# The findings of the static-analysis job that were already there when this file was written, one per
# line: fingerprint, tool, rule, file:line (where it was then; the fingerprint does not
# use the number), message, and - where its triage said - why it is known rather than
# fixed. The job fails on a finding whose fingerprint is not here, unless master's
# .gitlab/security-exceptions.yml accepts it.
# The list only shrinks: build/ci/security-findings.py --write-baseline keeps the findings
# still found, drops the ones gone and adds none. By hand, delete the line of a finding
# that has been fixed, or end a line that has no reason with a tab and the reason its
# triage gave; nothing else. docs/ContinuousIntegration.md, "Security scanning", says how.
#
# 687 findings, 214 of them with a reason.
de067b660072084e4de7	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/AntiSpam/AntiSpamDiagnostics.h:56	performing an implicit widening conversion to type 'const ULONGLONG' (aka 'const unsigned long') of a multiplication performed in type 'int'
691624b920e4eb995d68	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/AntiSpam/DKIM/Arc.cpp:279	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
85f8d8f13812b0b7e1aa	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/AntiSpam/DKIM/Arc.cpp:477	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
53b731361e040d3a4e5a	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/AntiSpam/DKIM/Arc.cpp:583	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
a99f27a0addc957661d7	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/AntiSpam/DKIM/DKIM.cpp:901	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
441dd559593dc6f2db7d	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/Common/AntiSpam/DKIM/DKIMParameters.cpp:37	repeated branch body in conditional chain
66ac3dd50f67953fa828	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/AntiSpam/SpamAssassin/SpamAssassinClient.cpp:54	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
219bb871cb39a3d0ca52	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/AntiSpam/SpamTestSpamAssassin.cpp:212	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
a20d41e89a6e088891f5	clang-tidy	readability-suspicious-call-argument	hmailserver/source/Server/Common/AntiSpam/SpamTrapMonitor.cpp:566	1st argument 'connecting' (passed to 'sSenderIP') looks like it might be swapped with the 2nd, 'sender' (passed to 'sSenderEmail')	Triaged 26 September 2026: the arguments are in the order the callee names them - a move made back after a failure goes new to old on purpose, SPF takes the connecting address as the sender's IP, a delegate is the reply's SENT-BY.
fa3b0167ff60a7f99339	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/AntiVirus/Sandbox.cpp:67	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
aa5aba66310389fc8beb	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/AntiVirus/Sandbox.cpp:100	performing an implicit widening conversion to type 'const unsigned long long' of a multiplication performed in type 'int'
a394564a7ee36b402193	clang-tidy	bugprone-signed-char-misuse	hmailserver/source/Server/Common/AntiVirus/Sandbox.cpp:169	'signed char' to 'unsigned int' conversion; consider casting to 'unsigned char' first. (also cert-str34-c)
68bff568630e2ac5953a	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/AntiVirus/Sandbox.cpp:2441	'atol' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
b0a7c3ff90ff6b9d6e2f	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Application/AccountStores.cpp:1569	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether	Triaged 26 September 2026: deliberate - a destructor, or a best-effort step (a cache invalidated, a drain woken, a decision dropped, an optional PST part) that must not throw into its caller, most with the comment that says so.
