From 76d8ae869443ff05268639b78f73f65ed6728f9b Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan <owen-mc@github.com>
Date: Tue, 7 Jul 2026 10:59:21 +0100
Subject: [PATCH] Add `MISSING:` tag

---
 .../BadLocking/UnintendedDeclaration.cpp      |  2 +-
 .../NoCheckBeforeUnsafePutUser/test.cpp       |  6 +--
 .../AllocMultiplicationOverflow/test.cpp      |  2 +-
 .../CWE/CWE-193/array-access/test.cpp         |  2 +-
 .../Security/CWE/CWE-200/test3/test.cpp       |  4 +-
 .../CWE/CWE-369/semmle/tests/test.cpp         | 10 ++---
 .../CWE/CWE-377/semmle/tests/test.cpp         |  2 +-
 .../CWE/CWE-754/semmle/tests/test.cpp         |  2 +-
 .../Best Practices/GuardedFree/test.cpp       |  4 +-
 .../OffsetUseBeforeRangeCheck/test.cpp        | 12 +++---
 .../UnusedStaticFunctions/extraction_error.c  |  2 +-
 .../query-tests/Critical/MemoryFreed/test.cpp |  4 +-
 .../Critical/MemoryFreed/test_free.cpp        | 12 +++---
 .../Critical/MissingCheckScanf/test.cpp       |  6 +--
 .../Critical/MissingNullTest/test.cpp         |  4 +-
 .../query-tests/Critical/NewFree/test.cpp     |  2 +-
 .../Critical/OverflowCalculated/tests1.cpp    | 12 +++---
 .../Critical/OverflowCalculated/tests2.cpp    | 16 +++----
 .../Critical/OverflowCalculated/tests3.cpp    |  2 +-
 .../Critical/OverflowStatic/test.c            | 16 +++----
 .../Critical/OverflowStatic/test.cpp          |  8 ++--
 .../query-tests/Critical/SizeCheck/test2.c    |  4 +-
 .../Rule 30/FunctionPointerConversions/test.c |  4 +-
 .../BadAdditionOverflowCheck/templates.cpp    |  2 +-
 .../Arithmetic/BitwiseSignCheck/bsc.cpp       |  2 +-
 .../Arithmetic/ComparisonPrecedence/test.cpp  |  2 +-
 .../Arithmetic/IntMultToLong/Buildless.c      |  4 +-
 .../Arithmetic/IntMultToLong/IntMultToLong.c  |  6 +--
 .../PointlessComparison/PointlessComparison.c |  4 +-
 .../Conversion/ArrayArgSizeMismatch/test.cpp  |  2 +-
 .../LossyFunctionResultCast/test.cpp          |  8 ++--
 .../Likely Bugs/Format/NonConstantFormat/a.c  |  2 +-
 .../Likely Bugs/Format/NonConstantFormat/b.c  |  4 +-
 .../Format/NonConstantFormat/test.cpp         |  2 +-
 .../Format/SnprintfOverflow/test.cpp          |  2 +-
 .../Format/WrongNumberOfFormatArguments/a.c   |  4 +-
 .../Format/WrongNumberOfFormatArguments/b.c   |  4 +-
 .../Format/WrongNumberOfFormatArguments/c.c   |  4 +-
 .../WrongNumberOfFormatArguments/test.c       |  2 +-
 .../Buildless/second.cpp                      |  4 +-
 .../Linux_signed_chars/a.c                    |  2 +-
 .../Linux_signed_chars/b.c                    |  4 +-
 .../DubiousNullCheck/DubiousNullCheck.cpp     |  4 +-
 .../ExprHasNoEffect/templatey.cpp             |  4 +-
 .../inconsistentLoopDirection.cpp             |  6 +--
 .../AllocaInLoop/BoundedLoop.cpp              |  2 +-
 .../ImproperNullTermination/test.cpp          | 18 ++++----
 .../PointerOverflow/test.cpp                  |  2 +-
 .../StrncpyFlippedArgs/test.cpp               |  2 +-
 .../SuspiciousCallToMemset/test.cpp           |  6 +--
 .../SuspiciousCallToStrncat/test.c            |  8 ++--
 .../RedundantNullCheckSimple.cpp              |  8 ++--
 .../Underspecified Functions/test.c           |  2 +-
 .../Likely Bugs/UseInOwnInitializer/test.cpp  |  2 +-
 .../query-tests/Security/CWE/CWE-014/test.c   | 42 +++++++++----------
 .../query-tests/Security/CWE/CWE-014/test.cpp | 22 +++++-----
 .../UncontrolledProcessOperation/test.cpp     |  4 +-
 .../Security/CWE/CWE-119/SAMATE/test.cpp      | 10 ++---
 .../semmle/tests/test_buffer_overrun.cpp      |  6 +--
 .../CWE/CWE-119/semmle/tests/tests.cpp        |  2 +-
 .../CWE-119/semmle/tests/var_size_struct.cpp  |  4 +-
 .../CWE/CWE-120/semmle/tests/tests2.cpp       |  2 +-
 .../CWE/CWE-120/semmle/tests/unions.c         |  4 +-
 .../NoSpaceForZeroTerminator/test2.cpp        |  4 +-
 .../semmle/ArithmeticUncontrolled/test.c      | 10 ++---
 .../semmle/ArithmeticUncontrolled/test.cpp    |  6 +--
 .../semmle/ArithmeticWithExtremeValues/test.c | 12 +++---
 .../semmle/TaintedAllocationSize/test.cpp     |  8 ++--
 .../query-tests/Security/CWE/CWE-193/test.cpp | 36 ++++++++--------
 .../query-tests/Security/CWE/CWE-295/test.cpp |  4 +-
 .../CWE/CWE-311/semmle/tests/test3.cpp        |  4 +-
 .../query-tests/Security/CWE/CWE-327/test.cpp | 22 +++++-----
 .../Security/CWE/CWE-327/test2.cpp            | 16 +++----
 .../Security/CWE/CWE-367/semmle/test2.cpp     |  8 ++--
 .../tests/IteratorToExpiredContainer/test.cpp |  6 +--
 .../semmle/tests/UseAfterFree/test.cpp        | 20 ++++-----
 .../test.cpp                                  |  4 +-
 .../CWE/CWE-457/semmle/tests/test.cpp         |  6 +--
 .../SuspiciousAddWithSizeof/buildless.cpp     |  4 +-
 .../Security/CWE/CWE-611/tests4.cpp           |  4 +-
 .../Security/CWE/CWE-611/tests5.cpp           |  4 +-
 .../CWE-807/semmle/TaintedCondition/test.cpp  |  8 ++--
 .../query-tests/Security/CWE/CWE-843/test.cpp |  6 +--
 .../4.10 Classes/AV Rule 79/DeleteThis.cpp    |  4 +-
 .../jsf/4.10 Classes/AV Rule 79/QObject.cpp   |  2 +-
 .../jsf/4.21 Operators/AV Rule 164/test.c     |  6 +--
 .../jsf/4.21 Operators/AV Rule 165/test.c     |  2 +-
 87 files changed, 284 insertions(+), 284 deletions(-)

diff --git a/cpp/ql/test/examples/BadLocking/UnintendedDeclaration.cpp b/cpp/ql/test/examples/BadLocking/UnintendedDeclaration.cpp
index 48f279c8335..5f8bcb25ec3 100644
--- a/cpp/ql/test/examples/BadLocking/UnintendedDeclaration.cpp
+++ b/cpp/ql/test/examples/BadLocking/UnintendedDeclaration.cpp
@@ -86,7 +86,7 @@ public:
 
 	void test7()
 	{
-		Lock<Mutex>(memberMutex); // BAD (creates an uninitialized variable called `memberMutex`, probably not intended) [NOT DETECTED]
+		Lock<Mutex>(memberMutex); // $ MISSING: Alert // BAD (creates an uninitialized variable called `memberMutex`, probably not intended) [NOT DETECTED]
 
 		// ...
 	}
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/test.cpp
index f474b33c65d..287e1c67449 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/test.cpp
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/test.cpp
@@ -19,7 +19,7 @@ void test1(int p)
 {
 	sys_somesystemcall(&p);
 
-	unsafe_put_user(123, &p); // BAD [NOT DETECTED]
+	unsafe_put_user(123, &p); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 void test2(int p)
@@ -40,7 +40,7 @@ void test3()
 
 	sys_somesystemcall(&v);
 
-	unsafe_put_user(123, &v); // BAD [NOT DETECTED]
+	unsafe_put_user(123, &v); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 void test4()
@@ -68,7 +68,7 @@ void test5()
 
 	sys_somesystemcall(&myData);
 
-	unsafe_put_user(123, &(myData.x)); // BAD [NOT DETECTED]
+	unsafe_put_user(123, &(myData.x)); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 void test6()
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp
index 40845e355e0..8065679ec2d 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp
@@ -24,7 +24,7 @@ void test()
 
 	size_t size2 = x;
 	size2 *= y;
-	char *buffer6 = (char *)malloc(size2); // BAD [NOT DETECTED]
+	char *buffer6 = (char *)malloc(size2); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED]
 
 	char *buffer7 = new char[x * 10]; // GOOD
 	char *buffer8 = new char[x * y]; // $ Alert // BAD
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/test.cpp
index dc60e34f253..f22d6593456 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/test.cpp
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/test.cpp
@@ -105,6 +105,6 @@ void test7(int size) {
     }
 
     for (char *p = arr; p <= arr + size; p++) {
-        *p = 0; // BAD [NOT DETECTED]
+        *p = 0; // $ MISSING: Alert // BAD [NOT DETECTED]
     }
 }
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test3/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test3/test.cpp
index cadf28ca6ec..a882316f0c3 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test3/test.cpp
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test3/test.cpp
@@ -10,8 +10,8 @@ int main(int argc, char *argv[])
 {
   FILE *fp;
   char buf[128];
-  fp = fopen("myFile.txt","r+"); // BAD [NOT DETECTED]
-  fgets(buf,128,fp); 
+  fp = fopen("myFile.txt","r+"); // $ MISSING: Alert // BAD [NOT DETECTED]
+  fgets(buf,128,fp);
   fprintf(fp,"%s\n","data to file");
   fclose(fp);
   return 0;
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/test.cpp
index c3f27c3aa64..e97918a3770 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/test.cpp
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/test.cpp
@@ -58,9 +58,9 @@ int badTestf3(int type, int met) {
   is = getSize(type);
   switch (met) {
   case 1:
-    if (is >= 0) return 123 / is; // BAD [NOT DETECTED]
+    if (is >= 0) return 123 / is; // $ MISSING: Alert // BAD [NOT DETECTED]
   case 2:
-    if (0 == is) return 123 / is; // BAD [NOT DETECTED]
+    if (0 == is) return 123 / is; // $ MISSING: Alert // BAD [NOT DETECTED]
   case 3:
     if (!is & 123 / is) // $ Alert // BAD
       return 123;
@@ -82,7 +82,7 @@ int badTestf3(int type, int met) {
   }
   if (is != 0) return -1;
   if (is == 0) type += 1;
-  return 123 / is; // BAD [NOT DETECTED]
+  return 123 / is; // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 int goodTestf3(int type, int met) {
@@ -223,7 +223,7 @@ int badTestf12(FILE * f) {
   int a;
   int ret = -1;
   a = getc(f);
-  if (a == 0) ret = 123 / a; // BAD [NOT DETECTED]
+  if (a == 0) ret = 123 / a; // $ MISSING: Alert // BAD [NOT DETECTED]
   return ret;
 }
 
@@ -262,7 +262,7 @@ void badTestf13(int type) {
   if (is < 5)
     badMySubDiv(type, is); // $ Alert // BAD
   if (is < 0)
-    badMySubDiv(type, is); // BAD [NOT DETECTED]
+    badMySubDiv(type, is); // $ MISSING: Alert // BAD [NOT DETECTED]
   if (is > 5)
     badMySubDiv(type, is); // GOOD
   if (is == 0)
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/test.cpp
index 758fdfda8a7..d2277725a3e 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/test.cpp
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/test.cpp
@@ -39,7 +39,7 @@ int funcTest3()
   FILE *fp;
   char filename[80];
   strcat(filename, "/tmp/tmp.name");
-  fp = fopen(filename,"w"); // BAD [NOT DETECTED]
+  fp = fopen(filename,"w"); // $ MISSING: Alert // BAD [NOT DETECTED]
   fprintf(fp,"%s\n","data to file");
   fclose(fp);
   return 0;
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-754/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-754/semmle/tests/test.cpp
index 72a11620eb3..8909566f201 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-754/semmle/tests/test.cpp
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-754/semmle/tests/test.cpp
@@ -60,7 +60,7 @@ int functionWork1b(int retIndex) {
 }
 int functionWork1_() {
   int i;
-  scanf("%i",&i); // BAD [NOT DETECTED]
+  scanf("%i",&i); // $ MISSING: Alert // BAD [NOT DETECTED]
   if(i<10)
     return -1;
   return i;
diff --git a/cpp/ql/test/query-tests/Best Practices/GuardedFree/test.cpp b/cpp/ql/test/query-tests/Best Practices/GuardedFree/test.cpp
index 136575fdced..ad2f800ae98 100644
--- a/cpp/ql/test/query-tests/Best Practices/GuardedFree/test.cpp	
+++ b/cpp/ql/test/query-tests/Best Practices/GuardedFree/test.cpp	
@@ -52,7 +52,7 @@ void test6(char *x) {
 }
 
 void test7(char *x) {
-  if (x || x) { // BAD [NOT DETECTED]
+  if (x || x) { // $ MISSING: Alert // BAD [NOT DETECTED]
     free(x);
   }
 }
@@ -91,7 +91,7 @@ void test10(char *x) {
   if (x) free(x);
 
 void test11(char *x) {
-  TRY_FREE(x) // BAD [NOT DETECTED]
+  TRY_FREE(x) // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 bool test12(char *x) {
diff --git a/cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/test.cpp b/cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/test.cpp
index cc0a5616819..0d096e4407a 100644
--- a/cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/test.cpp	
+++ b/cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/test.cpp	
@@ -15,24 +15,24 @@ void test(char *buffer, int bufferSize)
 	if ((buffer[i] == 'x') && (i < bufferSize)) {} // $ Alert // BAD
 
 	if ((bufferSize > i) && (buffer[i] == 'x')) {} // GOOD
-	if ((buffer[i] == 'x') && (bufferSize > i)) {} // BAD [NOT DETECTED]
+	if ((buffer[i] == 'x') && (bufferSize > i)) {} // $ MISSING: Alert // BAD [NOT DETECTED]
 
 	if ((i <= bufferSize - 1) && (buffer[i] == 'x')) {} // GOOD
-	if ((buffer[i] == 'x') && (i <= bufferSize - 1)) {} // BAD [NOT DETECTED]
+	if ((buffer[i] == 'x') && (i <= bufferSize - 1)) {} // $ MISSING: Alert // BAD [NOT DETECTED]
 
 	if ((bufferSize >= i + 1) && (buffer[i] == 'x')) {} // GOOD
-	if ((buffer[i] == 'x') && (bufferSize >= i + 1)) {} // BAD [NOT DETECTED]
+	if ((buffer[i] == 'x') && (bufferSize >= i + 1)) {} // $ MISSING: Alert // BAD [NOT DETECTED]
 
 	if ((i < bufferSize) && (true) && (buffer[i] == 'x')) {} // GOOD
 	if ((buffer[i] == 'x') && (true) && (i < bufferSize)) {} // $ Alert // BAD
 
 	if ((i < bufferSize - 1) && (buffer[i + 1] == 'x')) {} // GOOD
-	if ((buffer[i + 1] == 'x') && (i < bufferSize - 1)) {} // BAD [NOT DETECTED]
+	if ((buffer[i + 1] == 'x') && (i < bufferSize - 1)) {} // $ MISSING: Alert // BAD [NOT DETECTED]
 
 	if ((i < bufferSize) && (buffer[i] == 'x') && (i < bufferSize - 1)) {} // GOOD
 	if ((i < bufferSize) && ((buffer[i] == 'x') && (i < bufferSize - 1))) {} // GOOD
-	if ((i < bufferSize + 1) && (buffer[i] == 'x') && (i < bufferSize)) {} // BAD [NOT DETECTED]
-	if ((i < bufferSize + 1) && ((buffer[i] == 'x') && (i < bufferSize))) {} // BAD [NOT DETECTED]
+	if ((i < bufferSize + 1) && (buffer[i] == 'x') && (i < bufferSize)) {} // $ MISSING: Alert // BAD [NOT DETECTED]
+	if ((i < bufferSize + 1) && ((buffer[i] == 'x') && (i < bufferSize))) {} // $ MISSING: Alert // BAD [NOT DETECTED]
 
