wekan+rocketchat: 3 defects, all 5 MOADs scanned
wekan-0003: MOAD-0001 wekanCreator.js member dedup uses Array.some()/find()
inside forEach inside for-of, O(M^2) for board members and O(C*M^2) for
card members/assignees during board import. Fix: Set-based dedup O(1).
58.8x op-count reduction (board), 5.6x (cards). 4/4 PASS.
rocketchat-0003: MOAD-0001 endDirectCall() calls call.users.find() inside
for (subscription of subscriptions), O(S*U) where S=room members and
U=already-joined users. Fix: build Set before loop for O(1) lookup.
100x speedup modeled at S=10000, J=100. 5/5 PASS.
rocketchat-0004: MOAD-0004 CWE-312 oauth2-server/model.ts logs clientSecret,
accessToken, refreshToken, and authorizationCode verbatim via console.log
when debug=true. Fix: replace credential values with [REDACTED] sentinel.
Wekan MOAD-0002/0003/0004/0005 CLEAN (Meteor 3.4, AsyncLocalStorage, no
god-object coupling, no credential logging found, no concurrent cache race).
Rocket.Chat MOAD-0002/0003/0005 CLEAN (Meteor 3.3.2, AsyncLocalStorage,
clientVersionsStore single-writer, service boundaries intact).
russell@unturf.com
60b0999acd