diff --git a/python/ql/test/query-tests/Security/CWE-020-ExternalAPIs/ExternalAPIsUsedWithUntrustedData.expected b/python/ql/test/query-tests/POI/ExternalAPIs/ExternalAPIsUsedWithUntrustedData.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-020-ExternalAPIs/ExternalAPIsUsedWithUntrustedData.expected
rename to python/ql/test/query-tests/POI/ExternalAPIs/ExternalAPIsUsedWithUntrustedData.expected
diff --git a/python/ql/test/query-tests/Security/CWE-020-ExternalAPIs/ExternalAPIsUsedWithUntrustedData.qlref b/python/ql/test/query-tests/POI/ExternalAPIs/ExternalAPIsUsedWithUntrustedData.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-020-ExternalAPIs/ExternalAPIsUsedWithUntrustedData.qlref
rename to python/ql/test/query-tests/POI/ExternalAPIs/ExternalAPIsUsedWithUntrustedData.qlref
diff --git a/python/ql/test/query-tests/Security/CWE-020-ExternalAPIs/UntrustedDataToExternalAPI.expected b/python/ql/test/query-tests/POI/ExternalAPIs/UntrustedDataToExternalAPI.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-020-ExternalAPIs/UntrustedDataToExternalAPI.expected
rename to python/ql/test/query-tests/POI/ExternalAPIs/UntrustedDataToExternalAPI.expected
diff --git a/python/ql/test/query-tests/Security/CWE-020-ExternalAPIs/UntrustedDataToExternalAPI.qlref b/python/ql/test/query-tests/POI/ExternalAPIs/UntrustedDataToExternalAPI.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-020-ExternalAPIs/UntrustedDataToExternalAPI.qlref
rename to python/ql/test/query-tests/POI/ExternalAPIs/UntrustedDataToExternalAPI.qlref
diff --git a/python/ql/test/query-tests/Security/CWE-020-ExternalAPIs/test.py b/python/ql/test/query-tests/POI/ExternalAPIs/test.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-020-ExternalAPIs/test.py
rename to python/ql/test/query-tests/POI/ExternalAPIs/test.py
diff --git a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.expected b/python/ql/test/query-tests/Security/BadPractice/BindToAllInterfaces/BindToAllInterfaces.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.expected
rename to python/ql/test/query-tests/Security/BadPractice/BindToAllInterfaces/BindToAllInterfaces.expected
diff --git a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.qlref b/python/ql/test/query-tests/Security/BadPractice/BindToAllInterfaces/BindToAllInterfaces.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.qlref
rename to python/ql/test/query-tests/Security/BadPractice/BindToAllInterfaces/BindToAllInterfaces.qlref
diff --git a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py b/python/ql/test/query-tests/Security/BadPractice/BindToAllInterfaces/BindToAllInterfaces_test.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
rename to python/ql/test/query-tests/Security/BadPractice/BindToAllInterfaces/BindToAllInterfaces_test.py
diff --git a/python/ql/test/query-tests/Security/CVE-2018-1281/options b/python/ql/test/query-tests/Security/BadPractice/BindToAllInterfaces/options
similarity index 100%
rename from python/ql/test/query-tests/Security/CVE-2018-1281/options
rename to python/ql/test/query-tests/Security/BadPractice/BindToAllInterfaces/options
diff --git a/python/ql/test/query-tests/Security/CWE-215/FlaskDebug.expected b/python/ql/test/query-tests/Security/BadPractice/FlaskRunWithDebug/FlaskDebug.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-215/FlaskDebug.expected
rename to python/ql/test/query-tests/Security/BadPractice/FlaskRunWithDebug/FlaskDebug.expected
diff --git a/python/ql/test/query-tests/Security/CWE-215/FlaskDebug.qlref b/python/ql/test/query-tests/Security/BadPractice/FlaskRunWithDebug/FlaskDebug.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-215/FlaskDebug.qlref
rename to python/ql/test/query-tests/Security/BadPractice/FlaskRunWithDebug/FlaskDebug.qlref
diff --git a/python/ql/test/query-tests/Security/BadPractice/FlaskRunWithDebug/options b/python/ql/test/query-tests/Security/BadPractice/FlaskRunWithDebug/options
new file mode 100644
index 00000000000..e552c11e561
--- /dev/null
+++ b/python/ql/test/query-tests/Security/BadPractice/FlaskRunWithDebug/options
@@ -0,0 +1 @@
+semmle-extractor-options: --max-import-depth=2 -p ../../lib
diff --git a/python/ql/test/query-tests/Security/CWE-215/test.py b/python/ql/test/query-tests/Security/BadPractice/FlaskRunWithDebug/test.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-215/test.py
rename to python/ql/test/query-tests/Security/BadPractice/FlaskRunWithDebug/test.py
diff --git a/python/ql/test/query-tests/Security/CWE-295/RequestWithoutValidation.expected b/python/ql/test/query-tests/Security/BadPractice/HTTPSRequestWithoutCertValidation/RequestWithoutValidation.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-295/RequestWithoutValidation.expected
rename to python/ql/test/query-tests/Security/BadPractice/HTTPSRequestWithoutCertValidation/RequestWithoutValidation.expected
