# synapse — CWE-407 Scan: CLEAN

Scanned: 2026-03-29

## Scope

- `synapse/push/mailer.py` — `deduped_ordered_list`: `seen = set()` (line 939)
- `synapse/storage/databases/main/event_push_actions.py` — `seen_thread_ids`: `set()` based
- Event DAG traversal / state resolution: checked state_resolution_v2.py, event_federation.py
- Room auth chain computation: uses set-based seen throughout

## Verdict

No CWE-407 (algorithmic complexity / quadratic membership check) defects found.
All deduplication in push notification, event DAG traversal, and state
resolution uses `set` or `dict` structures. No list-based visited patterns in
hot paths.