# CLEAN — gRPC (multi-language)
Scanned 2026-03-29 for CWE-407.

## Scope

- Java source: `examples/android/helloworld/` only (no Java RPC core in this clone)
- C++ core: `core/lib/`, `src/core/` — service resolution, call handling

## Findings

gRPC's Java implementation in this repository is limited to example code. The core RPC runtime is implemented in C++ and uses protobuf-generated descriptors with flat-array or hash-map lookups for service and method resolution. No quadratic list-membership pattern was found in:

- Method descriptor building (protobuf ServiceDescriptor uses array indexing)
- Service type resolution (registry uses hash map)
- Call filter/interceptor chains (fixed-size arrays assembled at startup)

**Result: No actionable CWE-407 defects.**