diff --git a/python/ql/test/query-tests/Security/CWE-295/RequestWithoutValidation.qlref b/python/ql/test/query-tests/Security/BadPractice/HTTPSRequestWithoutCertValidation/RequestWithoutValidation.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-295/RequestWithoutValidation.qlref
rename to python/ql/test/query-tests/Security/BadPractice/HTTPSRequestWithoutCertValidation/RequestWithoutValidation.qlref
diff --git a/python/ql/test/query-tests/Security/CWE-295/make_request.py b/python/ql/test/query-tests/Security/BadPractice/HTTPSRequestWithoutCertValidation/make_request.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-295/make_request.py
rename to python/ql/test/query-tests/Security/BadPractice/HTTPSRequestWithoutCertValidation/make_request.py
diff --git a/python/ql/test/query-tests/Security/BadPractice/HTTPSRequestWithoutCertValidation/options b/python/ql/test/query-tests/Security/BadPractice/HTTPSRequestWithoutCertValidation/options
new file mode 100644
index 00000000000..b7721e6c509
--- /dev/null
+++ b/python/ql/test/query-tests/Security/BadPractice/HTTPSRequestWithoutCertValidation/options
@@ -0,0 +1 @@
+semmle-extractor-options: -p ../../lib --max-import-depth=3
diff --git a/python/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.expected b/python/ql/test/query-tests/Security/BadPractice/HardcodedCredentials/HardcodedCredentials.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.expected
rename to python/ql/test/query-tests/Security/BadPractice/HardcodedCredentials/HardcodedCredentials.expected
diff --git a/python/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.qlref b/python/ql/test/query-tests/Security/BadPractice/HardcodedCredentials/HardcodedCredentials.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.qlref
rename to python/ql/test/query-tests/Security/BadPractice/HardcodedCredentials/HardcodedCredentials.qlref
diff --git a/python/ql/test/query-tests/Security/CWE-798/test.py b/python/ql/test/query-tests/Security/BadPractice/HardcodedCredentials/test.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-798/test.py
rename to python/ql/test/query-tests/Security/BadPractice/HardcodedCredentials/test.py
diff --git a/python/ql/test/query-tests/Security/CWE-020/IncompleteHostnameRegExp.expected b/python/ql/test/query-tests/Security/BadPractice/IncompleteUrlSanitizer/IncompleteHostnameRegExp.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-020/IncompleteHostnameRegExp.expected
rename to python/ql/test/query-tests/Security/BadPractice/IncompleteUrlSanitizer/IncompleteHostnameRegExp.expected
diff --git a/python/ql/test/query-tests/Security/CWE-020/IncompleteHostnameRegExp.qlref b/python/ql/test/query-tests/Security/BadPractice/IncompleteUrlSanitizer/IncompleteHostnameRegExp.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-020/IncompleteHostnameRegExp.qlref
rename to python/ql/test/query-tests/Security/BadPractice/IncompleteUrlSanitizer/IncompleteHostnameRegExp.qlref
diff --git a/python/ql/test/query-tests/Security/CWE-020/IncompleteUrlSubstringSanitization.expected b/python/ql/test/query-tests/Security/BadPractice/IncompleteUrlSanitizer/IncompleteUrlSubstringSanitization.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-020/IncompleteUrlSubstringSanitization.expected
rename to python/ql/test/query-tests/Security/BadPractice/IncompleteUrlSanitizer/IncompleteUrlSubstringSanitization.expected
diff --git a/python/ql/test/query-tests/Security/CWE-020/IncompleteUrlSubstringSanitization.qlref b/python/ql/test/query-tests/Security/BadPractice/IncompleteUrlSanitizer/IncompleteUrlSubstringSanitization.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-020/IncompleteUrlSubstringSanitization.qlref
rename to python/ql/test/query-tests/Security/BadPractice/IncompleteUrlSanitizer/IncompleteUrlSubstringSanitization.qlref
diff --git a/python/ql/test/query-tests/Security/CWE-020/hosttest.py b/python/ql/test/query-tests/Security/BadPractice/IncompleteUrlSanitizer/hosttest.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-020/hosttest.py
rename to python/ql/test/query-tests/Security/BadPractice/IncompleteUrlSanitizer/hosttest.py
diff --git a/python/ql/test/query-tests/Security/CWE-020/urltest.py b/python/ql/test/query-tests/Security/BadPractice/IncompleteUrlSanitizer/urltest.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-020/urltest.py
rename to python/ql/test/query-tests/Security/BadPractice/IncompleteUrlSanitizer/urltest.py
diff --git a/python/ql/test/query-tests/Security/CWE-377/InsecureTemporaryFile.expected b/python/ql/test/query-tests/Security/BadPractice/InsecureTemporaryFile/InsecureTemporaryFile.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-377/InsecureTemporaryFile.expected
rename to python/ql/test/query-tests/Security/BadPractice/InsecureTemporaryFile/InsecureTemporaryFile.expected