a21c23181a2e119883e0	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Application/Application.cpp:484	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
c2739f348dfe3c972d25	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Application/BackupExecuter.cpp:1053	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
1fa45fa45a75c2a4e6eb	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Application/BackupScheduleTask.cpp:434	uninitialized record type: 'info'
837741bdf223d5d21f45	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Application/BackupScheduleTask.cpp:460	uninitialized record type: 'parent_info'
933217f297bd18202f6d	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Application/BackupScheduleTask.cpp:519	uninitialized record type: 'freeBytesAvailable'
1a348d713d63b8dcb758	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Application/BackupScheduleTask.cpp:547	performing an implicit widening conversion to type 'unsigned long long' of a multiplication performed in type 'int'
ccfd4d9b7a1937613ec6	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Application/BackupScheduleTask.cpp:548	performing an implicit widening conversion to type 'boost::uintmax_t' (aka 'unsigned long') of a multiplication performed in type 'int'
1bc8c666126de6bed709	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Application/DomainSamples.cpp:29	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'
b08c6f8b9db890ec4c1c	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Application/EffectiveSetting.cpp:586	the value returned by this function should not be disregarded; neglecting it may lead to errors
b605ea1950fa611d070f	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Application/EffectiveSetting.cpp:981	the value returned by this function should not be disregarded; neglecting it may lead to errors
195ca9a5d9cff0078ccf	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Application/EnvironmentSettings.cpp:78	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
a5a446abdf9bf38fae47	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Application/EnvironmentSettings.cpp:567	uninitialized record type: 'information'
7a854a4853939ed7342c	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Application/EnvironmentSettings.cpp:617	the value returned by this function should not be disregarded; neglecting it may lead to errors
c1adb2ce695ccf8329c0	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Application/EnvironmentSettings.cpp:1188	the value returned by this function should not be disregarded; neglecting it may lead to errors
0a787152c8f00da9490f	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Application/EnvironmentSettings.cpp:1189	the value returned by this function should not be disregarded; neglecting it may lead to errors
721459bb6b35a25aa211	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/Common/Application/ErrorManager.cpp:271	repeated branch body in conditional chain
0d9913886b5603636d5f	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Application/ExceptionHandler.cpp:85	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
0bbd4bd49286962d833f	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Application/ExceptionHandler.cpp:95	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
e2301132634b20aa266f	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Application/ExceptionHandler.cpp:133	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
7118b6b3743ef2bf84f6	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Application/ExceptionHandler.cpp:149	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
e6e449f21c06a858215e	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Application/IniFileSettings.cpp:366	uninitialized record type: 'context'
52287ca23662035ce3db	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Application/IniFileSettings.cpp:2607	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
87d18b0a9244e511e448	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Application/Logger.cpp:697	performing an implicit widening conversion to type 'boost::uintmax_t' (aka 'unsigned long') of a multiplication performed in type 'int'
e2c0251530701feb2a2b	clang-tidy	readability-suspicious-call-argument	hmailserver/source/Server/Common/Application/Logger.cpp:730	2nd argument 'from' (passed to '__pos') looks like it might be swapped with the 3rd, 'npos' (passed to '__n')
d1a8d825ef6835787d04	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Application/MailboxRetentionTask.cpp:58	uninitialized record type: 'cutoffTm'
d0b0ca1a85950b88dfc9	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Application/MessageIndexer.cpp:288	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether	Triaged 26 September 2026: deliberate - a destructor, or a best-effort step (a cache invalidated, a drain woken, a decision dropped, an optional PST part) that must not throw into its caller, most with the comment that says so.
7156f10cf1bfe259ed44	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/Common/Application/MessageIndexer.cpp:330	repeated branch body in conditional chain	Triaged 26 September 2026: different conditions that end the same way, on purpose.
7b67c2e57cb1b94346fa	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Application/MessageIndexer.cpp:456	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether	Triaged 26 September 2026: deliberate - a destructor, or a best-effort step (a cache invalidated, a drain woken, a decision dropped, an optional PST part) that must not throw into its caller, most with the comment that says so.
