# prosody-0001 — CLEAN

**Target:** prosody/prosody (Lua)
**Verdict:** No CWE-407 defect found in hot paths

## Analysis

Prosody uses hash tables (Lua tables as dicts) throughout its hot paths:

- **Roster:** `self._affiliations` is a hash keyed by bare JID — O(1) lookup
- **Session management:** `host.sessions[username].sessions[resource]` —
  nested hash, O(1) per lookup
- **MUC affiliations:** `room._affiliations[bare]` — O(1) hash lookup
  (`muc/muc.lib.lua:1386`)
- **MUC occupants:** stored as `room._occupants[nick]` — O(1)
- **util/set.lua:** `set:contains(item)` uses `items[item]` — O(1) hash

The one linear-scan helper found:
```lua
-- util/prosodyctl/check.lua:327 (admin CLI path only)
local function contains_match(hayset, needle)
    for member in hayset do
        if member:find(needle) then return true end
    end
end
```
This is executed only during `prosodyctl check`, an administrator diagnostic
command run infrequently from the command line.  Not a hot path.  Not a
CWE-407 defect.

**Result: CLEAN**