# bottle — CWE-407 Scan: CLEAN

Scanned: 2026-03-29

## Scope

- `bottle.py` — Route.all_plugins(): dedup via `unique = set()`
- Plugin installation/removal: list traversal with no membership dedup inside
  hot loops
- Route matching: trie-based router, no list membership checks

## Verdict

No CWE-407 (algorithmic complexity / quadratic membership check) defects found.
Plugin name deduplication uses `set`. No visited/seen lists in traversal paths.