIds uses `Set<TaskName> assignedTasks = new HashSet<>()`.
StandbyContainerManager resourceRequests is a `HashSet<SamzaResourceRequest>`.

No CWE-407 defects found.