776c3d2d69e67fb40261	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Application/MetricsHistoryTask.cpp:230	uninitialized record type: 'parts'
d31126421264473753b0	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Application/MigrationJobPst.cpp:470	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
9ccfdc5b6f8c032fd635	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Application/MigrationJobPstItems.cpp:145	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
037627595483733d5bfd	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Application/NewInstallDefaults.cpp:133	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
91b10384c86acdf85eef	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Application/NewInstallDefaults.cpp:560	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
c82af791bae66049cec1	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Application/NewInstallDefaults.cpp:561	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
4e302953c0fdd6434758	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Application/OutOfMemoryHandler.cpp:53	performing an implicit widening conversion to type 'unsigned long' of a multiplication performed in type 'int'
cb6f9e56216595076c7d	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Application/OutOfMemoryHandler.cpp:79	performing an implicit widening conversion to type 'unsigned long' of a multiplication performed in type 'int'
6415d0ded31b946a8c4a	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Application/Profiles.cpp:1748	the value returned by this function should not be disregarded; neglecting it may lead to errors
9b28cdbe8f7c12232dfb	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Application/Profiles.cpp:1749	the value returned by this function should not be disregarded; neglecting it may lead to errors
ac4804cddc0bdbf4bb03	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Application/QuarantineDigestTask.cpp:134	uninitialized record type: 'local'
9146d8d57f04fd3bbb05	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Application/ScheduledMailTask.cpp:218	uninitialized record type: 'one'
d2d886985db720af6176	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Application/SettingsDiff.cpp:72	the value returned by this function should not be disregarded; neglecting it may lead to errors
d68b7e65f51c172b9e17	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Application/WindowsEventLog.cpp:128	performing an implicit widening conversion to type 'const unsigned long long' of a multiplication performed in type 'int'
407c20c677fa44364253	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Application/WindowsEventLog.cpp:508	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
3c2e0430eb804bdd3021	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Cache/CacheContainer.cpp:44	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'
f50a12f3f9e0db7217fb	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Cache/CacheContainer.cpp:47	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'
008dbd1f5113f5a938c7	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Cache/CacheContainer.cpp:48	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'
55004377b869d8703ccd	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Cache/CacheContainer.cpp:49	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'
d613426dbcc6172482b7	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/LDAP/LdapClient.cpp:276	uninitialized record type: 'timeout'
f1eb5821395ad1321847	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/Common/LDAP/LdapClient.cpp:430	switch has 2 consecutive identical branches
68cd732a435d0be4c1da	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/LDAP/LdapClient.cpp:1138	uninitialized record type: 'credentials'
bdae807a4302e21bd8a2	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/LDAP/LdapClient.cpp:1209	uninitialized record type: 'credentials'
a996e85e90d48269a0c9	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/LDAP/LdapClient.cpp:1479	uninitialized record type: 'cookie'
83c82df7116b5ae59e01	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/LDAP/LdapSettings.cpp:228	uninitialized record type: 'attributes'
79b0ad5fc2a9a477ca75	cppcheck	nullPointerRedundantCheck	hmailserver/source/Server/Common/Mime/Mime.cpp:397	Either the condition '!pszStart' is redundant or there is possible null pointer dereference: pszStart.
d5e742f12fec45b41ae0	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Mime/Mime.cpp:898	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
3b8a448e614beead2ec8	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/Common/Mime/MimeCode.cpp:277	repeated branch body in conditional chain
3b475a7d09adca8232bc	clang-tidy	bugprone-macro-parentheses	hmailserver/source/Server/Common/Mime/MimeCode.h:100	macro replacement list should be enclosed in parentheses
3379010fd89ce8796242	clang-tidy	bugprone-macro-parentheses	hmailserver/source/Server/Common/Mime/MimeCode.h:100	macro argument should be enclosed in parentheses
258f08f6e3f27e00da5a	clang-tidy	bugprone-macro-parentheses	hmailserver/source/Server/Common/Mime/MimeCode.h:109	macro replacement list should be enclosed in parentheses
474d7b9c718e8e76b03d	clang-tidy	bugprone-macro-parentheses	hmailserver/source/Server/Common/Mime/MimeCode.h:109	macro argument should be enclosed in parentheses
f1bbd9885357bc3cf157	clang-tidy	bugprone-misplaced-widening-cast	hmailserver/source/Server/Common/Mime/MimeTester.cpp:639	either cast from 'int' to 'size_t' (aka 'unsigned long') is ineffective, or there is loss of precision before the conversion	Triaged 26 September 2026: a sum or product of small non-negative ints (a tester's counts, an SNMP cipher's output lengths) - nothing is lost before the cast.