diff --git a/python/ql/test/query-tests/Security/CWE-377/InsecureTemporaryFile.py b/python/ql/test/query-tests/Security/BadPractice/InsecureTemporaryFile/InsecureTemporaryFile.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-377/InsecureTemporaryFile.py
rename to python/ql/test/query-tests/Security/BadPractice/InsecureTemporaryFile/InsecureTemporaryFile.py
diff --git a/python/ql/test/query-tests/Security/CWE-377/InsecureTemporaryFile.qlref b/python/ql/test/query-tests/Security/BadPractice/InsecureTemporaryFile/InsecureTemporaryFile.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-377/InsecureTemporaryFile.qlref
rename to python/ql/test/query-tests/Security/BadPractice/InsecureTemporaryFile/InsecureTemporaryFile.qlref
diff --git a/python/ql/test/query-tests/Security/CWE-377/SecureTemporaryFile.py b/python/ql/test/query-tests/Security/BadPractice/InsecureTemporaryFile/SecureTemporaryFile.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-377/SecureTemporaryFile.py
rename to python/ql/test/query-tests/Security/BadPractice/InsecureTemporaryFile/SecureTemporaryFile.py
diff --git a/python/ql/test/query-tests/Security/BadPractice/InsecureTemporaryFile/options b/python/ql/test/query-tests/Security/BadPractice/InsecureTemporaryFile/options
new file mode 100644
index 00000000000..b7721e6c509
--- /dev/null
+++ b/python/ql/test/query-tests/Security/BadPractice/InsecureTemporaryFile/options
@@ -0,0 +1 @@
+semmle-extractor-options: -p ../../lib --max-import-depth=3
diff --git a/python/ql/test/query-tests/Security/CWE-079/Jinja2WithoutEscaping.expected b/python/ql/test/query-tests/Security/BadPractice/Jinja2RenderWithoutEscape/Jinja2WithoutEscaping.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-079/Jinja2WithoutEscaping.expected
rename to python/ql/test/query-tests/Security/BadPractice/Jinja2RenderWithoutEscape/Jinja2WithoutEscaping.expected
diff --git a/python/ql/test/query-tests/Security/CWE-079/Jinja2WithoutEscaping.qlref b/python/ql/test/query-tests/Security/BadPractice/Jinja2RenderWithoutEscape/Jinja2WithoutEscaping.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-079/Jinja2WithoutEscaping.qlref
rename to python/ql/test/query-tests/Security/BadPractice/Jinja2RenderWithoutEscape/Jinja2WithoutEscaping.qlref
diff --git a/python/ql/test/query-tests/Security/CWE-079/jinja2_escaping.py b/python/ql/test/query-tests/Security/BadPractice/Jinja2RenderWithoutEscape/jinja2_escaping.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-079/jinja2_escaping.py
rename to python/ql/test/query-tests/Security/BadPractice/Jinja2RenderWithoutEscape/jinja2_escaping.py
diff --git a/python/ql/test/query-tests/Security/CWE-022-TarSlip/options b/python/ql/test/query-tests/Security/BadPractice/Jinja2RenderWithoutEscape/options
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-022-TarSlip/options
rename to python/ql/test/query-tests/Security/BadPractice/Jinja2RenderWithoutEscape/options
diff --git a/python/ql/test/query-tests/Security/CWE-295/MissingHostKeyValidation.expected b/python/ql/test/query-tests/Security/BadPractice/SSHMissingHostKeyValidation/MissingHostKeyValidation.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-295/MissingHostKeyValidation.expected
rename to python/ql/test/query-tests/Security/BadPractice/SSHMissingHostKeyValidation/MissingHostKeyValidation.expected
diff --git a/python/ql/test/query-tests/Security/CWE-295/MissingHostKeyValidation.qlref b/python/ql/test/query-tests/Security/BadPractice/SSHMissingHostKeyValidation/MissingHostKeyValidation.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-295/MissingHostKeyValidation.qlref
rename to python/ql/test/query-tests/Security/BadPractice/SSHMissingHostKeyValidation/MissingHostKeyValidation.qlref
diff --git a/python/ql/test/query-tests/Security/BadPractice/SSHMissingHostKeyValidation/options b/python/ql/test/query-tests/Security/BadPractice/SSHMissingHostKeyValidation/options
new file mode 100644
index 00000000000..b7721e6c509
--- /dev/null
+++ b/python/ql/test/query-tests/Security/BadPractice/SSHMissingHostKeyValidation/options
@@ -0,0 +1 @@
+semmle-extractor-options: -p ../../lib --max-import-depth=3
diff --git a/python/ql/test/query-tests/Security/CWE-295/paramiko_host_key.py b/python/ql/test/query-tests/Security/BadPractice/SSHMissingHostKeyValidation/paramiko_host_key.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-295/paramiko_host_key.py
rename to python/ql/test/query-tests/Security/BadPractice/SSHMissingHostKeyValidation/paramiko_host_key.py
diff --git a/python/ql/test/query-tests/Security/CWE-732/WeakFilePermissions.expected b/python/ql/test/query-tests/Security/BadPractice/WeakFilePermissions/WeakFilePermissions.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-732/WeakFilePermissions.expected
rename to python/ql/test/query-tests/Security/BadPractice/WeakFilePermissions/WeakFilePermissions.expected
