# CLEAN — bevy

Scanned 2026-03-29 for CWE-407 (algorithmic complexity).

## Findings

- `bevy_ecs/src/schedule/graph/graph_map.rs` — cycle detection uses `HashSet` for `blocked` and `maybe_in_more_cycles`. CLEAN.
- `bevy_ecs/src/schedule/graph/dag.rs` — transitive reduction uses `FixedBitSet` for `visited`. CLEAN.
- `bevy_ecs/src/schedule/auto_insert_apply_deferred.rs` — `no_sync_edges` is `BTreeSet`. CLEAN.
- `bevy_ecs/src/schedule/node.rs` — `ambiguous_with_all: &HashSet<NodeId>`, `ignored_ambiguities: &BTreeSet`. CLEAN.
- `bevy_gltf/src/loader/gltf_ext/scene.rs` — uses `FixedBitSet` and `HashSet` for visited tracking. CLEAN.
- `bevy_ui/src/stack.rs` — `visited_root_nodes: Local<HashSet<Entity>>`. CLEAN.
- `bevy_picking/src/hover.rs` — `hover_ancestors: EntityHashSet`. CLEAN.
- `bevy_render/src/view/window/screenshot.rs` — `seen_targets: Local<HashSet<...>>`. CLEAN.
- `bevy_pbr/src/render/light.rs` — `all_cascades_seen: HashSet`. CLEAN.
- `bevy_ecs/src/bundle/info.rs` — `explicit_component_ids: IndexSet<_, FixedHasher>`. CLEAN.
- `bevy_ecs/src/world/entity_access/world_mut.rs` — `contributed_components()` slice `.contains()` called during archetype migration (not per-frame hot path), N bounded to component count per entity. Not actionable.

**Result: No actionable CWE-407 defects.**