92c5621b2b8a199fce57	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Persistence/MailboxMove.cpp:89	the value returned by this function should not be disregarded; neglecting it may lead to errors
dd1e4d1f403685c281b9	clang-tidy	readability-suspicious-call-argument	hmailserver/source/Server/Common/Persistence/MailboxMove.cpp:569	1st argument 'wanted' (passed to 'oldAddress') looks like it might be swapped with the 2nd, 'oldAddress' (passed to 'newAddress')
383f04447ae783f72b57	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStore.cpp:56	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
e2cfd7175987d6078899	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Persistence/MessageStore.cpp:257	uninitialized record type: 'status'
c3c1ec7de617ba25828c	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Persistence/MessageStore.cpp:413	uninitialized record type: 'status'
e567056b49d884f32f5f	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStore.cpp:535	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
ce8a6e1bf3f24f1bff6a	clang-tidy	bugprone-signed-char-misuse	hmailserver/source/Server/Common/Persistence/MessageStore.cpp:2123	'signed char' to 'int' conversion; consider casting to 'unsigned char' first. (also cert-str34-c)	Triaged 26 September 2026: compared with ASCII only, where a byte above 0x7F matches nothing it should not; or read as unsigned and refused at 0x7F and above; or a wchar_t, which AppendUtf8 turns into U+FFFD when out of range.
daa7bfcfdc07d306de3e	clang-tidy	bugprone-exception-escape	hmailserver/source/Server/Common/Persistence/MessageStoreBlobs.cpp:379	an exception may be thrown in function '~DeletionHold' which should not throw exceptions
fd897b30c27ef1f04622	clang-tidy	readability-suspicious-call-argument	hmailserver/source/Server/Common/Persistence/MessageStoreFormat.cpp:1042	2nd argument 'restAt' (passed to '__pos') looks like it might be swapped with the 3rd, 'npos' (passed to '__n')
72c2741ba9ebeb0b3e63	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreFormat.cpp:1154	performing an implicit widening conversion to type 'unsigned long long' of a multiplication performed in type 'int'
e12b13b24713ab6ee8d6	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreMaintenance.cpp:56	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'
b35e55f994d41a868191	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Persistence/MessageStoreMaintenance.cpp:97	the value returned by this function should not be disregarded; neglecting it may lead to errors
44014f2363ce943af1c7	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Persistence/MessageStoreMaintenance.cpp:98	the value returned by this function should not be disregarded; neglecting it may lead to errors
721669b67293637648f3	clang-tidy	concurrency-mt-unsafe	hmailserver/source/Server/Common/Persistence/MessageStoreMaintenance.cpp:197	function is not thread safe	Triaged 26 September 2026: getenv read with no setenv anywhere in the server; strerror for a message's text; sigprocmask in a forked child, which has one thread.
5756465f9c9f16ba0151	clang-tidy	concurrency-mt-unsafe	hmailserver/source/Server/Common/Persistence/MessageStoreMaintenance.cpp:1222	function is not thread safe
5c2abf2813b86ab1989e	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreObjectClient.cpp:41	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
5d6b796b0e62e7618c4c	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreObjectClient.cpp:44	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
de24c356b902a32e1cb4	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreObjectClient.cpp:45	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
0cb8ff6588b6766b1772	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreObjectClient.cpp:49	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
e7a6947f09a173115cda	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreObjectClient.cpp:50	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
f57ef63dff0239a7a27f	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreObjectClient.cpp:68	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
0186ef1f9de51897cd28	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreObjectClient.cpp:78	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
e4dd60ae3e495af2dca3	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreObjectClient.cpp:144	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
d3e32737661fdafd85df	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreObjectClient.cpp:144	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
08337460952c1d254117	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Persistence/MessageStoreObjectClient.cpp:222	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
9e7fcf14179c240f7b55	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Persistence/MessageStoreObjectClient.cpp:1287	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
ef907c315028f41145ab	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreObjectClient.h:121	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
260d67a3d43647e3717a	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreObjectClient.h:198	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
d78e27007e4a2c70379d	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreObjects.cpp:55	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
a504c493e972920b0a78	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreObjects.cpp:56	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
39cd558d7b7eb8961e34	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreObjects.cpp:61	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
b5fe67bdb024fa231b3b	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreObjects.cpp:62	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
79c3db735ce5ae085dff	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreObjects.cpp:70	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
baba35a37c94ef33870d	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreObjects.cpp:71	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
402a450b916057a83931	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreObjects.cpp:72	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
6f48b4b59e1fcc725f4d	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreObjects.cpp:73	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
28c2517bf75fe211e68c	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreObjects.cpp:74	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
bd72dedf28cf75337fd5	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreObjects.cpp:75	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
11b5fbbb9e9041e4fa8c	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Persistence/MessageStoreObjects.cpp:162	uninitialized record type: 'status'	Triaged 26 September 2026: every field is assigned before it is read - a record filled field by field from a row or the file before it is kept, a system structure filled by the call it is passed to, a table its constructor fills.