 	// look for 'ab'
 	for (i = 0; i < bufferSize; i++) {
diff --git a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/extraction_error.c b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/extraction_error.c
index 66eedf743fb..66e0d05e98b 100644
--- a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/extraction_error.c	
+++ b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/extraction_error.c	
@@ -2,7 +2,7 @@
 
 static void my_function1_called() {} // GOOD
 static void my_function2_called_after_error() {} // GOOD
-static void my_function3_not_called() {} // BAD [NOT DETECTED]
+static void my_function3_not_called() {} // $ MISSING: Alert // BAD [NOT DETECTED]
 
 int main(void) {
 	my_function1_called();
diff --git a/cpp/ql/test/query-tests/Critical/MemoryFreed/test.cpp b/cpp/ql/test/query-tests/Critical/MemoryFreed/test.cpp
index b46cc6b54a4..7dbad5fcc81 100644
--- a/cpp/ql/test/query-tests/Critical/MemoryFreed/test.cpp
+++ b/cpp/ql/test/query-tests/Critical/MemoryFreed/test.cpp
@@ -182,7 +182,7 @@ void test_strdupa_no_dealloc() {
 void test_strdupa_dealloc() {
 	char msg[] = "OctoCat";
 	char *cpy = strdupa(msg);
-    free(cpy); // BAD [NOT DETECTED]
+    free(cpy); // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 // --- strndupa ---
@@ -196,7 +196,7 @@ void test_strndupa_no_dealloc() {
 void test_strndupa_dealloc() {
 	char msg[] = "OctoCat";
 	char *cpy = strndupa(msg, 4);
-    free(cpy); // BAD [NOT DETECTED]
+    free(cpy); // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 // ---
diff --git a/cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp b/cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp
index c16127e18a6..75ecfcf3d6d 100644
--- a/cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp
+++ b/cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp
@@ -23,7 +23,7 @@ void test_double_free_aliasing(void *a, void* b) {
     free(a); // GOOD
     a = b;
     free(a); // GOOD
-    free(b); // BAD [NOT DETECTED]
+    free(b); // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 void test_dominance1(void *a) {
@@ -40,8 +40,8 @@ void test_dominance2(void *a) {
 void test_post_dominance1(int *a)
 {
     if (condition()) free(a); // $ Source[cpp/double-free] Source[cpp/use-after-free]
-    if (condition()) a[2] = 5; // BAD [NOT DETECTED]
-    if (condition()) free(a); // $ Source[cpp/double-free] Source[cpp/use-after-free] // BAD [NOT DETECTED]
+    if (condition()) a[2] = 5; // $ MISSING: Alert // BAD [NOT DETECTED]
+    if (condition()) free(a); // $ Source[cpp/double-free] Source[cpp/use-after-free] // $ MISSING: Alert // BAD [NOT DETECTED]
     a[2] = 5; // $ Alert[cpp/use-after-free] // BAD
     free(a); // $ Alert[cpp/double-free] // BAD
 }
@@ -61,7 +61,7 @@ void test_use_after_free6(int *a, int *b) {
     free(a);
     a=b;
     free(b);
-    if (condition()) a[0] = 5; // BAD [NOT DETECTED]
+    if (condition()) a[0] = 5; // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 void test_use_after_free7(int *a) {
@@ -343,7 +343,7 @@ void test_array(PtrContainer *containers) {
     delete containers[0].ptr; // GOOD
     delete containers[1].ptr; // GOOD
     delete containers[2].ptr; // GOOD
-    delete containers[2].ptr; // BAD (double free) [NOT DETECTED]
+    delete containers[2].ptr; // $ MISSING: Alert // BAD (double free) [NOT DETECTED]
 }
 
 struct E {
@@ -424,5 +424,5 @@ void testHasGetter() {
     free(buffer2);
 
     HasGetterNoFree hg3;
-    void *buffer3 = hg3.getBuffer(); // BAD (not freed) [NOT DETECTED]
+    void *buffer3 = hg3.getBuffer(); // $ MISSING: Alert // BAD (not freed) [NOT DETECTED]
 }
diff --git a/cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp b/cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp
index ba79df57fee..25f04f1938b 100644
--- a/cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp
+++ b/cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp
@@ -299,7 +299,7 @@ int main()
 		int *ptr_i = &i;
 
 		scanf("%d", &i);
-		use(*ptr_i); // BAD [NOT DETECTED]: may not have written `i`
+		use(*ptr_i); // $ MISSING: Alert // BAD [NOT DETECTED]: may not have written `i`
 	}
 
 	{
@@ -307,7 +307,7 @@ int main()
 		int *ptr_i = &i;
 
 		scanf("%d", ptr_i);
-		use(i); // BAD [NOT DETECTED]: may not have written `*ptr_i`
+		use(i); // $ MISSING: Alert // BAD [NOT DETECTED]: may not have written `*ptr_i`
 	}
 
 	{
@@ -380,7 +380,7 @@ void my_scan_int_test()
 	use(i); // GOOD: used before scanf
 
 	my_scan_int(i);
-	use(i); // BAD [NOT DETECTED]
+	use(i); // $ MISSING: Alert // BAD [NOT DETECTED]
 
 	if (my_scan_int(i))
 	{
diff --git a/cpp/ql/test/query-tests/Critical/MissingNullTest/test.cpp b/cpp/ql/test/query-tests/Critical/MissingNullTest/test.cpp
index 8872bf79364..ff4dfcfa171 100644
--- a/cpp/ql/test/query-tests/Critical/MissingNullTest/test.cpp
+++ b/cpp/ql/test/query-tests/Critical/MissingNullTest/test.cpp
@@ -18,13 +18,13 @@ void test1(bool cond)
 	{
 		int *p, *q;
 
-		y = *p; // BAD (p is uninitialized and could be 0) [NOT DETECTED]
+		y = *p; // $ MISSING: Alert // BAD (p is uninitialized and could be 0) [NOT DETECTED]
 		p = NULL;
 		y = *p; // $ Alert // BAD (p is 0)
 		p = &x;
 		y = *p; // GOOD (p points to x)
 		p = q;
-		y = *p; // BAD (p is uninitialized and could be 0) [NOT DETECTED]
+		y = *p; // $ MISSING: Alert // BAD (p is uninitialized and could be 0) [NOT DETECTED]
 	}
 
 	{
diff --git a/cpp/ql/test/query-tests/Critical/NewFree/test.cpp b/cpp/ql/test/query-tests/Critical/NewFree/test.cpp
index d886ee070be..26aff45efef 100644
--- a/cpp/ql/test/query-tests/Critical/NewFree/test.cpp
+++ b/cpp/ql/test/query-tests/Critical/NewFree/test.cpp
@@ -190,7 +190,7 @@ void test6(bool do_array_delete)
 
 	if (do_array_delete)
 	{
-		delete [] c_ptr_array[5]; // BAD [NOT DETECTED]
+		delete [] c_ptr_array[5]; // $ MISSING: Alert // BAD [NOT DETECTED]
 	} else {
 		delete c_ptr_array[5]; // GOOD
 	}
diff --git a/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests1.cpp b/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests1.cpp
index e00b70765ed..72dba152a23 100644
--- a/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests1.cpp
+++ b/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests1.cpp
@@ -43,7 +43,7 @@ void tests1(int case_num)
 			break;
 
 		case 5:
-			buffer = (char *)calloc(strlen(str), sizeof(char)); // BAD [NOT DETECTED]
+			buffer = (char *)calloc(strlen(str), sizeof(char)); // $ MISSING: Alert // BAD [NOT DETECTED]
 			strcpy(buffer, str);
 			break;
 
@@ -81,7 +81,7 @@ void tests1(int case_num)
 			break;
 
 		case 12:
-			buffer = (char *)malloc(strlen(str) + 0); // BAD [NOT DETECTED]
+			buffer = (char *)malloc(strlen(str) + 0); // $ MISSING: Alert // BAD [NOT DETECTED]
 			strcpy(buffer, str);
 			break;
 
@@ -91,17 +91,17 @@ void tests1(int case_num)
 			break;
 
 		case 102:
-			wbuffer = (wchar_t *)malloc(wcslen(wstr) + 1); // BAD (no sizeof) [NOT DETECTED]
+			wbuffer = (wchar_t *)malloc(wcslen(wstr) + 1); // $ MISSING: Alert // BAD (no sizeof) [NOT DETECTED]
 			wcscpy(wbuffer, wstr);
 			break;
 
 		case 103:
-			wbuffer = (wchar_t *)calloc(wcslen(wstr), sizeof(char)); // BAD [NOT DETECTED]
+			wbuffer = (wchar_t *)calloc(wcslen(wstr), sizeof(char)); // $ MISSING: Alert // BAD [NOT DETECTED]
 			wcscpy(wbuffer, wstr);
 			break;
 
 		case 104:
-			wbuffer = (wchar_t *)calloc(wcslen(wstr) + 1, sizeof(char)); // BAD (wrong sizeof) [NOT DETECTED]
+			wbuffer = (wchar_t *)calloc(wcslen(wstr) + 1, sizeof(char)); // $ MISSING: Alert // BAD (wrong sizeof) [NOT DETECTED]
 			wcscpy(wbuffer, wstr);
 			break;
 
@@ -116,7 +116,7 @@ void tests1(int case_num)
 			break;
 
 		case 107:
-			wbuffer = (wchar_t *)calloc(wcslen(wstr), sizeof(wchar_t)); // BAD [NOT DETECTED]
+			wbuffer = (wchar_t *)calloc(wcslen(wstr), sizeof(wchar_t)); // $ MISSING: Alert // BAD [NOT DETECTED]
 			wcscpy(wbuffer, wstr);
 			break;
 
diff --git a/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests2.cpp b/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests2.cpp
index db6928a7015..c24e9cb66a3 100644
--- a/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests2.cpp
+++ b/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests2.cpp
@@ -35,7 +35,7 @@ void tests2(int case_num)
 			break;
 
 		case 2:
-			buffer = (char *)malloc(strlen(str1) + strlen(str2)); // BAD [NOT DETECTED]
+			buffer = (char *)malloc(strlen(str1) + strlen(str2)); // $ MISSING: Alert // BAD [NOT DETECTED]
 			strcpy(buffer, str1);
 			strcat(buffer, str2);
 			break;
@@ -53,7 +53,7 @@ void tests2(int case_num)
 			break;
 
 		case 5:
-			buffer = (char *)malloc((strlen(str1) + strlen(str2)) * sizeof(char)); // BAD [NOT DETECTED]
+			buffer = (char *)malloc((strlen(str1) + strlen(str2)) * sizeof(char)); // $ MISSING: Alert // BAD [NOT DETECTED]
 			strcpy(buffer, str1);
 			strcat(buffer, str2);
 			break;
@@ -65,7 +65,7 @@ void tests2(int case_num)
 			break;
 
 		case 7:
-			buffer = (char *)malloc((strlen(str1) + strlen(str2) + 1) * sizeof(char)); // BAD [NOT DETECTED]
+			buffer = (char *)malloc((strlen(str1) + strlen(str2) + 1) * sizeof(char)); // $ MISSING: Alert // BAD [NOT DETECTED]
 			strcpy(buffer, str1);
 			strcat(buffer, str2);
 			strcat(buffer, str3);
@@ -79,24 +79,24 @@ void tests2(int case_num)
 			break;
 
 		case 101:
-			wbuffer = (wchar_t *)malloc((wcslen(wstr1) + 1) * sizeof(wchar_t)); // BAD [NOT DETECTED]
+			wbuffer = (wchar_t *)malloc((wcslen(wstr1) + 1) * sizeof(wchar_t)); // $ MISSING: Alert // BAD [NOT DETECTED]
 			wcscpy(wbuffer, wstr1);
 			wcscat(wbuffer, wstr2);
 			break;
-		
+
 		case 102:
-			wbuffer = (wchar_t *)malloc((wcslen(wstr1) + wcslen(wstr2)) * sizeof(wchar_t)); // BAD [NOT DETECTED]
+			wbuffer = (wchar_t *)malloc((wcslen(wstr1) + wcslen(wstr2)) * sizeof(wchar_t)); // $ MISSING: Alert // BAD [NOT DETECTED]
 			wcscpy(wbuffer, wstr1);
 			wcscat(wbuffer, wstr2);
 			break;
-			
+
 		case 103:
 			wbuffer = (wchar_t *)malloc((wcslen(wstr1) + wcslen(wstr2) + 1) * sizeof(wchar_t)); // GOOD
 			wcscpy(wbuffer, wstr1);
 			wcscat(wbuffer, wstr2);
 			break;
 	}
-	
+
 	if (buffer != 0)
 	{
 		free(buffer);
diff --git a/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests3.cpp b/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests3.cpp
index d6ff097fd2f..4a6d75562e4 100644
--- a/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests3.cpp
+++ b/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests3.cpp
@@ -59,7 +59,7 @@ void test3b()
 
 void test3c()
 {
-	char *buffer = new char[10]; // BAD [NOT DETECTED]
+	char *buffer = new char[10]; // $ MISSING: Alert // BAD [NOT DETECTED]
 
 	strcpy(buffer, "123456");
 	strcat(buffer, "123456");
diff --git a/cpp/ql/test/query-tests/Critical/OverflowStatic/test.c b/cpp/ql/test/query-tests/Critical/OverflowStatic/test.c
index 8a191a56365..f6de6b4e56f 100644
--- a/cpp/ql/test/query-tests/Critical/OverflowStatic/test.c
+++ b/cpp/ql/test/query-tests/Critical/OverflowStatic/test.c
@@ -8,19 +8,19 @@ struct {
 void f(void) {
     char c;
 