diff --git a/python/ql/test/query-tests/Security/CWE-732/WeakFilePermissions.qlref b/python/ql/test/query-tests/Security/BadPractice/WeakFilePermissions/WeakFilePermissions.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-732/WeakFilePermissions.qlref
rename to python/ql/test/query-tests/Security/BadPractice/WeakFilePermissions/WeakFilePermissions.qlref
diff --git a/python/ql/test/query-tests/Security/BadPractice/WeakFilePermissions/options b/python/ql/test/query-tests/Security/BadPractice/WeakFilePermissions/options
new file mode 100644
index 00000000000..e552c11e561
--- /dev/null
+++ b/python/ql/test/query-tests/Security/BadPractice/WeakFilePermissions/options
@@ -0,0 +1 @@
+semmle-extractor-options: --max-import-depth=2 -p ../../lib
diff --git a/python/ql/test/query-tests/Security/CWE-732/test.py b/python/ql/test/query-tests/Security/BadPractice/WeakFilePermissions/test.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-732/test.py
rename to python/ql/test/query-tests/Security/BadPractice/WeakFilePermissions/test.py
diff --git a/python/ql/test/query-tests/Security/CWE-079/options b/python/ql/test/query-tests/Security/CWE-079/options
deleted file mode 100644
index 492768b3481..00000000000
--- a/python/ql/test/query-tests/Security/CWE-079/options
+++ /dev/null
@@ -1 +0,0 @@
-semmle-extractor-options: -p ../lib/ --max-import-depth=3
diff --git a/python/ql/test/query-tests/Security/CWE-209/options b/python/ql/test/query-tests/Security/CWE-209/options
deleted file mode 100644
index 2729d5a143a..00000000000
--- a/python/ql/test/query-tests/Security/CWE-209/options
+++ /dev/null
@@ -1 +0,0 @@
-semmle-extractor-options: -p ../lib/ --max-import-depth=2
diff --git a/python/ql/test/query-tests/Security/CWE-215/options b/python/ql/test/query-tests/Security/CWE-215/options
deleted file mode 100644
index 84717fe64cf..00000000000
--- a/python/ql/test/query-tests/Security/CWE-215/options
+++ /dev/null
@@ -1 +0,0 @@
-semmle-extractor-options: --max-import-depth=2 -p ../lib
diff --git a/python/ql/test/query-tests/Security/CWE-295/options b/python/ql/test/query-tests/Security/CWE-295/options
deleted file mode 100644
index 492768b3481..00000000000
--- a/python/ql/test/query-tests/Security/CWE-295/options
+++ /dev/null
@@ -1 +0,0 @@
-semmle-extractor-options: -p ../lib/ --max-import-depth=3
diff --git a/python/ql/test/query-tests/Security/CWE-312/options b/python/ql/test/query-tests/Security/CWE-312/options
deleted file mode 100644
index 492768b3481..00000000000
--- a/python/ql/test/query-tests/Security/CWE-312/options
+++ /dev/null
@@ -1 +0,0 @@
-semmle-extractor-options: -p ../lib/ --max-import-depth=3
diff --git a/python/ql/test/query-tests/Security/CWE-326/options b/python/ql/test/query-tests/Security/CWE-326/options
deleted file mode 100644
index 492768b3481..00000000000
--- a/python/ql/test/query-tests/Security/CWE-326/options
+++ /dev/null
@@ -1 +0,0 @@
-semmle-extractor-options: -p ../lib/ --max-import-depth=3
diff --git a/python/ql/test/query-tests/Security/CWE-327/options b/python/ql/test/query-tests/Security/CWE-327/options
deleted file mode 100644
index 492768b3481..00000000000
--- a/python/ql/test/query-tests/Security/CWE-327/options
+++ /dev/null
@@ -1 +0,0 @@
-semmle-extractor-options: -p ../lib/ --max-import-depth=3
diff --git a/python/ql/test/query-tests/Security/CWE-377/options b/python/ql/test/query-tests/Security/CWE-377/options
deleted file mode 100644
index 492768b3481..00000000000
--- a/python/ql/test/query-tests/Security/CWE-377/options
+++ /dev/null
@@ -1 +0,0 @@
-semmle-extractor-options: -p ../lib/ --max-import-depth=3
diff --git a/python/ql/test/query-tests/Security/CWE-601/options b/python/ql/test/query-tests/Security/CWE-601/options
deleted file mode 100644
index 28b616e5f19..00000000000
--- a/python/ql/test/query-tests/Security/CWE-601/options
+++ /dev/null
@@ -1 +0,0 @@
-semmle-extractor-options: --lang=3 --max-import-depth=2 -p ../lib
diff --git a/python/ql/test/query-tests/Security/CWE-732/options b/python/ql/test/query-tests/Security/CWE-732/options
deleted file mode 100644
index 84717fe64cf..00000000000
--- a/python/ql/test/query-tests/Security/CWE-732/options
+++ /dev/null
@@ -1 +0,0 @@
-semmle-extractor-options: --max-import-depth=2 -p ../lib
diff --git a/python/ql/test/query-tests/Security/CWE-327/InsecureDefaultProtocol.expected b/python/ql/test/query-tests/Security/Crypto/TLS/InsecureDefaultProtocol.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-327/InsecureDefaultProtocol.expected
rename to python/ql/test/query-tests/Security/Crypto/TLS/InsecureDefaultProtocol.expected
diff --git a/python/ql/test/query-tests/Security/CWE-327/InsecureDefaultProtocol.qlref b/python/ql/test/query-tests/Security/Crypto/TLS/InsecureDefaultProtocol.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-327/InsecureDefaultProtocol.qlref
rename to python/ql/test/query-tests/Security/Crypto/TLS/InsecureDefaultProtocol.qlref
