diff --git a/csharp/ql/campaigns/Solorigate/test/Solorigate/test.cs b/csharp/ql/campaigns/Solorigate/test/Solorigate/test.cs
index 2530492ef74..1e6c66fd0db 100644
--- a/csharp/ql/campaigns/Solorigate/test/Solorigate/test.cs
+++ b/csharp/ql/campaigns/Solorigate/test/Solorigate/test.cs
@@ -6,12 +6,12 @@ class FalsePositiveCases
 	// regular FVN
 	ulong GetRegularFvnHash(string s)
 	{
-		ulong num = 14695981039346656037UL; /* FNV base offset */ // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
+		ulong num = 14695981039346656037UL; /* FNV base offset */ // $ SPURIOUS: Alert[cs/solorigate/number-of-known-hashes-above-threshold]
 
 		foreach (byte b in Encoding.UTF8.GetBytes(s))
 		{
 			num ^= (ulong)b;
-			num *= 1099511628211UL; /* FNV prime */ // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
+			num *= 1099511628211UL; /* FNV prime */ // $ SPURIOUS: Alert[cs/solorigate/number-of-known-hashes-above-threshold]
 		}
 
 		return num;
diff --git a/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegation-test.cs b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegation-test.cs
index 95118a986d3..5e0e69119d4 100644
--- a/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegation-test.cs	
+++ b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegation-test.cs	
@@ -98,8 +98,8 @@ namespace JsonWebTokenHandlerTest
                 SaveSigninToken = true
             };
 
-            tokenValidationParamsBaseline.LifetimeValidator = (notBefore, expires, securityToken, validationParameters) => ValidateLifetimeAlwaysTrue(securityToken, validationParameters); // $ Alert[cs/json-webtoken-handler/delegated-security-validations-always-return-true] // BUG delegated-security-validations-always-return-true
-            tokenValidationParamsBaseline.AudienceValidator = (IEnumerable<string> audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => true; // $ Alert[cs/json-webtoken-handler/delegated-security-validations-always-return-true] // BUG delegated-security-validations-always-return-true
+            tokenValidationParamsBaseline.LifetimeValidator = (notBefore, expires, securityToken, validationParameters) => ValidateLifetimeAlwaysTrue(securityToken, validationParameters); // $ Alert[cs/json-webtoken-handler/delegated-security-validations-always-return-true]
+            tokenValidationParamsBaseline.AudienceValidator = (IEnumerable<string> audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => true; // $ Alert[cs/json-webtoken-handler/delegated-security-validations-always-return-true]
             tokenValidationParamsBaseline.TokenReplayValidator = (DateTime? expirationTime, string securityToken, TokenValidationParameters validationParameters) =>    // GOOD
                 {
                     if (securityToken is null)
diff --git a/csharp/ql/test/query-tests/Language Abuse/UselessCastToSelf/UselessCastToSelf.cs b/csharp/ql/test/query-tests/Language Abuse/UselessCastToSelf/UselessCastToSelf.cs
index 3b3f06ded0f..bcfe712413e 100644
--- a/csharp/ql/test/query-tests/Language Abuse/UselessCastToSelf/UselessCastToSelf.cs	
+++ b/csharp/ql/test/query-tests/Language Abuse/UselessCastToSelf/UselessCastToSelf.cs	
@@ -9,7 +9,7 @@ class Test
         var bad1 = (int)1; // $ Alert
         var bad2 = (Test)this; // $ Alert
         var bad3 = this as Test; // $ Alert
-        func = (Func<int, int?>)(x => x); // MISSING
+        func = (Func<int, int?>)(x => x); // $ MISSING: Alert
         exprFunc = (Expression<Func<int, int?>>)(x => x); // $ Alert
 
         // GOOD
@@ -22,7 +22,7 @@ class Test
         var good7 = (Action<int>)((int x) => { });
         func = x => x;
         exprFunc = x => x;
-        exprFuncUntyped = (Expression<Func<int, int?>>)(x => x); // $ Alert // FP
+        exprFuncUntyped = (Expression<Func<int, int?>>)(x => x); // $ SPURIOUS: Alert
     }
 
     enum Enum
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-807/ConditionalBypass.cs b/csharp/ql/test/query-tests/Security Features/CWE-807/ConditionalBypass.cs
index 39328ca7c17..b3e9c842ac6 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-807/ConditionalBypass.cs	
+++ b/csharp/ql/test/query-tests/Security Features/CWE-807/ConditionalBypass.cs	
@@ -24,7 +24,7 @@ public class ConditionalBypassHandler : IHttpHandler
 
         // FALSE POSITIVES: both methods are conditionally executed, but they probably
         // both perform the security-critical action
-        if (adminCookie.Value == "false") // $ Alert=r3 Alert=r4 Alert=r2
+        if (adminCookie.Value == "false") // $ SPURIOUS: Alert=r3 Alert=r4 Alert=r2
         {
             login(user, password);
         }