-    c = xs[-1]; // BAD [NOT DETECTED]
+    c = xs[-1]; // $ MISSING: Alert // BAD [NOT DETECTED]
     c = xs[0]; // GOOD
     c = xs[4]; // GOOD
     c = xs[5]; // $ Alert // BAD
     c = xs[6]; // $ Alert // BAD
 
-    c = stru.ys[-1]; // BAD [NOT DETECTED]
+    c = stru.ys[-1]; // $ MISSING: Alert // BAD [NOT DETECTED]
     c = stru.ys[0]; // GOOD
     c = stru.ys[4]; // GOOD
     c = stru.ys[5]; // $ Alert // BAD
     c = stru.ys[6]; // $ Alert // BAD
 
-    c = stru.zs[-1]; // BAD [NOT DETECTED]
+    c = stru.zs[-1]; // $ MISSING: Alert // BAD [NOT DETECTED]
     c = stru.zs[0]; // GOOD (zs is variable size)
     c = stru.zs[4]; // GOOD (zs is variable size)
     c = stru.zs[5]; // GOOD (zs is variable size)
@@ -32,7 +32,7 @@ void test_buffer_sentinal() {
   struct { char len; char buf[1]; } *b = malloc(10); // len(buf.buffer) effectively 8
   b->buf[0] = 0; // GOOD
   b->buf[7] = 0; // GOOD
-  b->buf[8] = 0; // BAD [NOT DETECTED]
+  b->buf[8] = 0; // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 union u {
@@ -44,21 +44,21 @@ void union_test() {
   union u u;
   u.ptr[0] = 0; // GOOD
   u.ptr[sizeof(u)-1] = 0; // GOOD
-  u.ptr[sizeof(u)] = 0; // BAD [NOT DETECTED]
+  u.ptr[sizeof(u)] = 0; // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 void test_struct_union() {
   struct { union u u; } v;
   v.u.ptr[0] = 0; // GOOD
   v.u.ptr[sizeof(union u)-1] = 0; // GOOD
-  v.u.ptr[sizeof(union u)] = 0; // BAD [NOT DETECTED]
+  v.u.ptr[sizeof(union u)] = 0; // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 void union_test2() {
   union { char ptr[1]; unsigned long value; } u;
   u.ptr[0] = 0; // GOOD
   u.ptr[sizeof(u)-1] = 0; // GOOD
-  u.ptr[sizeof(u)] = 0; // BAD [NOT DETECTED]
+  u.ptr[sizeof(u)] = 0; // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 typedef struct {
@@ -69,5 +69,5 @@ typedef struct {
 void test_alloc() {
   // Special case of taking sizeof without any addition or multiplications
   var_buf *b = malloc(sizeof(var_buf));
-  b->buf[1] = 0; // BAD [NOT DETECTED]
+  b->buf[1] = 0; // $ MISSING: Alert // BAD [NOT DETECTED]
 }
diff --git a/cpp/ql/test/query-tests/Critical/OverflowStatic/test.cpp b/cpp/ql/test/query-tests/Critical/OverflowStatic/test.cpp
index 6f8ce4c7d7a..19d0fa76bad 100644
--- a/cpp/ql/test/query-tests/Critical/OverflowStatic/test.cpp
+++ b/cpp/ql/test/query-tests/Critical/OverflowStatic/test.cpp
@@ -35,16 +35,16 @@ void f2(char *src)
 	amount = 100;
 	memcpy(buffer, src, amount); // GOOD
 	amount = amount + 1;
-	memcpy(buffer, src, amount); // BAD [NOT DETECTED]
+	memcpy(buffer, src, amount); // $ MISSING: Alert // BAD [NOT DETECTED]
 	amount = 101;
 	memcpy(buffer, src, amount); // $ Alert // BAD
 
 	ptr = buffer;
-	memcpy(ptr, src, 101); // BAD [NOT DETECTED]
+	memcpy(ptr, src, 101); // $ MISSING: Alert // BAD [NOT DETECTED]
 	ptr = &(buffer[0]);
-	memcpy(ptr, src, 101); // BAD [NOT DETECTED]
+	memcpy(ptr, src, 101); // $ MISSING: Alert // BAD [NOT DETECTED]
 	ptr = &(buffer[1]);
-	memcpy(ptr, src, 100); // BAD [NOT DETECTED]
+	memcpy(ptr, src, 100); // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 void f3() {
diff --git a/cpp/ql/test/query-tests/Critical/SizeCheck/test2.c b/cpp/ql/test/query-tests/Critical/SizeCheck/test2.c
index 5e09a428bf3..e6095acc3d2 100644
--- a/cpp/ql/test/query-tests/Critical/SizeCheck/test2.c
+++ b/cpp/ql/test/query-tests/Critical/SizeCheck/test2.c
@@ -50,8 +50,8 @@ void *MyMalloc2(size_t size);
 
 void customAllocatorTests()
 {
-    double *dptr1 = MyMalloc1(33); // BAD -- Not a multiple of sizeof(double) [NOT DETECTED]
-    double *dptr2 = MyMalloc2(33); // BAD -- Not a multiple of sizeof(double) [NOT DETECTED]
+    double *dptr1 = MyMalloc1(33); // $ MISSING: Alert // BAD -- Not a multiple of sizeof(double) [NOT DETECTED]
+    double *dptr2 = MyMalloc2(33); // $ MISSING: Alert // BAD -- Not a multiple of sizeof(double) [NOT DETECTED]
 }
 
 // --- variable length data structures ---
diff --git a/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 30/FunctionPointerConversions/test.c b/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 30/FunctionPointerConversions/test.c
index 73ebd802501..a6f915b6c7f 100644
--- a/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 30/FunctionPointerConversions/test.c	
+++ b/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 30/FunctionPointerConversions/test.c	
@@ -20,8 +20,8 @@ void test()
 
 	funPtr1 = funPtr2; // GOOD
 	funPtr2 = funPtr2; // GOOD
-	intPtr = funPtr2; // BAD (function pointer -> int pointer) [NOT DETECTED]
-	voidPtr = funPtr2; // BAD (function pointer -> void pointer) [NOT DETECTED]
+	intPtr = funPtr2; // $ MISSING: Alert // BAD (function pointer -> int pointer) [NOT DETECTED]
+	voidPtr = funPtr2; // $ MISSING: Alert // BAD (function pointer -> void pointer) [NOT DETECTED]
 	i = funPtr2; // GOOD (permitted)
 
 	funPtr1 = (void (*)())funPtr1; // GOOD
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/templates.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/templates.cpp
index ea71b1bb770..ee111a7b7cd 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/templates.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/templates.cpp	
@@ -13,7 +13,7 @@ bool compareValues() {
   // instantiations outside.
   return
     T1::value < T2::value || // GOOD
-    T1::value < T1::value || // BAD [NOT DETECTED]
+    T1::value < T1::value || // $ MISSING: Alert // BAD [NOT DETECTED]
     C1::value < C1::value ; // $ Alert[cpp/comparison-of-identical-expressions] // BAD
 }
 
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BitwiseSignCheck/bsc.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BitwiseSignCheck/bsc.cpp
index c1f671a43d1..ff973794f0d 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BitwiseSignCheck/bsc.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BitwiseSignCheck/bsc.cpp	
@@ -39,5 +39,5 @@ bool is_bit_set_v3(int x, int bitnum) {
 }
 
 bool is_bit_set_v4(int x, int bitnum) {
-  return (x & (1 << bitnum)) >= 1; // BAD [NOT DETECTED]
+  return (x & (1 << bitnum)) >= 1; // $ MISSING: Alert // BAD [NOT DETECTED]
 }
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/ComparisonPrecedence/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/ComparisonPrecedence/test.cpp
index f727b8bb566..35c38c1700e 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/ComparisonPrecedence/test.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/ComparisonPrecedence/test.cpp	
@@ -57,7 +57,7 @@ void test1(int x, int y, int z) {
 	{
 		MyClass1 a, b, c;
 
-		if (a < b < c) {} // BAD (the overloaded `operator<` behaves like `<`) [NOT DETECTED]
+		if (a < b < c) {} // $ MISSING: Alert // BAD (the overloaded `operator<` behaves like `<`) [NOT DETECTED]
 	}
 
 	// overloaded non-comparison
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/Buildless.c b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/Buildless.c
index 388d6a74d6d..1dd3ebb2587 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/Buildless.c	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/Buildless.c	
@@ -8,7 +8,7 @@ void test_float_double1(float f, double d) {
 
     float f1 = fabsf(f * f); // GOOD
     float f2 = fabsf(f * d); // GOOD
-    double f3 = fabs(f * f); // BAD [NOT DETECTED]
+    double f3 = fabs(f * f); // $ MISSING: Alert // BAD [NOT DETECTED]
     double f4 = fabs(f * d); // GOOD
 }
 
@@ -23,6 +23,6 @@ void test_float_double2(float f, double d) {
 
     float f1 = fabsf(f * f); // GOOD
     float f2 = fabsf(f * d); // GOOD
-    double f3 = fabs(f * f); // BAD [NOT DETECTED]
+    double f3 = fabs(f * f); // $ MISSING: Alert // BAD [NOT DETECTED]
     double f4 = fabs(f * d); // GOOD
 }
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/IntMultToLong.c b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/IntMultToLong.c
index 08e799fe795..9446d6177ce 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/IntMultToLong.c	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/IntMultToLong.c	
@@ -102,9 +102,9 @@ void g(unsigned char uchar1, unsigned char uchar2, unsigned char uchar3, int i)
     ulong4 = (uchar1 + (uchar1 + 1)) * (uchar2 + 1); // GOOD
     ulong5 = (i + (uchar1 + 1)) * (uchar2 + 1); // $ Alert // BAD
 
-    ulong5 = (uchar1 + 1073741824) * uchar2; // BAD [NOT DETECTED]
-    ulong5 = (uchar1 + (1 << 30)) * uchar2; // BAD [NOT DETECTED]
-    ulong5 = uchar1 * uchar1 * uchar1 * uchar2 * uchar2 * uchar2; // BAD [NOT DETECTED]
+    ulong5 = (uchar1 + 1073741824) * uchar2; // $ MISSING: Alert // BAD [NOT DETECTED]
+    ulong5 = (uchar1 + (1 << 30)) * uchar2; // $ MISSING: Alert // BAD [NOT DETECTED]
+    ulong5 = uchar1 * uchar1 * uchar1 * uchar2 * uchar2 * uchar2; // $ MISSING: Alert // BAD [NOT DETECTED]
     ulong5 = (uchar1 + (unsigned short)(-1)) * (uchar2 + (unsigned short)(-1)); // $ Alert // BAD
 }
 
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.c b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.c
index 188aa46d790..54882e520a5 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.c	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.c	
@@ -247,12 +247,12 @@ int overeager_wraparound(unsigned int u32bound, unsigned long long u64bound) {
   unsigned long long u64idx;
 
   for (u32idx = 1; u32idx < u32bound; u32idx++) {
-    if (u32idx == 0) // BAD [NOT DETECTED]
+    if (u32idx == 0) // $ MISSING: Alert // BAD [NOT DETECTED]
       return 0;
   }
 
   for (u64idx = 1; u64idx < u64bound; u64idx++) {
-    if (u64idx == 0) // BAD [NOT DETECTED]
+    if (u64idx == 0) // $ MISSING: Alert // BAD [NOT DETECTED]
       return 0;
   }
 
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Conversion/ArrayArgSizeMismatch/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Conversion/ArrayArgSizeMismatch/test.cpp
index f4a60ece66a..ec9bcd08cb0 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Conversion/ArrayArgSizeMismatch/test.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Conversion/ArrayArgSizeMismatch/test.cpp	
@@ -25,7 +25,7 @@ void test(float f3[3], float f4[4], float f5[5], float *fp)
 	g(arr4); // GOOD
 	g(arr5); // GOOD
 
-	h(f3); // BAD [NOT DETECTED]
+	h(f3); // $ MISSING: Alert // BAD [NOT DETECTED]
 	h(f4); // GOOD
 	h(f5); // GOOD
 	h(fp); // GOOD
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Conversion/LossyFunctionResultCast/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Conversion/LossyFunctionResultCast/test.cpp
index ce532877220..120aad86ddf 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Conversion/LossyFunctionResultCast/test.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Conversion/LossyFunctionResultCast/test.cpp	
@@ -49,14 +49,14 @@ void test1()
 	{
 		// ...
 	}
-	if (getFloatRef()) // BAD [NOT DETECTED]
+	if (getFloatRef()) // $ MISSING: Alert // BAD [NOT DETECTED]
 	{
-		setPosInt(getFloatRef()); // BAD [NOT DETECTED]
+		setPosInt(getFloatRef()); // $ MISSING: Alert // BAD [NOT DETECTED]
 		setPosFloat(getFloatRef());
 	}
-	if (getConstFloatRef()) // BAD [NOT DETECTED]
+	if (getConstFloatRef()) // $ MISSING: Alert // BAD [NOT DETECTED]
 	{
-		setPosInt(getConstFloatRef()); // BAD [NOT DETECTED]
+		setPosInt(getConstFloatRef()); // $ MISSING: Alert // BAD [NOT DETECTED]
 		setPosFloat(getConstFloatRef());
 	}
 