7c00c3a5fdda3340e7f4	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Persistence/MessageStoreObjects.cpp:264	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
6ccb6bdf2666443fd3e4	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Persistence/MessageStoreObjects.cpp:265	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
bee5ca8975899c55c29b	clang-tidy	bugprone-signed-char-misuse	hmailserver/source/Server/Common/Persistence/MessageStoreObjects.cpp:712	'signed char' to 'int' conversion; consider casting to 'unsigned char' first. (also cert-str34-c)	Triaged 26 September 2026: compared with ASCII only, where a byte above 0x7F matches nothing it should not; or read as unsigned and refused at 0x7F and above; or a wchar_t, which AppendUtf8 turns into U+FFFD when out of range.
908ccdeb9d2012866db4	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreObjects.cpp:1479	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
0cec356e89f0804d04e4	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreObjects.cpp:1642	performing an implicit widening conversion to type 'time_t' (aka 'long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
5d693588682d3608e835	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Persistence/MessageStoreObjects.cpp:1721	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether	Triaged 26 September 2026: deliberate - a destructor, or a best-effort step (a cache invalidated, a drain woken, a decision dropped, an optional PST part) that must not throw into its caller, most with the comment that says so.
d51e9d5c728909838893	clang-tidy	bugprone-exception-escape	hmailserver/source/Server/Common/Persistence/MessageStoreObjects.cpp:1752	an exception may be thrown in function '~InFlight' which should not throw exceptions	Triaged 26 September 2026: a destructor that takes a mutex to let go of what it holds - a mutex that throws is a broken process, and terminate is the right answer to it.
124260780b9ea0b61486	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/Common/Persistence/MessageStoreObjects.cpp:2058	repeated branch body in conditional chain	Triaged 26 September 2026: different conditions that end the same way, on purpose.
bd985cef33b20236f1c3	clang-tidy	bugprone-signed-char-misuse	hmailserver/source/Server/Common/Persistence/MessageStoreObjects.cpp:2264	'signed char' to 'int' conversion; consider casting to 'unsigned char' first. (also cert-str34-c)	Triaged 26 September 2026: compared with ASCII only, where a byte above 0x7F matches nothing it should not; or read as unsigned and refused at 0x7F and above; or a wchar_t, which AppendUtf8 turns into U+FFFD when out of range.
da4fe02d3465796456d2	clang-tidy	bugprone-exception-escape	hmailserver/source/Server/Common/Persistence/MessageStoreObjects.cpp:2699	an exception may be thrown in function '~HoldTree' which should not throw exceptions	Triaged 26 September 2026: a destructor that takes a mutex to let go of what it holds - a mutex that throws is a broken process, and terminate is the right answer to it.
6c59776cfbfa628369e4	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/MessageStoreObjects.cpp:2750	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
b611cee71f5dbafec7e5	clang-tidy	readability-suspicious-call-argument	hmailserver/source/Server/Common/Persistence/NameChanger.cpp:212	1st argument 'oldDirectoryName' (passed to 'fromDirectory') looks like it might be swapped with the 2nd, 'newDirectoryName' (passed to 'toDirectory')	Triaged 26 September 2026: the arguments are in the order the callee names them - a move made back after a failure goes new to old on purpose, SPF takes the connecting address as the sender's IP, a delegate is the reply's SENT-BY.