diff --git a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected b/python/ql/test/query-tests/Security/Crypto/TLS/InsecureProtocol.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
rename to python/ql/test/query-tests/Security/Crypto/TLS/InsecureProtocol.expected
diff --git a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.py b/python/ql/test/query-tests/Security/Crypto/TLS/InsecureProtocol.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.py
rename to python/ql/test/query-tests/Security/Crypto/TLS/InsecureProtocol.py
diff --git a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.qlref b/python/ql/test/query-tests/Security/Crypto/TLS/InsecureProtocol.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.qlref
rename to python/ql/test/query-tests/Security/Crypto/TLS/InsecureProtocol.qlref
diff --git a/python/ql/test/query-tests/Security/Crypto/TLS/options b/python/ql/test/query-tests/Security/Crypto/TLS/options
new file mode 100644
index 00000000000..b7721e6c509
--- /dev/null
+++ b/python/ql/test/query-tests/Security/Crypto/TLS/options
@@ -0,0 +1 @@
+semmle-extractor-options: -p ../../lib --max-import-depth=3
diff --git a/python/ql/test/query-tests/Security/CWE-327/BrokenCryptoAlgorithm.expected b/python/ql/test/query-tests/Security/Crypto/WeakCryptoAlgorithm/BrokenCryptoAlgorithm.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-327/BrokenCryptoAlgorithm.expected
rename to python/ql/test/query-tests/Security/Crypto/WeakCryptoAlgorithm/BrokenCryptoAlgorithm.expected
diff --git a/python/ql/test/query-tests/Security/CWE-327/BrokenCryptoAlgorithm.qlref b/python/ql/test/query-tests/Security/Crypto/WeakCryptoAlgorithm/BrokenCryptoAlgorithm.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-327/BrokenCryptoAlgorithm.qlref
rename to python/ql/test/query-tests/Security/Crypto/WeakCryptoAlgorithm/BrokenCryptoAlgorithm.qlref
diff --git a/python/ql/test/query-tests/Security/CWE-327/TestNode.expected b/python/ql/test/query-tests/Security/Crypto/WeakCryptoAlgorithm/TestNode.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-327/TestNode.expected
rename to python/ql/test/query-tests/Security/Crypto/WeakCryptoAlgorithm/TestNode.expected
diff --git a/python/ql/test/query-tests/Security/CWE-327/TestNode.ql b/python/ql/test/query-tests/Security/Crypto/WeakCryptoAlgorithm/TestNode.ql
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-327/TestNode.ql
rename to python/ql/test/query-tests/Security/Crypto/WeakCryptoAlgorithm/TestNode.ql
diff --git a/python/ql/test/query-tests/Security/Crypto/WeakCryptoAlgorithm/options b/python/ql/test/query-tests/Security/Crypto/WeakCryptoAlgorithm/options
new file mode 100644
index 00000000000..b7721e6c509
--- /dev/null
+++ b/python/ql/test/query-tests/Security/Crypto/WeakCryptoAlgorithm/options
@@ -0,0 +1 @@
+semmle-extractor-options: -p ../../lib --max-import-depth=3
diff --git a/python/ql/test/query-tests/Security/CWE-327/test_cryptography.py b/python/ql/test/query-tests/Security/Crypto/WeakCryptoAlgorithm/test_cryptography.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-327/test_cryptography.py
rename to python/ql/test/query-tests/Security/Crypto/WeakCryptoAlgorithm/test_cryptography.py
diff --git a/python/ql/test/query-tests/Security/CWE-327/test_pycrypto.py b/python/ql/test/query-tests/Security/Crypto/WeakCryptoAlgorithm/test_pycrypto.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-327/test_pycrypto.py
rename to python/ql/test/query-tests/Security/Crypto/WeakCryptoAlgorithm/test_pycrypto.py
diff --git a/python/ql/test/query-tests/Security/CWE-326/WeakCrypto.expected b/python/ql/test/query-tests/Security/Crypto/WeakCryptoKey/WeakCrypto.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-326/WeakCrypto.expected
rename to python/ql/test/query-tests/Security/Crypto/WeakCryptoKey/WeakCrypto.expected
diff --git a/python/ql/test/query-tests/Security/CWE-326/WeakCrypto.qlref b/python/ql/test/query-tests/Security/Crypto/WeakCryptoKey/WeakCrypto.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-326/WeakCrypto.qlref
rename to python/ql/test/query-tests/Security/Crypto/WeakCryptoKey/WeakCrypto.qlref
diff --git a/python/ql/test/query-tests/Security/Crypto/WeakCryptoKey/options b/python/ql/test/query-tests/Security/Crypto/WeakCryptoKey/options
new file mode 100644
index 00000000000..b7721e6c509
--- /dev/null
+++ b/python/ql/test/query-tests/Security/Crypto/WeakCryptoKey/options
@@ -0,0 +1 @@
+semmle-extractor-options: -p ../../lib --max-import-depth=3
diff --git a/python/ql/test/query-tests/Security/CWE-326/weak_crypto.py b/python/ql/test/query-tests/Security/Crypto/WeakCryptoKey/weak_crypto.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-326/weak_crypto.py
rename to python/ql/test/query-tests/Security/Crypto/WeakCryptoKey/weak_crypto.py