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/a.c b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/a.c
index 5b31d31b9fb..41003dc8bc6 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/a.c	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/a.c	
@@ -13,7 +13,7 @@ char *getString();
 void test_custom_printf1()
 {
   myMultiplyDefinedPrintf("string", getString()); // GOOD
-  myMultiplyDefinedPrintf(getString(), "string"); // BAD [NOT DETECTED]
+  myMultiplyDefinedPrintf(getString(), "string"); // $ MISSING: Alert // BAD [NOT DETECTED]
   myMultiplyDefinedPrintf2("string", getString()); // GOOD (we can't tell which declaration is correct so we have to assume this is OK)
   myMultiplyDefinedPrintf2(getString(), "string"); // GOOD (we can't tell which declaration is correct so we have to assume this is OK)
 }
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/b.c b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/b.c
index b0addf37881..cf639858a88 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/b.c	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/b.c	
@@ -10,7 +10,7 @@ char *getString();
 void test_custom_printf2(char *string)
 {
   myMultiplyDefinedPrintf("string", getString()); // GOOD
-  myMultiplyDefinedPrintf(getString(), "string"); // BAD [NOT DETECTED]
+  myMultiplyDefinedPrintf(getString(), "string"); // $ MISSING: Alert // BAD [NOT DETECTED]
   myMultiplyDefinedPrintf2("string", getString()); // GOOD (we can't tell which declaration is correct so we have to assume this is OK)
   myMultiplyDefinedPrintf2(getString(), "string"); // GOOD (we can't tell which declaration is correct so we have to assume this is OK)
-}
\ No newline at end of file
+}
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/test.cpp
index d562142df53..58eaaa1d850 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/test.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/test.cpp	
@@ -48,7 +48,7 @@ int main(int argc, char **argv) { // $ Source
   printf(choose_message(argc - 1), argc - 1); // GOOD
   printf(messages[1]); // GOOD
   printf(message); // GOOD
-  printf(make_message(argc - 1)); // BAD [NOT DETECTED]
+  printf(make_message(argc - 1)); // $ MISSING: Alert // BAD [NOT DETECTED]
   printf("Hello, World\n"); // GOOD
   printf(_("Hello, World\n")); // GOOD
   {
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/SnprintfOverflow/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Format/SnprintfOverflow/test.cpp
index a1ddd23aff2..ec865e1ab82 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/SnprintfOverflow/test.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/SnprintfOverflow/test.cpp	
@@ -83,7 +83,7 @@ void test6(const char *sa, const char *sb)
 	int pos = 0;
 
 	pos = snprintf(buffer, 100, "'%s', ", sa);
-	pos += snprintf(&(buffer[pos]), 100 - pos, "'%s'.", sb); // BAD [NOT DETECTED]
+	pos += snprintf(&(buffer[pos]), 100 - pos, "'%s'.", sb); // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 size_t strlen(const char *str);
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/a.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/a.c
index c58fd98c231..280e75a7d82 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/a.c	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/a.c	
@@ -18,8 +18,8 @@ void test_custom_printf1()
   myMultiplyDefinedPrintf("%i", 0, 1, 2); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments)
   myMultiplyDefinedPrintf2("%i", 0); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
   myMultiplyDefinedPrintf2("%i", 0, 1); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
-  myMultiplyDefinedPrintf2("%i", 0, 1, 2); // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED]
+  myMultiplyDefinedPrintf2("%i", 0, 1, 2); // $ MISSING: Alert // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED]
   myMultiplyDefinedPrintf3("%s", "%s"); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
   myMultiplyDefinedPrintf3("%s", "%s", "%s"); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
-  myMultiplyDefinedPrintf3("%s", "%s", "%s", "%s"); // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED]
+  myMultiplyDefinedPrintf3("%s", "%s", "%s", "%s"); // $ MISSING: Alert // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED]
 }
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/b.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/b.c
index 9de6d71014a..f6ed16e02c8 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/b.c	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/b.c	
@@ -15,8 +15,8 @@ void test_custom_printf2()
   myMultiplyDefinedPrintf("%i", 0, 1, 2); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments)
   myMultiplyDefinedPrintf2("%i", 0); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
   myMultiplyDefinedPrintf2("%i", 0, 1); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
-  myMultiplyDefinedPrintf2("%i", 0, 1, 2); // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED]
+  myMultiplyDefinedPrintf2("%i", 0, 1, 2); // $ MISSING: Alert // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED]
   myMultiplyDefinedPrintf3("%s", "%s"); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
   myMultiplyDefinedPrintf3("%s", "%s", "%s"); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
-  myMultiplyDefinedPrintf3("%s", "%s", "%s", "%s"); // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED]
+  myMultiplyDefinedPrintf3("%s", "%s", "%s", "%s"); // $ MISSING: Alert // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED]
 }
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/c.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/c.c
index a5f3ef6669b..43682db2b7e 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/c.c	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/c.c	
@@ -7,8 +7,8 @@ void test_custom_printf2()
   myMultiplyDefinedPrintf("%i", 0, 1, 2); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments)
   myMultiplyDefinedPrintf2("%i", 0); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
   myMultiplyDefinedPrintf2("%i", 0, 1); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
-  myMultiplyDefinedPrintf2("%i", 0, 1, 2); // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED]
+  myMultiplyDefinedPrintf2("%i", 0, 1, 2); // $ MISSING: Alert // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED]
   myMultiplyDefinedPrintf3("%s", "%s"); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
   myMultiplyDefinedPrintf3("%s", "%s", "%s"); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
-  myMultiplyDefinedPrintf3("%s", "%s", "%s", "%s"); // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED]
+  myMultiplyDefinedPrintf3("%s", "%s", "%s", "%s"); // $ MISSING: Alert // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED]
 }
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/test.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/test.c
index f054f382c5f..ba974ced7f7 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/test.c	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/test.c	
@@ -30,7 +30,7 @@ void test(int i, const char *str)
 
 		printf("%1$*2$d", 0, num, width); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments) [INCORRECT MESSAGE]
 		printf("%1$*2$d", num, width); // $ SPURIOUS: Alert[cpp/too-many-format-arguments] // GOOD [FALSE POSITIVE]
-		printf("%1$*2$d", width); // BAD (too few format arguments) [NOT DETECTED]
+		printf("%1$*2$d", width); // $ MISSING: Alert // BAD (too few format arguments) [NOT DETECTED]
 	}
 	{
 		int precision;
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/second.cpp b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/second.cpp
index bced9652785..74877883c58 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/second.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/second.cpp	
@@ -12,10 +12,10 @@ void test_size_t() {
     printf("%zi", s); // GOOD
     printf("%zu", s); // GOOD (we generally permit signedness changes)
     printf("%zx", s); // GOOD (we generally permit signedness changes)
-    printf("%d", s); // BAD [NOT DETECTED]
+    printf("%d", s); // $ MISSING: Alert // BAD [NOT DETECTED]
     printf("%ld", s); // DUBIOUS [NOT DETECTED]
     printf("%lld", s); // DUBIOUS [NOT DETECTED]
-    printf("%u", s); // BAD [NOT DETECTED]
+    printf("%u", s); // $ MISSING: Alert // BAD [NOT DETECTED]
 
     char buffer[1024];
 
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c
index 17d1bd98fed..a51afbeb62e 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c	
@@ -10,7 +10,7 @@ void myMultiplyDefinedPrintf2(const char *format, const char *extraArg, ...);
 void test_custom_printf1()
 {
   myMultiplyDefinedPrintf("%i", "%f", 1); // GOOD
-  myMultiplyDefinedPrintf("%i", "%f", 1.0f); // BAD [NOT DETECTED]
+  myMultiplyDefinedPrintf("%i", "%f", 1.0f); // $ MISSING: Alert // BAD [NOT DETECTED]
   myMultiplyDefinedPrintf2("%i", "%f", 1); // GOOD (we can't tell which declaration is correct so we have to assume this is OK)
   myMultiplyDefinedPrintf2("%i", "%f", 1.0f); // GOOD (we can't tell which declaration is correct so we have to assume this is OK)
 }
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/b.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/b.c
index adf443c1e9d..570a08e63d2 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/b.c	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/b.c	
@@ -8,7 +8,7 @@ void myMultiplyDefinedPrintf2(const char *extraArg, const char *format, ...);
 void test_custom_printf2()
 {
   myMultiplyDefinedPrintf("%i", "%f", 1); // GOOD
-  myMultiplyDefinedPrintf("%i", "%f", 1.0f); // BAD [NOT DETECTED]
+  myMultiplyDefinedPrintf("%i", "%f", 1.0f); // $ MISSING: Alert // BAD [NOT DETECTED]
   myMultiplyDefinedPrintf2("%i", "%f", 1); // GOOD (we can't tell which declaration is correct so we have to assume this is OK)
   myMultiplyDefinedPrintf2("%i", "%f", 1.0f); // GOOD (we can't tell which declaration is correct so we have to assume this is OK)
-}
\ No newline at end of file
+}
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/DubiousNullCheck/DubiousNullCheck.cpp b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/DubiousNullCheck/DubiousNullCheck.cpp
index f8e8851abec..94d7448d239 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/DubiousNullCheck/DubiousNullCheck.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/DubiousNullCheck/DubiousNullCheck.cpp	
@@ -22,9 +22,9 @@ public:
 	myClass(myClass *ptr, myClass &ref) {
 		assert(ptr != NULL);
 		assert(y != NULL);
-		assert(&y != NULL); // BAD [NOT DETECTED]
+		assert(&y != NULL); // $ MISSING: Alert // BAD [NOT DETECTED]
 		assert(this->y != NULL);
-		assert(&this->y != NULL); // BAD [NOT DETECTED]
+		assert(&this->y != NULL); // $ MISSING: Alert // BAD [NOT DETECTED]
 		assert(ptr->y != NULL);
 		assert(&ptr->y != NULL); // $ Alert // BAD
 		assert((ptr->y) != NULL);
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/templatey.cpp b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/templatey.cpp
index c47f7febe41..f99db5321d8 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/templatey.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/templatey.cpp	
@@ -15,9 +15,9 @@ void operator<<(streamable& lhs, streamable& rhs)
 int main()
 {
   int x = 3;
-  foo(x, x); // BAD [NOT DETECTED]
+  foo(x, x); // $ MISSING: Alert // BAD [NOT DETECTED]
   streamable y;
-  foo(y, y); // BAD [NOT DETECTED]
+  foo(y, y); // $ MISSING: Alert // BAD [NOT DETECTED]
   return 0;
 }
 
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.cpp b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.cpp
index 794be80efdf..e0b2358aeaa 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.cpp	
@@ -197,7 +197,7 @@ void IntendedOverflow(unsigned char p)
     for (s = m + 1; s < m; s--) {} // $ Alert // BAD (never runs)
 
     for (i = p - 1; i < p; i--) {} // GOOD
-    for (s = p - 1; s < p; s--) {} // BAD [NOT DETECTED]
+    for (s = p - 1; s < p; s--) {} // $ MISSING: Alert // BAD [NOT DETECTED]
 
 	{
 		int n;
@@ -210,10 +210,10 @@ void IntendedOverflow(unsigned char p)
 		for (i = 63; i < n; i--) {} // GOOD
 
 		n = 64;
-		for (s = n - 1; s < n; s--) {} // BAD [NOT DETECTED]
+		for (s = n - 1; s < n; s--) {} // $ MISSING: Alert // BAD [NOT DETECTED]
 		n = 64;
 		for (s = n - 1; s < 64; s--) {} // $ Alert // BAD
 		n = 64;
-		for (s = 63; s < n; s--) {} // BAD [NOT DETECTED]
+		for (s = 63; s < n; s--) {} // $ MISSING: Alert // BAD [NOT DETECTED]
 	}
 }
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/BoundedLoop.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/BoundedLoop.cpp
index b14dbbbb8de..67f45dbbf8e 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/BoundedLoop.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/BoundedLoop.cpp	
@@ -109,7 +109,7 @@ void incBefore() {
 void nestedAddsUp() {
   for (int i = 0; i < 16; i++) {
     for (int j = 0; j < 16; j++) {
-      alloca(100); // BAD [NOT DETECTED]
+      alloca(100); // $ MISSING: Alert // BAD [NOT DETECTED]
     }
   }
 }
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/test.cpp
index 6a154805233..4a18f34108b 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/test.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/test.cpp	
@@ -27,8 +27,8 @@ void test_unassigned()
 		strdup(buffer2); // $ Alert[cpp/improper-null-termination] // BAD
 
 		memcpy(buffer2, buffer1, sizeof(buffer2));
-		strdup(buffer1); // BAD [NOT DETECTED]
-		strdup(buffer2); // BAD [NOT DETECTED]
+		strdup(buffer1); // $ MISSING: Alert // BAD [NOT DETECTED]
+		strdup(buffer2); // $ MISSING: Alert // BAD [NOT DETECTED]
 	}
 
 	{
@@ -196,7 +196,7 @@ void test_readlink(int fd, const char *path, size_t sz)
 		char *buffer = (char *)malloc(1024);
 
 		readlink(path, buffer, 1024);
-		strdup(buffer); // BAD [NOT DETECTED]
+		strdup(buffer); // $ MISSING: Alert // BAD [NOT DETECTED]
 	}
 
 	{
@@ -211,7 +211,7 @@ void test_readlink(int fd, const char *path, size_t sz)
 		char *buffer = (char *)malloc(sz);
 
 		readlink(path, buffer, sz);
-		strdup(buffer); // BAD [NOT DETECTED]
+		strdup(buffer); // $ MISSING: Alert // BAD [NOT DETECTED]
 	}
 
 	{
@@ -289,7 +289,7 @@ void test_strcat()
 		char buffer[1024];
 
 		doNothing2(buffer);
-		strcat(buffer, "content"); // BAD [NOT DETECTED]
+		strcat(buffer, "content"); // $ MISSING: Alert // BAD [NOT DETECTED]
 	}
 
 	{
@@ -303,7 +303,7 @@ void test_strcat()
 		strcat(buffer_ptr, "content"); // GOOD
 
 		buffer_ptr = buffer2;
-		strcat(buffer_ptr, "content"); // BAD [NOT DETECTED]
+		strcat(buffer_ptr, "content"); // $ MISSING: Alert // BAD [NOT DETECTED]
 	}
 
 	{
@@ -361,7 +361,7 @@ void test_strlen(bool cond1, bool cond2)
 		if (cond1)
 			buffer[0] = 0;
 		if (cond2)
-			strlen(buffer); // BAD [NOT DETECTED]
+			strlen(buffer); // $ MISSING: Alert // BAD [NOT DETECTED]
 	}
 
 	{
@@ -524,7 +524,7 @@ void test_printf(char *str)
 		char *copied_str = (char *)malloc(len);
 
 		memcpy(copied_str, str, len);
-		printf("%s", copied_str); // BAD [NOT DETECTED]
+		printf("%s", copied_str); // $ MISSING: Alert // BAD [NOT DETECTED]
 	}
 
 	{
@@ -580,7 +580,7 @@ void test_reassignment()
 		{
 			strcpy(buffer_ptr, "content"); // null terminates buffer1 or buffer2
 			buffer_ptr = buffer2;
-			strdup(buffer2); // BAD [NOT DETECTED]
+			strdup(buffer2); // $ MISSING: Alert // BAD [NOT DETECTED]
 		}
 	}
 }
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/PointerOverflow/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/PointerOverflow/test.cpp
index 6dae7b3102c..fb81a49699f 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/PointerOverflow/test.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/PointerOverflow/test.cpp	
@@ -22,7 +22,7 @@ struct Q {
 void foo(int untrusted_int) {
 	Q q;
     if (q.begin() + untrusted_int > q.end() || // GOOD (for the purpose of this test)
-          q.begin() + untrusted_int < q.begin()) // BAD [NOT DETECTED]
+          q.begin() + untrusted_int < q.begin()) // $ MISSING: Alert // BAD [NOT DETECTED]
       throw q;
 }
 
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/test.cpp
index 93ddf132f9e..5cc20a6b70b 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/test.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/test.cpp	
@@ -34,7 +34,7 @@ void test2()
 	wcsncpy(buf1, str, wcslen(str)); // $ Alert // BAD
 	wcsncpy(buf1, str, wcslen(str) + 1); // $ Alert // BAD
 	wcsncpy(buf1, buf2, sizeof(buf2)); // $ Alert // BAD
-	wcsncpy(buf1, buf2, sizeof(buf2) / sizeof(wchar_t)); // $ Alert // BAD [NOT DETECTED]
+	wcsncpy(buf1, buf2, sizeof(buf2) / sizeof(wchar_t)); // $ Alert // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 void test3()
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/test.cpp
index 92be81a5f03..f305b8c067e 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/test.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/test.cpp	
@@ -22,7 +22,7 @@ int main()
 
 		memset(&ms, 0, sizeof(myStruct)); // GOOD
 		memset(&ms, 0, sizeof(ms)); // GOOD
-		memset(&ms, 0, 8); // BAD [NOT DETECTED]
+		memset(&ms, 0, 8); // $ MISSING: Alert // BAD [NOT DETECTED]
 		memset(&ms, 0, sizeof(otherStruct)); // $ Alert // BAD
 