0883e0e5e07ab34b8948	clang-tidy	readability-suspicious-call-argument	hmailserver/source/Server/Common/Persistence/NameChanger.cpp:220	1st argument 'newDirectoryName' (passed to 'oldDirectory') looks like it might be swapped with the 2nd, 'oldDirectoryName' (passed to 'newDirectory')	Triaged 26 September 2026: the arguments are in the order the callee names them - a move made back after a failure goes new to old on purpose, SPF takes the connecting address as the sender's IP, a delegate is the reply's SENT-BY.
45eb26123b1f32d1dc4f	clang-tidy	readability-suspicious-call-argument	hmailserver/source/Server/Common/Persistence/NameChanger.cpp:272	1st argument 'newDirectory' (passed to 'oldDirectory') looks like it might be swapped with the 2nd, 'oldDirectory' (passed to 'newDirectory')	Triaged 26 September 2026: the arguments are in the order the callee names them - a move made back after a failure goes new to old on purpose, SPF takes the connecting address as the sender's IP, a delegate is the reply's SENT-BY.
7b67df2e57dfccde6f35	clang-tidy	readability-suspicious-call-argument	hmailserver/source/Server/Common/Persistence/NameChanger.cpp:304	1st argument 'newDirectory' (passed to 'oldDirectory') looks like it might be swapped with the 2nd, 'oldDirectory' (passed to 'newDirectory')	Triaged 26 September 2026: the arguments are in the order the callee names them - a move made back after a failure goes new to old on purpose, SPF takes the connecting address as the sender's IP, a delegate is the reply's SENT-BY.
b92e074c14b48eb768e4	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Persistence/PersistentBounce.cpp:185	uninitialized record type: 'local'
981ec3ef434b72f3a69c	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Persistence/PersistentComplaint.cpp:139	uninitialized record type: 'local'
7bedfbb1580f398b4a6a	clang-tidy	bugprone-signed-char-misuse	hmailserver/source/Server/Common/Persistence/PersistentJournalRule.cpp:41	'signed char' to 'unsigned int' conversion; consider casting to 'unsigned char' first. (also cert-str34-c)
4160d57ee59f13cfec7c	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Persistence/PersistentMessage.cpp:95	performing an implicit widening conversion to type 'const unsigned long long' of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
f5bcb1e7f7159477bcdd	clang-tidy	readability-suspicious-call-argument	hmailserver/source/Server/Common/Persistence/PersistentMessage.cpp:725	1st argument 'linkFrom' (passed to 'existing') looks like it might be swapped with the 2nd, 'destinationFile' (passed to 'link')
3a29b77ba239361d051c	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Persistence/SchemaUpgrader.cpp:73	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether	Triaged 26 September 2026 for the 6.3.4 release gate (.gitlab/security-exceptions.yml), the same line in the same file then: This is deliberate: ~NamedUpgradeLock is a destructor and must not throw. MySQLConnection::TryExecute catches internally and reports failure only through its return (MySQLConnection.cpp 429-507), so only std::bad_alloc can reach this catch. A release_lock that fails because the connection broke fails because the session ended, and GET_LOCK dies with the session. The one case left, bad_alloc on a live pooled connection (DatabaseConnectionManager::UpgradeSchema returns it to the pool), would at worst make another walker wait out its 4-hour GET_LOCK and stop with the named error, with no damage to data.
26db2d67dfaaaa770e08	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Pst/PstFile.cpp:45	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
3ef8a84715c77831d04f	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Pst/PstFile.cpp:52	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
25208e35b3a5889e0db0	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Pst/PstFileAnsi.cpp:74	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
364a70dd2bd9a254f561	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Pst/PstFileAnsi.cpp:81	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
25c0299a30f39d54931b	clang-tidy	bugprone-signed-char-misuse	hmailserver/source/Server/Common/Pst/PstFormat.cpp:390	'signed char' to 'uint32_t' (aka 'unsigned int') conversion; consider casting to 'unsigned char' first. (also cert-str34-c)	Triaged 26 September 2026: compared with ASCII only, where a byte above 0x7F matches nothing it should not; or read as unsigned and refused at 0x7F and above; or a wchar_t, which AppendUtf8 turns into U+FFFD when out of range.
