package unit; /** * Koa CWE-407 scan result: CLEAN. * * Scanned: lib/ (application.js, context.js, request.js, response.js, only.js, * is-stream.js, search-params.js) * * Two hits reviewed: * request.js:262 host.includes('@') — String method, not Array. Not CWE-407. * request.js:355 methods.indexOf(this.method) — Fixed 6-element literal array, * O(6)=O(1) in practice, not inside a loop. Not CWE-407. * * See: docs/tickets/koa-0001-clean.md */ public class KoaTest { public static void main(String[] args) { System.out.println("Koa CLEAN — no CWE-407 defects. No benchmarks to run."); } }