 		{
@@ -87,7 +87,7 @@ int main()
 		memset(&msPtrArr, 0, sizeof(myStruct *) * NUM); // GOOD
 		memset(&msPtrArr, 0, sizeof(myStructPtr) * NUM); // GOOD
 		memset(&msPtrArr, 0, sizeof(myStruct **) * NUM); // $ Alert // BAD
-		memset(msPtrArr, 0, sizeof(myStruct) * NUM); // BAD [NOT DETECTED]
+		memset(msPtrArr, 0, sizeof(myStruct) * NUM); // $ MISSING: Alert // BAD [NOT DETECTED]
 		memset(msPtrArr, 0, sizeof(myStruct *) * NUM); // GOOD
 		memset(msPtrArr, 0, sizeof(myStructPtr) * NUM); // GOOD
 		memset(msPtrArr, 0, sizeof(myStruct **) * NUM); // $ Alert // BAD
@@ -128,7 +128,7 @@ void myFunc(myStruct paramArray[80], myStruct &refStruct)
 	memset(paramArray, 0, sizeof(myStruct) * 80); // GOOD
 	memset(paramArray, 0, sizeof(paramArray)); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]
 	memset(&paramArray, 0, sizeof(myStruct) * 80); // $ Alert // BAD
-	memset(&paramArray, 0, sizeof(paramArray)); // BAD [NOT DETECTED]
+	memset(&paramArray, 0, sizeof(paramArray)); // $ MISSING: Alert // BAD [NOT DETECTED]
 
 	memset(&refStruct, 0, sizeof(myStruct)); // GOOD
 	memset(&refStruct, 0, sizeof(refStruct)); // GOOD
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c
index b76482179ca..a5d7d9db97f 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c	
@@ -15,14 +15,14 @@ void good0(char *s) {
 	char buf[80];
 	strcpy(buf, "s = ");
 	strncat(buf, s, sizeof(buf)-5); // GOOD
-	strncat(buf, ".", 1); // BAD [NOT DETECTED] -- there might not be even 1 character of space
+	strncat(buf, ".", 1); // $ MISSING: Alert // BAD [NOT DETECTED] -- there might not be even 1 character of space
 }
 
 void bad0(char *s) {
 	char buf[80];
 	strcpy(buf, "s = ");
 	strncat(buf, s, sizeof(buf));  // $ Alert // BAD -- Forgot to allow for "s = "
-	strncat(buf, ".", 1); // BAD [NOT DETECTED] -- there might not be even 1 character of space
+	strncat(buf, ".", 1); // $ MISSING: Alert // BAD [NOT DETECTED] -- there might not be even 1 character of space
 }
 
 void good1(char *s) {
@@ -36,7 +36,7 @@ void bad1(char *s) {
 	char buf[80];
 	strcpy(buf, "s = ");
 	strncat(buf, s, sizeof(buf)-strlen("s = ")); // GOOD
-	strncat(buf, ".", 1); // BAD [NOT DETECTED] -- Need to check if any space is left
+	strncat(buf, ".", 1); // $ MISSING: Alert // BAD [NOT DETECTED] -- Need to check if any space is left
 }
 
 void strncat_test1(char *s) {
@@ -51,7 +51,7 @@ void strncat_test2(char *s) {
   int len = 80;
   char* buf = (char *)malloc(len);
   strncat(buf, s, len - strlen(buf) - 1); // GOOD
-  strncat(buf, s, len - strlen(buf));  // BAD [NOT DETECTED]
+  strncat(buf, s, len - strlen(buf));  // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 struct buffers
diff --git a/cpp/ql/test/query-tests/Likely Bugs/RedundantNullCheckSimple/RedundantNullCheckSimple.cpp b/cpp/ql/test/query-tests/Likely Bugs/RedundantNullCheckSimple/RedundantNullCheckSimple.cpp
index 3036bc4b5e7..d2f88ec331b 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/RedundantNullCheckSimple/RedundantNullCheckSimple.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/RedundantNullCheckSimple/RedundantNullCheckSimple.cpp	
@@ -39,7 +39,7 @@ void test_no_single_dominator(int *p, bool b) {
   } else {
     x = *p;
   }
-  if (p == nullptr) { // BAD [NOT DETECTED]
+  if (p == nullptr) { // $ MISSING: Alert // BAD [NOT DETECTED]
     return;
   }
 }
@@ -52,7 +52,7 @@ int test_postdominator_same_bb(int *p) {
 }
 
 int test_postdominator(int *p) {
-  int b = (p == nullptr); // BAD [NOT DETECTED]
+  int b = (p == nullptr); // $ MISSING: Alert // BAD [NOT DETECTED]
 
   if (b) b++; // This line breaks up the basic block
 
@@ -62,7 +62,7 @@ int test_postdominator(int *p) {
 }
 
 int test_inverted_logic(int *p) {
-  if (p == nullptr) { // BAD [NOT DETECTED]
+  if (p == nullptr) { // $ MISSING: Alert // BAD [NOT DETECTED]
     // The check above should probably have been `!=` instead of `==`.
     return *p;
   } else {
@@ -95,7 +95,7 @@ void test_field_local(bool boolvar) {
     }
   } else {
     int *x = sp->p;
-    if (sp == nullptr) { // BAD [NOT DETECTED]
+    if (sp == nullptr) { // $ MISSING: Alert // BAD [NOT DETECTED]
       return;
     }
   }
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/test.c b/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/test.c
index 3cdc534d424..cea100f191e 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/test.c	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/test.c	
@@ -32,7 +32,7 @@ void test(int *argv[]) {
   not_yet_declared2(1); // $ Alert[cpp/implicit-function-declaration] // BAD (GOOD for everything except for cpp/implicit-function-declaration)
   not_yet_declared2(ca); // $ Alert[cpp/mistyped-function-arguments] // BAD (GOOD for everything except for cpp/mistyped-function-arguments
                          //      and cpp/too-few-arguments. Not detected in the case of cpp/too-few-arguments.)
-  not_yet_declared2(); // BAD [NOT DETECTED] (GOOD for everything except for cpp/too-few-arguments)
+  not_yet_declared2(); // $ MISSING: Alert // BAD [NOT DETECTED] (GOOD for everything except for cpp/too-few-arguments)
 
   declared_empty_defined_with(); // $ Alert[cpp/too-few-arguments] // BAD
   declared_empty_defined_with(1); // GOOD
diff --git a/cpp/ql/test/query-tests/Likely Bugs/UseInOwnInitializer/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/UseInOwnInitializer/test.cpp
index 8d0c09be66c..abdb5819786 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/UseInOwnInitializer/test.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/UseInOwnInitializer/test.cpp	
@@ -87,5 +87,5 @@ namespace ns3
 {
 	const int v5 = ns1::v6 + 1; // GOOD
 	const int v6 = ns1::v6 + 1; // GOOD  [produces INVALID_KEY trap warning]
-	const int v7 = ns3::v7; // BAD [NOT DETECTED]
+	const int v7 = ns3::v7; // $ MISSING: Alert // BAD [NOT DETECTED]
 };
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-014/test.c b/cpp/ql/test/query-tests/Security/CWE/CWE-014/test.c
index 1ca22b5782e..f46e62849ce 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-014/test.c
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-014/test.c
@@ -13,30 +13,30 @@ extern void use_pw(char *pw);
 // x86-64 gcc 9.2: deleted
 // x86-64 clang 9.0.0: deleted
 // x64 msvc v19.14 (WINE): deleted
-int func1(void) { 
+int func1(void) {
 	char pw1[PW_SIZE];
 	use_pw(pw1);
-	memset(pw1, 0, PW_SIZE); // BAD [NOT DETECTED]
+	memset(pw1, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
 	return 0;
 }
 
 // x86-64 gcc 9.2: deleted
 // x86-64 clang 9.0.0: deleted
 // x64 msvc v19.14 (WINE): not deleted
-int func1a(void) {  
+int func1a(void) {
 	char pw1a[PW_SIZE];
 	use_pw(pw1a);
-	__builtin_memset(pw1a, 0, PW_SIZE); // BAD [NOT DETECTED]
+	__builtin_memset(pw1a, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
 	return 0;
 }
 
 // x86-64 gcc 9.2: deleted
 // x86-64 clang 9.0.0: deleted
 // x64 msvc v19.14 (WINE): deleted
-char *func1b(void) {  
+char *func1b(void) {
 	char pw1b[PW_SIZE];
 	use_pw(pw1b);
-	memset(pw1b, 0, PW_SIZE); // BAD [NOT DETECTED]
+	memset(pw1b, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
 	pw1b[0] = pw1b[3] = 'a';
 	return 0;
 }
@@ -44,7 +44,7 @@ char *func1b(void) {
 // x86-64 gcc 9.2: not deleted
 // x86-64 clang 9.0.0: not deleted
 // x64 msvc v19.14 (WINE): not deleted
-int func1c(char pw1c[PW_SIZE]) {  
+int func1c(char pw1c[PW_SIZE]) {
 	use_pw(pw1c);
 	memset(pw1c, 0, PW_SIZE); // GOOD
 	return 0;
@@ -54,7 +54,7 @@ int func1c(char pw1c[PW_SIZE]) {
 // x86-64 clang 9.0.0: not deleted
 // x64 msvc v19.14 (WINE): not deleted
 char pw1d[PW_SIZE];
-int func1d() {  
+int func1d() {
 	use_pw(pw1d);
 	memset(pw1d, 0, PW_SIZE); // GOOD
 	return 0;
@@ -62,47 +62,47 @@ int func1d() {
 // x86-64 gcc 9.2: deleted
 // x86-64 clang 9.0.0: deleted
 // x64 msvc v19.14 (WINE): deleted
-char *func2(void) {  
+char *func2(void) {
 	char pw2[PW_SIZE];
 	use_pw(pw2);
-	memset(pw2, 1, PW_SIZE); // BAD [NOT DETECTED]
+	memset(pw2, 1, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
 	return pw2;
 }
 
 // x86-64 gcc 9.2: deleted
 // x86-64 clang 9.0.0: deleted
 // x64 msvc v19.14 (WINE): partially deleted
-int func3(void) { 
+int func3(void) {
 	char pw3[PW_SIZE];
 	use_pw(pw3);
-	memset(pw3, 4, PW_SIZE); // BAD [NOT DETECTED]
+	memset(pw3, 4, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
 	return pw3[2];
 }
 
 // x86-64 gcc 9.2: deleted
 // x86-64 clang 9.0.0: deleted
 // x64 msvc v19.14 (WINE): not deleted
-int func4(void) { 
+int func4(void) {
 	char pw1a[PW_SIZE];
 	use_pw(pw1a);
-	__builtin_memset(pw1a + 3, 0, PW_SIZE - 3); // BAD [NOT DETECTED]
+	__builtin_memset(pw1a + 3, 0, PW_SIZE - 3); // $ MISSING: Alert // BAD [NOT DETECTED]
 	return 0;
 }
 
 // x86-64 gcc 9.2: deleted
 // x86-64 clang 9.0.0: deleted
 // x64 msvc v19.14 (WINE): not deleted
-int func6(void) { 
+int func6(void) {
 	char pw1a[PW_SIZE];
 	use_pw(pw1a);
-	__builtin_memset(&pw1a[3], 0, PW_SIZE - 3); // BAD [NOT DETECTED]
+	__builtin_memset(&pw1a[3], 0, PW_SIZE - 3); // $ MISSING: Alert // BAD [NOT DETECTED]
 	return pw1a[2];
 }
 
 // x86-64 gcc 9.2: deleted
 // x86-64 clang 9.0.0: deleted
 // x64 msvc v19.14 (WINE): not deleted
-int func5(void) { 
+int func5(void) {
 	char pw1a[PW_SIZE];
 	use_pw(pw1a);
 	__builtin_memset(pw1a + 3, 0, PW_SIZE - 4); // GOOD
@@ -112,17 +112,17 @@ int func5(void) {
 // x86-64 gcc 9.2: deleted
 // x86-64 clang 9.0.0: deleted
 // x64 msvc v19.14 (WINE): not deleted
-int func7(void) { 
+int func7(void) {
 	char pw1a[PW_SIZE];
 	use_pw(pw1a);
-	__builtin_memset(&pw1a[3], 0, PW_SIZE - 5); // BAD [NOT DETECTED]
+	__builtin_memset(&pw1a[3], 0, PW_SIZE - 5); // $ MISSING: Alert // BAD [NOT DETECTED]
 	return 0;
 }
 
 // x86-64 gcc 9.2: not deleted
 // x86-64 clang 9.0.0: not deleted
 // x64 msvc v19.14 (WINE): not deleted
-int func8(void) { 
+int func8(void) {
 	char pw1a[PW_SIZE];
 	use_pw(pw1a);
 	__builtin_memset(pw1a + pw1a[3], 0, PW_SIZE - 4); // GOOD
@@ -135,6 +135,6 @@ int func8(void) {
 char *func9(void) {
 	char pw1[PW_SIZE];
 	use_pw(pw1);
-	memset(pw1, 0, PW_SIZE); // BAD [NOT DETECTED]
+	memset(pw1, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
 	return 0;
 }
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-014/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-014/test.cpp
index d7228f50b2e..4faf1ffe1a2 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-014/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-014/test.cpp
@@ -54,7 +54,7 @@ void func3(unsigned long long sz) {
 void func4(unsigned long long sz) {
     char buff[128];
 		gets(buff);
-    memset(buff, 0, PW_SIZE); // BAD [NOT DETECTED]
+    memset(buff, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
     strcpy(buff, "Hello");
 }
 
@@ -64,7 +64,7 @@ void func4(unsigned long long sz) {
 void func5(unsigned long long sz) {
     char buff[128];
 		gets(buff);
-    memset(buff, 0, PW_SIZE); // BAD [NOT DETECTED]
+    memset(buff, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
     if (sz > 5) {
         strcpy(buff, "Hello");
     }
@@ -85,7 +85,7 @@ void func6(unsigned long long sz) {
 void func7(unsigned long long sz) {
     struct mem m;
 		gets(m.b);
-    memset(&m, 0, PW_SIZE); // BAD [NOT DETECTED]
+    memset(&m, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
     m.a = 15;
 }
 
@@ -95,7 +95,7 @@ void func7(unsigned long long sz) {
 void func8(unsigned long long sz) {
     struct mem *m = (struct mem *)malloc(sizeof(struct mem));
 		gets(m->b);
-    memset(m, 0, PW_SIZE); // BAD [NOT DETECTED]
+    memset(m, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 // x86-64 gcc 9.2: deleted
@@ -104,7 +104,7 @@ void func8(unsigned long long sz) {
 void func9(unsigned long long sz) {
     struct mem *m = (struct mem *)malloc(sizeof(struct mem));
 		gets(m->b);
-    memset(m, 0, PW_SIZE); // BAD [NOT DETECTED]
+    memset(m, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
     free(m);
 }
 