diff --git a/python/ql/test/query-tests/Security/CWE-312/CleartextLogging.expected b/python/ql/test/query-tests/Security/Exposure/SensitiveDataExposure/CleartextLogging.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-312/CleartextLogging.expected
rename to python/ql/test/query-tests/Security/Exposure/SensitiveDataExposure/CleartextLogging.expected
diff --git a/python/ql/test/query-tests/Security/CWE-312/CleartextLogging.qlref b/python/ql/test/query-tests/Security/Exposure/SensitiveDataExposure/CleartextLogging.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-312/CleartextLogging.qlref
rename to python/ql/test/query-tests/Security/Exposure/SensitiveDataExposure/CleartextLogging.qlref
diff --git a/python/ql/test/query-tests/Security/CWE-312/CleartextStorage.expected b/python/ql/test/query-tests/Security/Exposure/SensitiveDataExposure/CleartextStorage.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-312/CleartextStorage.expected
rename to python/ql/test/query-tests/Security/Exposure/SensitiveDataExposure/CleartextStorage.expected
diff --git a/python/ql/test/query-tests/Security/CWE-312/CleartextStorage.qlref b/python/ql/test/query-tests/Security/Exposure/SensitiveDataExposure/CleartextStorage.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-312/CleartextStorage.qlref
rename to python/ql/test/query-tests/Security/Exposure/SensitiveDataExposure/CleartextStorage.qlref
diff --git a/python/ql/test/query-tests/Security/Exposure/SensitiveDataExposure/options b/python/ql/test/query-tests/Security/Exposure/SensitiveDataExposure/options
new file mode 100644
index 00000000000..b7721e6c509
--- /dev/null
+++ b/python/ql/test/query-tests/Security/Exposure/SensitiveDataExposure/options
@@ -0,0 +1 @@
+semmle-extractor-options: -p ../../lib --max-import-depth=3
diff --git a/python/ql/test/query-tests/Security/CWE-312/password_in_cookie.py b/python/ql/test/query-tests/Security/Exposure/SensitiveDataExposure/password_in_cookie.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-312/password_in_cookie.py
rename to python/ql/test/query-tests/Security/Exposure/SensitiveDataExposure/password_in_cookie.py
diff --git a/python/ql/test/query-tests/Security/CWE-312/test.py b/python/ql/test/query-tests/Security/Exposure/SensitiveDataExposure/test.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-312/test.py
rename to python/ql/test/query-tests/Security/Exposure/SensitiveDataExposure/test.py
diff --git a/python/ql/test/query-tests/Security/CWE-209/StackTraceExposure.expected b/python/ql/test/query-tests/Security/Exposure/StackTraceExposure/StackTraceExposure.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-209/StackTraceExposure.expected
rename to python/ql/test/query-tests/Security/Exposure/StackTraceExposure/StackTraceExposure.expected
diff --git a/python/ql/test/query-tests/Security/CWE-209/StackTraceExposure.qlref b/python/ql/test/query-tests/Security/Exposure/StackTraceExposure/StackTraceExposure.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-209/StackTraceExposure.qlref
rename to python/ql/test/query-tests/Security/Exposure/StackTraceExposure/StackTraceExposure.qlref
diff --git a/python/ql/test/query-tests/Security/Exposure/StackTraceExposure/options b/python/ql/test/query-tests/Security/Exposure/StackTraceExposure/options
new file mode 100644
index 00000000000..59cbd921362
--- /dev/null
+++ b/python/ql/test/query-tests/Security/Exposure/StackTraceExposure/options
@@ -0,0 +1 @@
+semmle-extractor-options: -p ../../lib --max-import-depth=2
diff --git a/python/ql/test/query-tests/Security/CWE-209/test.py b/python/ql/test/query-tests/Security/Exposure/StackTraceExposure/test.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-209/test.py
rename to python/ql/test/query-tests/Security/Exposure/StackTraceExposure/test.py
diff --git a/python/ql/test/query-tests/Security/CWE-094/CodeInjection.expected b/python/ql/test/query-tests/Security/Injection/CodeInjection/CodeInjection.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-094/CodeInjection.expected
rename to python/ql/test/query-tests/Security/Injection/CodeInjection/CodeInjection.expected
diff --git a/python/ql/test/query-tests/Security/CWE-094/CodeInjection.qlref b/python/ql/test/query-tests/Security/Injection/CodeInjection/CodeInjection.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-094/CodeInjection.qlref
rename to python/ql/test/query-tests/Security/Injection/CodeInjection/CodeInjection.qlref
diff --git a/python/ql/test/query-tests/Security/CWE-094/code_injection.py b/python/ql/test/query-tests/Security/Injection/CodeInjection/code_injection.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-094/code_injection.py
rename to python/ql/test/query-tests/Security/Injection/CodeInjection/code_injection.py
diff --git a/python/ql/test/query-tests/Security/CWE-078-py2/CommandInjection.expected b/python/ql/test/query-tests/Security/Injection/CommandInjection-py2/CommandInjection.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-078-py2/CommandInjection.expected
