# zulip-0001: CLEAN — no CWE-407 defects found

**Target:** zulip/zulip
**Severity:** N/A
**Status:** CLEAN

## Summary

Scanned `zerver/tornado/event_queue.py` (message fanout / presence broadcast),
`zerver/actions/message_send.py` (per-message UserMessage creation loop), and
`zerver/lib/alert_words.py` (alert-word matching).

All hot-path membership tests use Python `set` / `dict` for O(1) lookup:

- `process_message_event()`: all user-ID sets (`presence_idle_user_ids`,
  `online_push_user_ids`, `muted_sender_user_ids`, etc.) are pre-built as
  `set(event_template.get(..., []))` before the subscriber loop.
- `message_send.py`: `mark_as_read_user_ids`, `mentioned_user_ids`,
  `ids_with_alert_words` are all `set[int]` — O(1) per check.
- `alert_words.py`: uses `ahocorasick.Automaton` (Aho-Corasick) for
  multi-pattern matching — O(text_length) regardless of alert-word count.

No actionable CWE-407 defects identified.