@@ -114,7 +114,7 @@ void func9(unsigned long long sz) {
 void func10(unsigned long long sz) {
     struct mem *m = (struct mem *)malloc(sizeof(struct mem));
 		gets(m->b);
-    memset(m, 0, PW_SIZE); // BAD [NOT DETECTED]
+    memset(m, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
     m->a = sz;
     m->c = m->a + 1;
 }
@@ -125,7 +125,7 @@ void func10(unsigned long long sz) {
 void func11(unsigned long long sz) {
     struct mem *m = (struct mem *)malloc(sizeof(struct mem));
 		gets(m->b);
-    ::memset(m, 0, PW_SIZE); // BAD [NOT DETECTED]
+    ::memset(m, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
     if (sz > 5) {
     	strcpy(m->b, "Hello");
     }
@@ -211,12 +211,12 @@ void badFunc0_0(){
 void nobadFunc1_0() {
 	char* buff1 = (char *) malloc(PW_SIZE);
 	gets(buff1);
-	memset(buff1, 0, PW_SIZE); // BAD [NOT DETECTED]
+	memset(buff1, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 void badFunc1_0(){
 	char * buff1 = (char *) malloc(PW_SIZE);
 	gets(buff1);
-	memset(buff1, 0, PW_SIZE); // BAD [NOT DETECTED]
+	memset(buff1, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
 	free(buff1);
 }
 void badFunc1_1(){
@@ -224,7 +224,7 @@ void badFunc1_1(){
 	for(int i = 0; i < PW_SIZE; i++) {
 		buff1[i] = 'a' + i;
 	}
-	memset(buff1, 0, PW_SIZE); // BAD [NOT DETECTED]
+	memset(buff1, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
 	free(buff1);
 }
 void nobadFunc2_0_0(){
@@ -301,7 +301,7 @@ bool nobadFunc2_1_0(unsigned char ch){
 void nobadFunc2_1_2(){
 	char buff1[PW_SIZE];
 	gets(buff1);
-	memset(buff1, 0, PW_SIZE); // BAD [NOT DETECTED]
+	memset(buff1, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
 	buff1[2] = 5;
 }
 
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/test.cpp
index 8b6703dde80..85f2ca9a572 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/test.cpp
@@ -77,8 +77,8 @@ void testReferencePointer2()
 	{
 		system(buffer); // $ Alert // BAD
 		system(data); // BAD
-		system(dataref); // BAD [NOT DETECTED]
-		system(data2); // BAD [NOT DETECTED]
+		system(dataref); // $ MISSING: Alert // BAD [NOT DETECTED]
+		system(data2); // $ MISSING: Alert // BAD [NOT DETECTED]
 	}
 }
 
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp
index a39c2bd47cf..a5c95e47851 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp
@@ -42,7 +42,7 @@ void test3(unsigned size, char *buf, unsigned anotherSize) {
     strncpy(str->string, buf, str->size + 1); // $ Alert[cpp/overrun-write] // BAD
 
     strncpy(str->string, buf, size); // GOOD
-    strncpy(str->string, buf, size + 1); // BAD [NOT DETECTED]
+    strncpy(str->string, buf, size + 1); // $ MISSING: Alert // BAD [NOT DETECTED]
 
     if(anotherSize < str->size) {
         strncpy(str->string, buf, anotherSize); // GOOD
@@ -73,7 +73,7 @@ void test3(unsigned size, char *buf, unsigned anotherSize) {
     }
 
     if(anotherSize <= size + 1) {
-        strncpy(str->string, buf, anotherSize); // BAD [NOT DETECTED]
+        strncpy(str->string, buf, anotherSize); // $ MISSING: Alert // BAD [NOT DETECTED]
     }
 
     if(anotherSize <= str->size + 2) {
@@ -81,7 +81,7 @@ void test3(unsigned size, char *buf, unsigned anotherSize) {
     }
 
     if(anotherSize <= size + 2) {
-        strncpy(str->string, buf, anotherSize); // BAD [NOT DETECTED]
+        strncpy(str->string, buf, anotherSize); // $ MISSING: Alert // BAD [NOT DETECTED]
     }
 }
 
@@ -138,7 +138,7 @@ void test4(unsigned size, char *buf, unsigned anotherSize) {
     }
 
     if(anotherSize <= size + 2) {
-        strncpy(str->string, buf, anotherSize); // BAD [NOT DETECTED]
+        strncpy(str->string, buf, anotherSize); // $ MISSING: Alert // BAD [NOT DETECTED]
     }
 }
 
@@ -229,7 +229,7 @@ void repeated_alerts(unsigned size, unsigned offset) {
   while(unknown()) {
     ++size;
   }
-  memset(buffer, 0, size); // BAD [NOT DETECTED]
+  memset(buffer, 0, size); // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 void set_string(string_t* p_str, char* buffer) {
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/test_buffer_overrun.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/test_buffer_overrun.cpp
index 8554f8c62fb..54fb672b881 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/test_buffer_overrun.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/test_buffer_overrun.cpp
@@ -5,7 +5,7 @@ void test_buffer_overrun_in_for_loop()
 {
     uint8_t data[SIZE] = {0};
     for (int x = 0; x < SIZE * 2; x++) {
-        data[x] = 0x41; // BAD [NOT DETECTED]
+        data[x] = 0x41; // $ MISSING: Alert // BAD [NOT DETECTED]
     }
 }
 
@@ -14,7 +14,7 @@ void test_buffer_overrun_in_while_loop_using_pointer_arithmetic()
     uint8_t data[SIZE] = {0};
     int offset = 0;
     while (offset < SIZE * 2) {
-        *(data + offset) = 0x41; // BAD [NOT DETECTED]
+        *(data + offset) = 0x41; // $ MISSING: Alert // BAD [NOT DETECTED]
         offset++;
     }
 }
@@ -24,7 +24,7 @@ void test_buffer_overrun_in_while_loop_using_array_indexing()
     uint8_t data[SIZE] = {0};
     int offset = 0;
     while (offset < SIZE * 2) {
-        data[offset] = 0x41; // BAD [NOT DETECTED]
+        data[offset] = 0x41; // $ MISSING: Alert // BAD [NOT DETECTED]
         offset++;
     }
 }
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests.cpp
index 44b2bdae6e8..4bd5d6935d2 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests.cpp
@@ -575,7 +575,7 @@ void test20()
 	}
 
 	num = 101;
-	if (fread(intBuffer, sizeof(int), num, fileSource) > 0) // BAD [NOT DETECTED]
+	if (fread(intBuffer, sizeof(int), num, fileSource) > 0) // $ MISSING: Alert // BAD [NOT DETECTED]
 	{
 		// ...
 	}
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/var_size_struct.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/var_size_struct.cpp
index 20beffd578b..01d4ae35313 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/var_size_struct.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/var_size_struct.cpp
@@ -51,8 +51,8 @@ void testVarString(int n) {
     s1->str[1] = '?'; // GOOD
     s2->str[1] = '?'; // GOOD
     s3->str[1] = '?'; // GOOD
-    s4->str[1] = '?'; // BAD [NOT DETECTED]
-    s5->str[1] = '?'; // BAD [NOT DETECTED]
+    s4->str[1] = '?'; // $ MISSING: Alert // BAD [NOT DETECTED]
+    s5->str[1] = '?'; // $ MISSING: Alert // BAD [NOT DETECTED]
   }
 }
 
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/tests2.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/tests2.cpp
index b9c3a7af36c..231929e3192 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/tests2.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/tests2.cpp
@@ -60,5 +60,5 @@ void test3() {
   dest2 = (char*)malloc(3);
   if (!dest2)
     return;
-  snprintf(dest2, sizeof(src), "%s", src); // BAD [NOT DETECTED]
+  snprintf(dest2, sizeof(src), "%s", src); // $ MISSING: Alert // BAD [NOT DETECTED]
 }
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/unions.c b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/unions.c
index ccfb730b2b9..7779ab08251 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/unions.c
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/unions.c
@@ -22,12 +22,12 @@ void unions_test(MyUnion *mu)
 	strcpy(mu, "1234567890"); // GOOD
 	strcpy(&(mu->ptr), "1234567890"); // GOOD (dubious)
 	strcpy(&(mu->buffer), "1234567890"); // GOOD
-	strcpy(mu, "12345678901234567890"); // BAD [NOT DETECTED]
+	strcpy(mu, "12345678901234567890"); // $ MISSING: Alert // BAD [NOT DETECTED]
 	strcpy(&(mu->ptr), "12345678901234567890"); // $ Alert[cpp/very-likely-overrunning-write] // BAD
 	strcpy(&(mu->buffer), "12345678901234567890"); // $ Alert[cpp/very-likely-overrunning-write] // BAD
 
 	mu->ptr = buffer;
 	strcpy(mu->ptr, "1234567890"); // GOOD
 	strcpy(mu->ptr, "12345678901234567890"); // GOOD
-	strcpy(mu->ptr, "123456789012345678901234567890"); // BAD [NOT DETECTED]
+	strcpy(mu->ptr, "123456789012345678901234567890"); // $ MISSING: Alert // BAD [NOT DETECTED]
 }
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test2.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test2.cpp
index 9e590d82512..7efaa43ab3b 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test2.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test2.cpp
@@ -39,7 +39,7 @@ namespace std
 //// Test code /////
 
 static void bad1(char *str) {
-    // BAD -- Not allocating space for '\0' terminator [NOT DETECTED]
+    // $ MISSING: Alert // BAD -- Not allocating space for '\0' terminator [NOT DETECTED]
     char *buffer = (char *)malloc(strlen(str));
     std::string str2(buffer);
     free(buffer);
@@ -53,7 +53,7 @@ static void good1(char *str) {
 }
 
 static void bad2(wchar_t *str) {
-    // BAD -- Not allocating space for '\0' terminator [NOT DETECTED]
+    // $ MISSING: Alert // BAD -- Not allocating space for '\0' terminator [NOT DETECTED]
     wchar_t *buffer = (wchar_t *)calloc(wcslen(str), sizeof(wchar_t));
     wcscpy(buffer, str);
     free(buffer);
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.c b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.c
index 4c1ce290cf4..5e7902800cd 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.c
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.c
@@ -68,7 +68,7 @@ void randomTester() {
   }
 
   {
-    int r = rand() + 100; // BAD [NOT DETECTED]
+    int r = rand() + 100; // $ MISSING: Alert // BAD [NOT DETECTED]
   }
 
   {
@@ -84,20 +84,20 @@ void randomTester() {
   }
 
   {
-    int r = RAND2() + 100; // BAD [NOT DETECTED]
+    int r = RAND2() + 100; // $ MISSING: Alert // BAD [NOT DETECTED]
   }
 
   {
     int r = RAND();
     int *ptr_r = &r;
-    *ptr_r += 100; // BAD [NOT DETECTED]
+    *ptr_r += 100; // $ MISSING: Alert // BAD [NOT DETECTED]
   }
 
   {
     int r = 0;
     int *ptr_r = &r;
     *ptr_r = RAND();
-    r += 100; // BAD [NOT DETECTED]
+    r += 100; // $ MISSING: Alert // BAD [NOT DETECTED]
   }
 
   {
@@ -142,7 +142,7 @@ void moreTests() {
   {
     int r = rand();
 
-    r <<= 8; // BAD [NOT DETECTED]
+    r <<= 8; // $ MISSING: Alert // BAD [NOT DETECTED]
   }
 
   {
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.cpp
index 20326533dd8..bc6314a4ac6 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.cpp
@@ -157,8 +157,8 @@ int test_underflow()
 int test_cast()
 {
 	int x = rand();
-	short a = x; // BAD [NOT DETECTED]
-	short b = -x; // BAD [NOT DETECTED]
+	short a = x; // $ MISSING: Alert // BAD [NOT DETECTED]
+	short b = -x; // $ MISSING: Alert // BAD [NOT DETECTED]
 	long long c = x; // GOOD
 	long long d = -x; // GOOD
 }
@@ -174,7 +174,7 @@ void test_float()
 	{
 		int x = rand();
 		float y = x * 5.0f; // GOOD
-		int z = y; // BAD [NOT DETECTED]
+		int z = y; // $ MISSING: Alert // BAD [NOT DETECTED]
 	}
 
 	{
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticWithExtremeValues/test.c b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticWithExtremeValues/test.c
index 79650a316f9..f557e62a9d6 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticWithExtremeValues/test.c
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticWithExtremeValues/test.c
@@ -65,7 +65,7 @@ void test_crement() {
   sc9 += 1; // GOOD
 
   sc10 = 1;
-  sc10 += CHAR_MAX; // BAD [NOT DETECTED]
+  sc10 += CHAR_MAX; // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 void test_negatives() {
@@ -75,13 +75,13 @@ void test_negatives() {
   sc1 += 0; // GOOD
   sc1 += -1; // GOOD
   sc2 = CHAR_MIN;
-  sc2 += -1; // BAD [NOT DETECTED]
+  sc2 += -1; // $ MISSING: Alert // BAD [NOT DETECTED]
   sc3 = CHAR_MIN;
-  sc3 = sc3 + -1; // BAD [NOT DETECTED]
+  sc3 = sc3 + -1; // $ MISSING: Alert // BAD [NOT DETECTED]
   sc4 = CHAR_MAX;
-  sc4 -= -1; // BAD [NOT DETECTED]
+  sc4 -= -1; // $ MISSING: Alert // BAD [NOT DETECTED]
   sc5 = -1;
-  sc5 += CHAR_MIN; // BAD [NOT DETECTED]
+  sc5 += CHAR_MIN; // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 void test_guards1(int cond) {
@@ -101,7 +101,7 @@ void test_guards2(int cond) {
 
 	if (x < 128) return;
 
-	return x + 1; // BAD [NOT DETECTED]
+	return x + 1; // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 void test_guards3(int cond) {
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp
index 4251e7cfcf5..448e6a1a8e0 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp
@@ -42,7 +42,7 @@ int main(int argc, char **argv) { // $ Source
 	MyStruct *arr1 = (MyStruct *)malloc(sizeof(MyStruct)); // GOOD
 	MyStruct *arr2 = (MyStruct *)malloc(tainted); // $ Alert // BAD
 	MyStruct *arr3 = (MyStruct *)malloc(tainted * sizeof(MyStruct)); // $ Alert // BAD
-	MyStruct *arr4 = (MyStruct *)malloc(getTainted() * sizeof(MyStruct)); // BAD [NOT DETECTED]
+	MyStruct *arr4 = (MyStruct *)malloc(getTainted() * sizeof(MyStruct)); // $ MISSING: Alert // BAD [NOT DETECTED]
 	MyStruct *arr5 = (MyStruct *)malloc(sizeof(MyStruct) + tainted); // $ Alert // BAD
 
 	int size = tainted * 8;
@@ -158,7 +158,7 @@ void more_bounded_tests() {
 
 		if (size < 100)
 		{
-			malloc(size * sizeof(int)); // BAD [NOT DETECTED]
+			malloc(size * sizeof(int)); // $ MISSING: Alert // BAD [NOT DETECTED]
 		}
 	}
 
@@ -213,7 +213,7 @@ void more_bounded_tests() {
 	{
 		int size = atoi(getenv("USER"));
 