rename to python/ql/test/query-tests/Security/Injection/CommandInjection-py2/CommandInjection.expected
diff --git a/python/ql/test/query-tests/Security/CWE-078-py2/CommandInjection.qlref b/python/ql/test/query-tests/Security/Injection/CommandInjection-py2/CommandInjection.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-078-py2/CommandInjection.qlref
rename to python/ql/test/query-tests/Security/Injection/CommandInjection-py2/CommandInjection.qlref
diff --git a/python/ql/test/query-tests/Security/CWE-078-py2/command_injection.py b/python/ql/test/query-tests/Security/Injection/CommandInjection-py2/command_injection.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-078-py2/command_injection.py
rename to python/ql/test/query-tests/Security/Injection/CommandInjection-py2/command_injection.py
diff --git a/python/ql/test/query-tests/Security/CWE-078-py2/options b/python/ql/test/query-tests/Security/Injection/CommandInjection-py2/options
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-078-py2/options
rename to python/ql/test/query-tests/Security/Injection/CommandInjection-py2/options
diff --git a/python/ql/test/query-tests/Security/CWE-078/CommandInjection.expected b/python/ql/test/query-tests/Security/Injection/CommandInjection/CommandInjection.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-078/CommandInjection.expected
rename to python/ql/test/query-tests/Security/Injection/CommandInjection/CommandInjection.expected
diff --git a/python/ql/test/query-tests/Security/CWE-078/CommandInjection.qlref b/python/ql/test/query-tests/Security/Injection/CommandInjection/CommandInjection.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-078/CommandInjection.qlref
rename to python/ql/test/query-tests/Security/Injection/CommandInjection/CommandInjection.qlref
diff --git a/python/ql/test/query-tests/Security/CWE-078/command_injection.py b/python/ql/test/query-tests/Security/Injection/CommandInjection/command_injection.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-078/command_injection.py
rename to python/ql/test/query-tests/Security/Injection/CommandInjection/command_injection.py
diff --git a/python/ql/test/query-tests/Security/CWE-078/options b/python/ql/test/query-tests/Security/Injection/CommandInjection/options
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-078/options
rename to python/ql/test/query-tests/Security/Injection/CommandInjection/options
diff --git a/python/ql/test/query-tests/Security/CWE-601/UrlRedirect.expected b/python/ql/test/query-tests/Security/Injection/OpenRedirect/UrlRedirect.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-601/UrlRedirect.expected
rename to python/ql/test/query-tests/Security/Injection/OpenRedirect/UrlRedirect.expected
diff --git a/python/ql/test/query-tests/Security/CWE-601/UrlRedirect.qlref b/python/ql/test/query-tests/Security/Injection/OpenRedirect/UrlRedirect.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-601/UrlRedirect.qlref
rename to python/ql/test/query-tests/Security/Injection/OpenRedirect/UrlRedirect.qlref
diff --git a/python/ql/test/query-tests/Security/Injection/OpenRedirect/options b/python/ql/test/query-tests/Security/Injection/OpenRedirect/options
new file mode 100644
index 00000000000..2c9a5f0a13c
--- /dev/null
+++ b/python/ql/test/query-tests/Security/Injection/OpenRedirect/options
@@ -0,0 +1 @@
+semmle-extractor-options: --lang=3 --max-import-depth=2 -p ../../lib
diff --git a/python/ql/test/query-tests/Security/CWE-601/test.py b/python/ql/test/query-tests/Security/Injection/OpenRedirect/test.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-601/test.py
rename to python/ql/test/query-tests/Security/Injection/OpenRedirect/test.py
diff --git a/python/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected b/python/ql/test/query-tests/Security/Injection/ReflectedXss/ReflectedXss.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected
rename to python/ql/test/query-tests/Security/Injection/ReflectedXss/ReflectedXss.expected
diff --git a/python/ql/test/query-tests/Security/CWE-079/ReflectedXss.qlref b/python/ql/test/query-tests/Security/Injection/ReflectedXss/ReflectedXss.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-079/ReflectedXss.qlref
rename to python/ql/test/query-tests/Security/Injection/ReflectedXss/ReflectedXss.qlref
diff --git a/python/ql/test/query-tests/Security/CWE-079/reflected_xss.py b/python/ql/test/query-tests/Security/Injection/ReflectedXss/reflected_xss.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-079/reflected_xss.py
rename to python/ql/test/query-tests/Security/Injection/ReflectedXss/reflected_xss.py
diff --git a/python/ql/test/query-tests/Security/CWE-089/SqlInjection.expected b/python/ql/test/query-tests/Security/Injection/SqlInjection/SqlInjection.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-089/SqlInjection.expected
