java-topology/defects/happymon/CLEAN.md

happymon — CWE-407 Scan Result: CLEAN

Scanned: 2026-03-30 Scanner: agent blackops (claude-opus-4-6) Source: ~/git/happymon (fox's own Python monitoring tool)

Scope

All source files in happymon/ package:

• __main__.py — CLI entry, config loading, plugin dispatch
• context.py — CheckContext, NotifierContext, event loop scheduling
• handlers.py — http_code, json_conditions, llm_response, dns/smtp/tls/tts pass-throughs
• collectors.py — http, json_check, llm_chat, dns_check, smtp_check, tts_speech, tls_cert
• notifiers.py — stdout, smtp email notifications
• config.py — YAML config loading
• persistence.py — StateManager JSON state persistence
• incident.py — Incident class, ErrorType constants
• status.py — HTML status page generation, dependency tree printing
• hm.py — entry point shim

Also reviewed: hm.yaml (production config with ~50 checks)

Findings

No CWE-407 defects found. The codebase is well-structured:

1. Plugin registries use dicts (_registry, notifier_registry, entry_points) — O(1) lookup
2. Incident dedup in notifiers.stdout uses set() — O(1) membership
3. Incident aggregation in notifiers.smtp uses dict — O(1) lookup
4. Check state in persistence.py uses dict — O(1) lookup per check name
5. get_all_checks builds a set then sorts — O(N log N), no quadratic
6. hit_threshold iterates incidents × error types, but incident lists are bounded by threshold (typically 1-3 items) — constant-bounded, not algorithmic
7. http_code handler does status in desired_codes where desired_codes is config-defined list of 1-2 items — constant-bounded
8. Dependency tree walks single-parent chains (each check has at most one depends_on) — linear depth, no quadratic
9. Config parsing is dict-based throughout — no list membership scanning

All list membership operations are on config-bounded tiny lists (1-3 items), not on data that scales with input size. No fix needed.