-		malloc(size * sizeof(int)); // BAD [NOT DETECTED]
+		malloc(size * sizeof(int)); // $ MISSING: Alert // BAD [NOT DETECTED]
 
 		if ((size > 0) && (size < 100))
 		{
@@ -226,7 +226,7 @@ void more_bounded_tests() {
 
 		if (size > 100)
 		{
-			malloc(size * sizeof(int)); // BAD [NOT DETECTED]
+			malloc(size * sizeof(int)); // $ MISSING: Alert // BAD [NOT DETECTED]
 		}
 	}
 }
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp
index 6d9fef227ac..9b6b1daf874 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp
@@ -6,9 +6,9 @@ void test1(int size) {
     char a = *q; // $ deref=L5->L6 Alert[cpp/invalid-pointer-deref]=r1 // BAD
     char b = *(q - 1); // GOOD
     char c = *(q + 1); // $ deref=L5->L8+1 Alert[cpp/invalid-pointer-deref]=r2 // BAD
-    char d = *(q + size); // BAD [NOT DETECTED]
+    char d = *(q + size); // $ MISSING: Alert // BAD [NOT DETECTED]
     char e = *(q - size); // GOOD
-    char f = *(q + size + 1); // BAD [NOT DETECTED]
+    char f = *(q + size + 1); // $ MISSING: Alert // BAD [NOT DETECTED]
     char g = *(q - size - 1); // GOOD
 }
 
@@ -18,9 +18,9 @@ void test2(int size) {
     char a = *q; // GOOD
     char b = *(q - 1); // GOOD
     char c = *(q + 1); // $ deref=L17->L20 Alert[cpp/invalid-pointer-deref]=r3 // BAD
-    char d = *(q + size); // BAD [NOT DETECTED]
+    char d = *(q + size); // $ MISSING: Alert // BAD [NOT DETECTED]
     char e = *(q - size); // GOOD
-    char f = *(q + size + 1); // BAD [NOT DETECTED]
+    char f = *(q + size + 1); // $ MISSING: Alert // BAD [NOT DETECTED]
     char g = *(q - size - 1); // GOOD
 }
 
@@ -30,21 +30,21 @@ void test3(int size) {
     char a = *q; // $ deref=L29->L30 Alert[cpp/invalid-pointer-deref]=r4 // BAD
     char b = *(q - 1); // GOOD
     char c = *(q + 1); // $ deref=L29->L32+1 Alert[cpp/invalid-pointer-deref]=r5 // BAD
-    char d = *(q + size); // BAD [NOT DETECTED]
+    char d = *(q + size); // $ MISSING: Alert // BAD [NOT DETECTED]
     char e = *(q - size); // GOOD
-    char f = *(q + size + 1); // BAD [NOT DETECTED]
+    char f = *(q + size + 1); // $ MISSING: Alert // BAD [NOT DETECTED]
     char g = *(q - size - 1); // GOOD
 }
 
 void test4(int size) {
     char* p = (char*)malloc(size - 1);
     char* q = p + (size - 1); // $ MISSING: alloc=L40-1
-    char a = *q; // $ MISSING: deref=L42 // BAD [NOT DETECTED]
+    char a = *q; // $ MISSING: deref=L42 // $ MISSING: Alert // BAD [NOT DETECTED]
     char b = *(q - 1); // GOOD
-    char c = *(q + 1); // $ MISSING: deref=L44+1 // BAD [NOT DETECTED]
-    char d = *(q + size); // BAD [NOT DETECTED]
+    char c = *(q + 1); // $ MISSING: deref=L44+1 // $ MISSING: Alert // BAD [NOT DETECTED]
+    char d = *(q + size); // $ MISSING: Alert // BAD [NOT DETECTED]
     char e = *(q - size); // GOOD
-    char f = *(q + size + 1); // BAD [NOT DETECTED]
+    char f = *(q + size + 1); // $ MISSING: Alert // BAD [NOT DETECTED]
     char g = *(q - size - 1); // GOOD
 }
 
@@ -93,7 +93,7 @@ void test6(int size) {
     }
 
     for (char* p = arr.begin; p <= arr.end; ++p) {
-        *p = 0; // $ MISSING: deref=L83->L91->L96 deref=L83->L95->L96 // BAD [NOT DETECTED]
+        *p = 0; // $ MISSING: deref=L83->L91->L96 deref=L83->L95->L96 // $ MISSING: Alert // BAD [NOT DETECTED]
     }
 
     for (char* p = arr.begin; p < arr.end; ++p) {
@@ -107,7 +107,7 @@ void test7_callee(array_t arr) {
     }
 
     for (char* p = arr.begin; p <= arr.end; ++p) {
-        *p = 0; // $ MISSING: deref=L83->L105->L110 deref=L83->L109->L110 // BAD [NOT DETECTED]
+        *p = 0; // $ MISSING: deref=L83->L105->L110 deref=L83->L109->L110 // $ MISSING: Alert // BAD [NOT DETECTED]
     }
 
     for (char* p = arr.begin; p < arr.end; ++p) {
@@ -134,7 +134,7 @@ void test8(int size) {
     }
 
     for (int i = 0; i <= arr.end - arr.begin; i++) {
-        *(arr.begin + i) = 0; // BAD [NOT DETECTED]
+        *(arr.begin + i) = 0; // $ MISSING: Alert // BAD [NOT DETECTED]
     }
 }
 
@@ -154,7 +154,7 @@ void test9(int size) {
     }
 
     for (char* p = arr->begin; p <= arr->end; ++p) {
-        *p = 0; // $ MISSING: deref=L144->L156->L157 // BAD [NOT DETECTED]
+        *p = 0; // $ MISSING: deref=L144->L156->L157 // $ MISSING: Alert // BAD [NOT DETECTED]
     }
 
     for (char* p = arr->begin; p < arr->end; ++p) {
@@ -168,7 +168,7 @@ void test10_callee(array_t *arr) {
     }
 
     for (char* p = arr->begin; p <= arr->end; ++p) {
-        *p = 0; // $ MISSING: deref=L144->L166->L171 deref=L144->L170->L171 // BAD [NOT DETECTED]
+        *p = 0; // $ MISSING: deref=L144->L166->L171 deref=L144->L170->L171 // $ MISSING: Alert // BAD [NOT DETECTED]
     }
 
     for (char* p = arr->begin; p < arr->end; ++p) {
@@ -181,7 +181,7 @@ void test10(int size) {
 }
 
 void deref_plus_one(char* q) {
-    char a = *(q + 1); // BAD [NOT DETECTED]
+    char a = *(q + 1); // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 void test11(unsigned size) {
@@ -198,7 +198,7 @@ void test12(unsigned len, unsigned index) {
         return;
     }
 
-    p[index] = '\0'; // $ MISSING: deref=L195->L201 // BAD [NOT DETECTED]
+    p[index] = '\0'; // $ MISSING: deref=L195->L201 // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 void test13(unsigned len, unsigned index) {
@@ -703,7 +703,7 @@ void test34(unsigned size) {
 }
 
 void deref(char* q) {
-  char x = *q; // $ MISSING: deref=L714->L705->L706 // BAD [NOT DETECTED]
+  char x = *q; // $ MISSING: deref=L714->L705->L706 // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 void test35(size_t size, char* q)
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-295/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-295/test.cpp
index d93fffc71d6..07927e92b48 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-295/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-295/test.cpp
@@ -113,7 +113,7 @@ void test1_1(SSL *ssl)
 	{
 		int result = SSL_get_verify_result(ssl);
 
-		if (result == 1) // BAD (conflates OK and a non-OK codes in `else`) [NOT DETECTED]
+		if (result == 1) // $ MISSING: Alert // BAD (conflates OK and a non-OK codes in `else`) [NOT DETECTED]
 		{
 		} else {
 		}
@@ -139,7 +139,7 @@ void test1_3(SSL *ssl)
 {
 	int result = SSL_get_verify_result(ssl);
 
-	if (result == 0) { // BAD (error code 1 is treated as OK, not as non-OK) [NOT DETECTED]
+	if (result == 0) { // $ MISSING: Alert // BAD (error code 1 is treated as OK, not as non-OK) [NOT DETECTED]
 		do_good();
 	} else if (result == 1) {
 		do_good();
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp
index 4bc6fbe6773..2f506a21235 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp
@@ -536,14 +536,14 @@ void tests2(person_info *pi)
 		char buffer[1024];
 
 		snprintf(buffer, 1024, "salary = %i\n", pi->newSalary);
-		send(val(), buffer, strlen(buffer), val()); // BAD [NOT DETECTED]
+		send(val(), buffer, strlen(buffer), val()); // $ MISSING: Alert // BAD [NOT DETECTED]
 	}
 	{
 		char buffer[1024];
 		int sal = pi->newSalary;
 
 		snprintf(buffer, 1024, "salary = %i\n", sal);
-		send(val(), buffer, strlen(buffer), val()); // BAD [NOT DETECTED]
+		send(val(), buffer, strlen(buffer), val()); // $ MISSING: Alert // BAD [NOT DETECTED]
 	}
 	{
 		char buffer[1024];
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-327/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-327/test.cpp
index c7117051373..0d65fbd65be 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-327/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-327/test.cpp
@@ -43,10 +43,10 @@ void test_macros(void *data, size_t amount, const char *str)
 	ENCRYPT_WITH_RC20(data, amount); // GOOD (if there ever is an RC20 algorithm, we have no reason to believe it's weak)
 	ENCRYPT_WITH_DES_REMOVED(data, amount); // GOOD (implementation has been deleted)
 
-	DESENCRYPT(data, amount); // BAD [NOT DETECTED]
-	RC2ENCRYPT(data, amount); // BAD [NOT DETECTED]
+	DESENCRYPT(data, amount); // $ MISSING: Alert // BAD [NOT DETECTED]
+	RC2ENCRYPT(data, amount); // $ MISSING: Alert // BAD [NOT DETECTED]
 	AESENCRYPT(data, amount); // GOOD (good algorithm)
-	DES3ENCRYPT(data, amount); // BAD [NOT DETECTED]
+	DES3ENCRYPT(data, amount); // $ MISSING: Alert // BAD [NOT DETECTED]
 
 	DES_DO_ENCRYPTION(data, amount); // BAD
 	RUN_DES_ENCODING(data, amount); // BAD
@@ -91,16 +91,16 @@ void test_functions(void *data, size_t amount, const char *str)
 	encrypt3DES(data, amount); // BAD
 	encryptTripleDES(data, amount); // BAD
 
-	DESEncrypt(data, amount); // BAD [NOT DETECTED]
-	RC2Encrypt(data, amount); // BAD [NOT DETECTED]
+	DESEncrypt(data, amount); // $ MISSING: Alert // BAD [NOT DETECTED]
+	RC2Encrypt(data, amount); // $ MISSING: Alert // BAD [NOT DETECTED]
 	AESEncrypt(data, amount); // GOOD (good algorithm)
-	DES3Encrypt(data, amount); // BAD [NOT DETECTED]
+	DES3Encrypt(data, amount); // $ MISSING: Alert // BAD [NOT DETECTED]
 
-	DoDESEncryption(data, amount); // BAD [NOT DETECTED]
-	encryptDes(data, amount); // BAD [NOT DETECTED]
+	DoDESEncryption(data, amount); // $ MISSING: Alert // BAD [NOT DETECTED]
+	encryptDes(data, amount); // $ MISSING: Alert // BAD [NOT DETECTED]
 	do_des_encrypt(data, amount); // BAD
-	DES_Set_Key(str); // BAD [NOT DETECTED]
-	DESSetKey(str); // BAD [NOT DETECTED]
+	DES_Set_Key(str); // $ MISSING: Alert // BAD [NOT DETECTED]
+	DESSetKey(str); // $ MISSING: Alert // BAD [NOT DETECTED]
 
 	Des(); // GOOD (probably nothing to do with encryption)
 	Desmond(str); // GOOD (probably nothing to do with encryption)
@@ -118,7 +118,7 @@ void my_implementation8();
 
 void test_macros2()
 {
-	INIT_ENCRYPT_WITH_DES(); // BAD [NOT DETECTED]
+	INIT_ENCRYPT_WITH_DES(); // $ MISSING: Alert // BAD [NOT DETECTED]
 	INIT_ENCRYPT_WITH_AES(); // GOOD (good algorithm)
 
 	// ...
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-327/test2.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-327/test2.cpp
index 49bbbf1b25e..0fb6c88e2bd 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-327/test2.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-327/test2.cpp
@@ -173,13 +173,13 @@ const char *get_algorithm3();
 
 void do_unseen_encrypts(char *data, size_t amount, keytype key)
 {
-	set_encryption_algorithm1(ALGO_DES); // BAD [NOT DETECTED]
+	set_encryption_algorithm1(ALGO_DES); // $ MISSING: Alert // BAD [NOT DETECTED]
 	set_encryption_algorithm1(ALGO_AES); // GOOD
 
-	set_encryption_algorithm2(USE_DES); // BAD [NOT DETECTED]
+	set_encryption_algorithm2(USE_DES); // $ MISSING: Alert // BAD [NOT DETECTED]
 	set_encryption_algorithm2(USE_AES); // GOOD
 
-	set_encryption_algorithm3("DES"); // BAD [NOT DETECTED]
+	set_encryption_algorithm3("DES"); // $ MISSING: Alert // BAD [NOT DETECTED]
 	set_encryption_algorithm3("AES"); // GOOD
 	set_encryption_algorithm3("AES-256"); // GOOD
 
@@ -189,7 +189,7 @@ void do_unseen_encrypts(char *data, size_t amount, keytype key)
 	encryption_with2(data, amount, key, USE_DES); // BAD
 	encryption_with2(data, amount, key, USE_AES); // GOOD
 
-	encryption_with3(data, amount, key, "DES"); // BAD [NOT DETECTED]
+	encryption_with3(data, amount, key, "DES"); // $ MISSING: Alert // BAD [NOT DETECTED]
 	encryption_with3(data, amount, key, "AES"); // GOOD
 	encryption_with3(data, amount, key, "AES-256"); // GOOD
 
@@ -258,7 +258,7 @@ void do_fn_ptr(char *data, size_t amount, keytype key)
 {
 	implementation_fn_ptr impl;
 
-	impl = &my_des_implementation; // BAD [NOT DETECTED]
+	impl = &my_des_implementation; // $ MISSING: Alert // BAD [NOT DETECTED]
 	impl(data, amount, key);
 
 	impl = &my_aes_implementation; // GOOD
@@ -302,12 +302,12 @@ public:
 void do_template_classes(char *data)
 {
 	desEncryptor *p = new desEncryptor(); // BAD
-	container<desEncryptor> c; // BAD [NOT DETECTED]
-	templateDesEncryptor<char *> t; // BAD [NOT DETECTED]
+	container<desEncryptor> c; // $ MISSING: Alert // BAD [NOT DETECTED]
+	templateDesEncryptor<char *> t; // $ MISSING: Alert // BAD [NOT DETECTED]
 
 	p->doDesEncryption(data); // BAD
 	c.obj->doDesEncryption(data); // BAD
-	t.doDesEncryption(data); // BAD [NOT DETECTED]
+	t.doDesEncryption(data); // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 // --- assert ---
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp
index e8e0161e1e7..1d8e3e4bdbf 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp
@@ -180,7 +180,7 @@ void test2_9(const char *path, int arg)
 
 	if (stat(path, &buf))
 	{
-		f = creat(path, arg); // BAD [NOT DETECTED]
+		f = creat(path, arg); // $ MISSING: Alert // BAD [NOT DETECTED]
 	}
 