rename to python/ql/test/query-tests/Security/Injection/SqlInjection/SqlInjection.expected
diff --git a/python/ql/test/query-tests/Security/CWE-089/SqlInjection.qlref b/python/ql/test/query-tests/Security/Injection/SqlInjection/SqlInjection.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-089/SqlInjection.qlref
rename to python/ql/test/query-tests/Security/Injection/SqlInjection/SqlInjection.qlref
diff --git a/python/ql/test/query-tests/Security/CWE-089/sql_injection.py b/python/ql/test/query-tests/Security/Injection/SqlInjection/sql_injection.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-089/sql_injection.py
rename to python/ql/test/query-tests/Security/Injection/SqlInjection/sql_injection.py
diff --git a/python/ql/test/query-tests/Security/CWE-022-PathInjection/PathInjection.expected b/python/ql/test/query-tests/Security/Injection/TarSlip/PathInjection/PathInjection.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-022-PathInjection/PathInjection.expected
rename to python/ql/test/query-tests/Security/Injection/TarSlip/PathInjection/PathInjection.expected
diff --git a/python/ql/test/query-tests/Security/CWE-022-PathInjection/PathInjection.qlref b/python/ql/test/query-tests/Security/Injection/TarSlip/PathInjection/PathInjection.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-022-PathInjection/PathInjection.qlref
rename to python/ql/test/query-tests/Security/Injection/TarSlip/PathInjection/PathInjection.qlref
diff --git a/python/ql/test/query-tests/Security/CWE-022-PathInjection/path_injection.py b/python/ql/test/query-tests/Security/Injection/TarSlip/PathInjection/path_injection.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-022-PathInjection/path_injection.py
rename to python/ql/test/query-tests/Security/Injection/TarSlip/PathInjection/path_injection.py
diff --git a/python/ql/test/query-tests/Security/CWE-022-PathInjection/test.py b/python/ql/test/query-tests/Security/Injection/TarSlip/PathInjection/test.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-022-PathInjection/test.py
rename to python/ql/test/query-tests/Security/Injection/TarSlip/PathInjection/test.py
diff --git a/python/ql/test/query-tests/Security/CWE-022-PathInjection/test_chaining.py b/python/ql/test/query-tests/Security/Injection/TarSlip/PathInjection/test_chaining.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-022-PathInjection/test_chaining.py
rename to python/ql/test/query-tests/Security/Injection/TarSlip/PathInjection/test_chaining.py
diff --git a/python/ql/test/query-tests/Security/CWE-022-TarSlip/TarSlip.expected b/python/ql/test/query-tests/Security/Injection/TarSlip/TarSlip.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-022-TarSlip/TarSlip.expected
rename to python/ql/test/query-tests/Security/Injection/TarSlip/TarSlip.expected
diff --git a/python/ql/test/query-tests/Security/CWE-022-TarSlip/TarSlip.qlref b/python/ql/test/query-tests/Security/Injection/TarSlip/TarSlip.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-022-TarSlip/TarSlip.qlref
rename to python/ql/test/query-tests/Security/Injection/TarSlip/TarSlip.qlref
diff --git a/python/ql/test/query-tests/Security/Injection/TarSlip/options b/python/ql/test/query-tests/Security/Injection/TarSlip/options
new file mode 100644
index 00000000000..b7721e6c509
--- /dev/null
+++ b/python/ql/test/query-tests/Security/Injection/TarSlip/options
@@ -0,0 +1 @@
+semmle-extractor-options: -p ../../lib --max-import-depth=3
diff --git a/python/ql/test/query-tests/Security/CWE-022-TarSlip/tarslip.py b/python/ql/test/query-tests/Security/Injection/TarSlip/tarslip.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-022-TarSlip/tarslip.py
rename to python/ql/test/query-tests/Security/Injection/TarSlip/tarslip.py
diff --git a/python/ql/test/query-tests/Security/CWE-502/UnsafeDeserialization.expected b/python/ql/test/query-tests/Security/Injection/UnsafeDeserialization/UnsafeDeserialization.expected
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-502/UnsafeDeserialization.expected
rename to python/ql/test/query-tests/Security/Injection/UnsafeDeserialization/UnsafeDeserialization.expected
diff --git a/python/ql/test/query-tests/Security/CWE-502/UnsafeDeserialization.qlref b/python/ql/test/query-tests/Security/Injection/UnsafeDeserialization/UnsafeDeserialization.qlref
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-502/UnsafeDeserialization.qlref
rename to python/ql/test/query-tests/Security/Injection/UnsafeDeserialization/UnsafeDeserialization.qlref
diff --git a/python/ql/test/query-tests/Security/CWE-502/unsafe_deserialization.py b/python/ql/test/query-tests/Security/Injection/UnsafeDeserialization/unsafe_deserialization.py
similarity index 100%
rename from python/ql/test/query-tests/Security/CWE-502/unsafe_deserialization.py
rename to python/ql/test/query-tests/Security/Injection/UnsafeDeserialization/unsafe_deserialization.py