# CLEAN — wasmtime

Scanned 2026-03-29 for CWE-407 (algorithmic complexity).

## Findings

- `crates/environ/src/graphs/scc.rs` — SCC algorithm uses `EntitySet` (a sparse set abstraction) for `on_stack`. CLEAN.
- `crates/environ/src/fact/trampoline.rs` — `ancestors: Vec<RuntimeComponentInstanceIndex>` with `.contains()` for reentrance guard: WebAssembly Component Model instance nesting depth is bounded in practice (typically 2–5 levels). Called once per adapter compilation (not per Wasm call). Not actionable.
- `crates/wasmtime/src/compile.rs` — `trampoline_types_seen: HashSet`. CLEAN.
- `crates/environ/src/compile/module_types.rs` — `already_seen: HashMap` for rec group deduplication. CLEAN.

**Result: No actionable CWE-407 defects.**