 	// ...
@@ -193,7 +193,7 @@ void test2_10(int dir, const char *path, int arg)
 
 	if (fstatat(dir, path, &buf))
 	{
-		f = openat(dir, path, arg); // BAD [NOT DETECTED]
+		f = openat(dir, path, arg); // $ MISSING: Alert // BAD [NOT DETECTED]
 	}
 
 	// ...
@@ -259,7 +259,7 @@ void test3_1(const char *path, int arg)
 	int f;
 
 	f = open(path, arg);
-	if (stat(path, &buf)) // BAD [NOT DETECTED]
+	if (stat(path, &buf)) // $ MISSING: Alert // BAD [NOT DETECTED]
 	{
 		// ...
 	}
@@ -314,7 +314,7 @@ void test5_2(const char *path1, const char *path2)
 
 	if (!rename(path1, path2))
 	{
-		f = fopen(path2, "r"); // BAD [NOT DETECTED]
+		f = fopen(path2, "r"); // $ MISSING: Alert // BAD [NOT DETECTED]
 	}
 }
 
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp
index ae217188c62..bdff14e60e4 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp
@@ -686,7 +686,7 @@ void test() {
   for (auto x : returnRef()[0]) {} // GOOD
   for (auto x : returnRef().at(0)) {} // GOOD
 
-  for(auto it = returnValue().begin(); it != returnValue().end(); ++it) {} // BAD [NOT DETECTED]
+  for(auto it = returnValue().begin(); it != returnValue().end(); ++it) {} // $ MISSING: Alert // BAD [NOT DETECTED]
 
   {
   auto v = returnValue();
@@ -713,7 +713,7 @@ void test() {
   for(auto it = v.begin(); it != v.end(); ++it) {} // GOOD
   }
 
-  for (auto x : return_self_by_ref(returnValue())) {} // BAD [NOT DETECTED]
+  for (auto x : return_self_by_ref(returnValue())) {} // $ MISSING: Alert // BAD [NOT DETECTED]
 
   for (auto x : return_self_by_value(returnValue())) {} // GOOD
 }
@@ -728,7 +728,7 @@ std::vector<int>& ref_to_first_in_returnValue_1() {
 }
 
 std::vector<int>& ref_to_first_in_returnValue_2() {
-  return returnValue()[0]; // BAD [NOT DETECTED]
+  return returnValue()[0]; // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 std::vector<int>& ref_to_first_in_returnValue_3() {
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp
index 7dd80687e9c..da0371dfe25 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp
@@ -37,7 +37,7 @@ void test1()
 	data = (char *)malloc(100*sizeof(char));
 	use_if_nonzero(data); // GOOD
 	free(data); // $ Source
-	use_if_nonzero(data); // BAD [NOT DETECTED]
+	use_if_nonzero(data); // $ MISSING: Alert // BAD [NOT DETECTED]
 	use(data); // $ Alert // BAD
 }
 
@@ -75,7 +75,7 @@ void test4()
 	free(data); // $ Source
 	if (data)
 	{
-		use_if_nonzero(data); // BAD [NOT DETECTED]
+		use_if_nonzero(data); // $ MISSING: Alert // BAD [NOT DETECTED]
 		use(data); // $ Alert // BAD
 	}
 }
@@ -94,8 +94,8 @@ char* returnsFreedData(int i)
 void test5()
 {
 	char* data = returnsFreedData(1);
-	use_if_nonzero(data); // BAD [NOT DETECTED]
-	use(data); // BAD [NOT DETECTED]
+	use_if_nonzero(data); // $ MISSING: Alert // BAD [NOT DETECTED]
+	use(data); // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 void test6()
@@ -104,7 +104,7 @@ void test6()
 	data = (char *)malloc(100*sizeof(char));
 	data2 = data;
 	free(data); // $ Source
-	use_if_nonzero(data2); // BAD [NOT DETECTED]
+	use_if_nonzero(data2); // $ MISSING: Alert // BAD [NOT DETECTED]
 	use(data); // $ Alert // BAD
 }
 
@@ -115,7 +115,7 @@ void test7()
 	data2 = data;
 	free(data); // $ Source
 	data2 = NULL;
-	use_if_nonzero(data); // BAD [NOT DETECTED]
+	use_if_nonzero(data); // $ MISSING: Alert // BAD [NOT DETECTED]
 	use(data); // $ Alert // BAD
 }
 
@@ -126,7 +126,7 @@ void test8()
 	data = data2;
 	free(data); // $ Source
 	data2 = NULL;
-	use_if_nonzero(data); // BAD [NOT DETECTED]
+	use_if_nonzero(data); // $ MISSING: Alert // BAD [NOT DETECTED]
 	use(data); // $ Alert // BAD
 }
 
@@ -171,8 +171,8 @@ template<class T> T test()
 	T* x;
 	use(x); // GOOD
 	delete x;
-	use_if_nonzero(x); // BAD [NOT DETECTED]
-	use(x); // BAD [NOT DETECTED]
+	use_if_nonzero(x); // $ MISSING: Alert // BAD [NOT DETECTED]
+	use(x); // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 void test12(int count)
@@ -214,7 +214,7 @@ template<class T> T test15()
 	T* x;
 	use(x); // GOOD
 	delete x; // $ Source
-	use(x); // $ Alert // BAD [NOT DETECTED]
+	use(x); // $ Alert // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 void test15runner(void)
 {
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/test.cpp
index 6990bf23109..052ca4e7436 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/test.cpp
@@ -27,12 +27,12 @@ void test1()
 		use(b);
 	}
 
-	if (maybeInitialize1(&c) == 0) // BAD (initialization check is wrong) [NOT DETECTED]
+	if (maybeInitialize1(&c) == 0) // $ MISSING: Alert // BAD (initialization check is wrong) [NOT DETECTED]
 	{
 		use(c);
 	}
 
-	result1 = maybeInitialize1(&d); // BAD (initialization stored but not checked) [NOT DETECTED]
+	result1 = maybeInitialize1(&d); // $ MISSING: Alert // BAD (initialization stored but not checked) [NOT DETECTED]
 	use(d);
 
 	result2 = maybeInitialize1(&e); // GOOD
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/test.cpp
index 4a8e734e2b6..b2edb3e8bde 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/test.cpp
@@ -27,7 +27,7 @@ void test4(bool b) {
 	if (b) {
 		foo = 1;
 	}
-	use(foo); // BAD [NOT DETECTED]
+	use(foo); // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 void test5() {
@@ -43,7 +43,7 @@ void test5(int count) {
 	for (int i = 0; i < count; i++) {
 		foo = i;
 	}
-	use(foo); // BAD [NOT DETECTED]
+	use(foo); // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 void test6(bool b) {
@@ -523,7 +523,7 @@ int non_exhaustive_switch(State s) {
 			y = 2;
 			break;
 	}
-	return y; // BAD [NOT DETECTED] (y is not initialized when s = StateC)
+	return y; // $ MISSING: Alert // BAD [NOT DETECTED] (y is not initialized when s = StateC)
 }
 
 int non_exhaustive_switch_2(State s) {
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/buildless.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/buildless.cpp
index cd0c9492dde..fc48183517e 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/buildless.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/buildless.cpp
@@ -5,6 +5,6 @@ void test_buildless(const char *p_c, const short *p_short, const int *p_int, con
   *(p_short + sizeof(int)); // $ Alert // BAD
   *(p_int + sizeof(int)); // $ Alert // BAD
   *(p_8 + sizeof(int)); // GOOD (`sizeof(uint8_t)` is 1, but there's an error in the type)
-  *(p_16 + sizeof(int)); // BAD [NOT DETECTED]
-  *(p_32 + sizeof(int)); // BAD [NOT DETECTED]
+  *(p_16 + sizeof(int)); // $ MISSING: Alert // BAD [NOT DETECTED]
+  *(p_32 + sizeof(int)); // $ MISSING: Alert // BAD [NOT DETECTED]
 }
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests4.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests4.cpp
index d08c77d630b..7f2f14b8904 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests4.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests4.cpp
@@ -96,7 +96,7 @@ void test4_8(const char *fileName) {
 	xmlDoc *p;
 	int flags = XML_PARSE_OPTION_HARMLESS;
 
-	p = xmlReadFile(fileName, NULL, flags | XML_PARSE_NOENT); // BAD (parser not correctly configured) [NOT DETECTED]
+	p = xmlReadFile(fileName, NULL, flags | XML_PARSE_NOENT); // $ MISSING: Alert // BAD (parser not correctly configured) [NOT DETECTED]
 	if (p != NULL)
 	{
 		xmlFreeDoc(p);
@@ -107,7 +107,7 @@ void test4_9(const char *fileName) {
 	xmlDoc *p;
 	int flags = XML_PARSE_NOENT;
 
-	p = xmlReadFile(fileName, NULL, flags | XML_PARSE_OPTION_HARMLESS); // BAD (parser not correctly configured) [NOT DETECTED]
+	p = xmlReadFile(fileName, NULL, flags | XML_PARSE_OPTION_HARMLESS); // $ MISSING: Alert // BAD (parser not correctly configured) [NOT DETECTED]
 	if (p != NULL)
 	{
 		xmlFreeDoc(p);
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests5.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests5.cpp
index 1c945a6a6b3..56a7905653d 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests5.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests5.cpp
@@ -93,11 +93,11 @@ void test5_8(DOMImplementationLS *impl, InputSource &data) {
 	DOMLSParser *p = impl->createLSParser();
 	DOMConfiguration *cfg = p->getDomConfig();
 
-	p->parse(data); // BAD (parser not correctly configured) [NOT DETECTED]
+	p->parse(data); // $ MISSING: Alert // BAD (parser not correctly configured) [NOT DETECTED]
 
 	cfg->setParameter(XMLUni::fgXercesDisableDefaultEntityResolution, true);
 	p->parse(data); // GOOD
 
 	cfg->setParameter(XMLUni::fgXercesDisableDefaultEntityResolution, false);
-	p->parse(data); // BAD (parser not correctly configured) [NOT DETECTED]
+	p->parse(data); // $ MISSING: Alert // BAD (parser not correctly configured) [NOT DETECTED]
 }
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/test.cpp
index 2f7eaa12cca..8df97d9afd3 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/test.cpp
@@ -15,7 +15,7 @@ extern const char* adminCookie;
 
 const char *currentUser;
 
-void processRequest() 
+void processRequest()
 {
      const char *userName = getenv("USER_NAME"); // $ Source
 
@@ -35,17 +35,17 @@ void processRequest()
         adminPrivileges = 0; // OK, since it's a 0 and not a 1
      }
 
-     // BAD (requires pointer analysis to catch) [NOT DETECTED]
+     // $ MISSING: Alert // BAD (requires pointer analysis to catch) [NOT DETECTED]
      const char** userp = &currentUser;
      *userp = userName;
      if (!strcmp(currentUser, "admin")) {
-       adminPrivileges = 1;     
+       adminPrivileges = 1;
      }
 }
 
 void bugWithBinop() {
      const char *userName = getenv("USER_NAME");
-     
+
      // The following is tainted, but should not cause
      // the whole program to be considered tainted.
      int bytes = strlen(userName) + 1;
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
index 5d03c1fef85..d71c66838c9 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
@@ -138,7 +138,7 @@ void test12() {
   // This has doesn't have any non-bitfield member, so we don't detect
   // the problem here since the query currently ignores bitfields.
   S1* s1 = new S1;
-  HasBitFields* hbf = reinterpret_cast<HasBitFields*>(s1); // BAD [NOT DETECTED]
+  HasBitFields* hbf = reinterpret_cast<HasBitFields*>(s1); // $ MISSING: Alert // BAD [NOT DETECTED]
 
   S1* s1_2 = new S1; // $ Source
   // This one has a non-bitfield members. So we detect the problem
@@ -168,7 +168,7 @@ void test14(bool b) {
     a = new Dog;
   }
   if(!b) {
-    Cat* d = static_cast<Cat*>(a); // BAD [NOT DETECTED]
+    Cat* d = static_cast<Cat*>(a); // $ MISSING: Alert // BAD [NOT DETECTED]
   }
 }
 
@@ -206,7 +206,7 @@ union MyUnion
 void test16() {
   void* si = new SingleInt;
   // ...
-  MyUnion* mu = (MyUnion*)si; // BAD [NOT DETECTED]
+  MyUnion* mu = (MyUnion*)si; // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 struct UnrelatedStructSize {
diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/DeleteThis.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/DeleteThis.cpp
index 7b8ef36945b..ee6dd48394d 100644
--- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/DeleteThis.cpp	
+++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/DeleteThis.cpp	
@@ -125,8 +125,8 @@ public:
 		c = new MyClass6(); // GOOD
 
 		d = new MyClass7(); // $ Alert // BAD
-		e = new MyClass7(); // BAD [NOT DETECTED]
-		f = new MyClass8(); // BAD [NOT DETECTED]
+		e = new MyClass7(); // $ MISSING: Alert // BAD [NOT DETECTED]
+		f = new MyClass8(); // $ MISSING: Alert // BAD [NOT DETECTED]
 	}
  	~MyClass9()
 	{
diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/QObject.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/QObject.cpp
index d6d481521e9..eb3d1693a9f 100644
--- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/QObject.cpp	
+++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/QObject.cpp	
@@ -13,7 +13,7 @@ class MyQtUser {
   MyQtUser(QObject *parent) {
     // This object sets its parent pointer to null and thus must be deleted
     // manually.
-    noParent = new DerivedFromQObject(nullptr); // BAD [NOT DETECTED]
+    noParent = new DerivedFromQObject(nullptr); // $ MISSING: Alert // BAD [NOT DETECTED]
 
     // This object does not need to be deleted because it will be deleted by
     // its parent object when the time is right.
diff --git a/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 164/test.c b/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 164/test.c
index 0a7a9d28c1b..87a2cd8420d 100644
--- a/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 164/test.c	
+++ b/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 164/test.c	
@@ -10,10 +10,10 @@ void f(unsigned char uc, signed char sc, int i) {
 	uc << 7;
 	uc << 8; // $ Alert // BAD
 
-	uc >>= -1; // BAD [NOT DETECTED]
-	uc >>= 0; // BAD [NOT DETECTED]
+	uc >>= -1; // $ MISSING: Alert // BAD [NOT DETECTED]
+	uc >>= 0; // $ MISSING: Alert // BAD [NOT DETECTED]
 	uc >>= 7;
-	uc >>= 8; // BAD [NOT DETECTED]
+	uc >>= 8; // $ MISSING: Alert // BAD [NOT DETECTED]
 
 	sc >> -1; // $ Alert // BAD
 	sc >> 0;
diff --git a/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 165/test.c b/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 165/test.c
index 8fa1ef8173b..45004352f2c 100644
--- a/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 165/test.c	
+++ b/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 165/test.c	
@@ -23,5 +23,5 @@ void f(int i, unsigned int ui, signed int si, TUI tui, volatile unsigned int vui
 	vui = -vui; // $ Alert // BAD
 	u = -u; // $ Alert // BAD
 	us = -us; // $ Alert // BAD
-	ui = -(5U); // BAD [NOT DETECTED]
+	ui = -(5U); // $ MISSING: Alert // BAD [NOT DETECTED]
 }