eb8a441a5b15e32f93f8	clang-tidy	bugprone-signed-char-misuse	hmailserver/source/Server/Common/Pst/PstFormat.cpp:393	'signed char' to 'uint32_t' (aka 'unsigned int') conversion; consider casting to 'unsigned char' first. (also cert-str34-c)	Triaged 26 September 2026: compared with ASCII only, where a byte above 0x7F matches nothing it should not; or read as unsigned and refused at 0x7F and above; or a wchar_t, which AppendUtf8 turns into U+FFFD when out of range.
ee76c07c335d63ff4889	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Pst/PstFormat.cpp:569	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
92672c70e3236fccc436	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Pst/PstItems.cpp:74	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
50f94bea6925b45b6afb	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Pst/PstItems.cpp:83	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
12442d746204c49bec2b	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Pst/PstItems.cpp:92	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
9163d05a929a10461f9e	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Pst/PstItems.cpp:110	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
bbc517927c0e08dd7905	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Pst/PstItems.cpp:117	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
278b157f1a592c18199a	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Pst/PstItems.cpp:124	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
5404f228da09074c41e7	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstItems.cpp:266	performing an implicit widening conversion to type 'int64_t' (aka 'long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
4212cb7587d98e9a7584	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstItems.cpp:266	performing an implicit widening conversion to type 'int64_t' (aka 'long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
732b58518c9524c95087	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Pst/PstItems.cpp:806	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether	Triaged 26 September 2026: deliberate - a destructor, or a best-effort step (a cache invalidated, a drain woken, a decision dropped, an optional PST part) that must not throw into its caller, most with the comment that says so.
527ffd15039802682a1a	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstItems.cpp:1158	performing an implicit widening conversion to type 'int64_t' (aka 'long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
786757b2f37af30e1d81	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstItems.cpp:1158	performing an implicit widening conversion to type 'int64_t' (aka 'long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
820734f442a8e276dedf	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstItems.h:314	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
8485ab344c1a5c310b7c	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstItems.h:315	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
f63a58e210ee64ae57d7	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstItems.h:316	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
355975c321eed9bbce51	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstItems.h:317	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
b62d503c7d90eab62ae1	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstItemsTester.cpp:146	performing an implicit widening conversion to type 'int64_t' (aka 'long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
c5f01f48556472534f35	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstItemsTester.cpp:146	performing an implicit widening conversion to type 'int64_t' (aka 'long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
71a7036c273655ce54cc	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstItemsTester.cpp:402	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
d550b3c2d696f37f86fb	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstItemsTester.cpp:477	performing an implicit widening conversion to type 'size_type' (aka 'unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
57a3425fe6c867e10dd1	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstItemsTester.cpp:478	performing an implicit widening conversion to type 'size_type' (aka 'unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
ae52d18d18856e4af3a9	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstItemsTester.cpp:945	performing an implicit widening conversion to type 'size_type' (aka 'unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
f566f8ba3dd9da31f62f	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Pst/PstLtp.cpp:282	uninitialized record type: 'entry'	Triaged 26 September 2026: every field is assigned before it is read - a record filled field by field from a row or the file before it is kept, a system structure filled by the call it is passed to, a table its constructor fills.
b160ea66181564ed8dcd	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Pst/PstLtp.cpp:516	uninitialized record type: 'column'	Triaged 26 September 2026: every field is assigned before it is read - a record filled field by field from a row or the file before it is kept, a system structure filled by the call it is passed to, a table its constructor fills.
1efa44406c5e158a26da	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstLtp.h:113	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
380cc1cfe63c7c5908c3	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstLtp.h:151	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
c1210585dfdbd6ba59f2	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstLtp.h:155	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
70882801d8c3b3b42917	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Pst/PstMime.cpp:167	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
e1177323ae78b6f7ac47	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Pst/PstMime.cpp:440	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
3fc8a8801193289651ba	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Pst/PstMime.cpp:776	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
75a6be6abd66650d7ef1	clang-tidy	concurrency-mt-unsafe	hmailserver/source/Server/Common/Pst/PstReaderProcess.cpp:151	function is not thread safe	Triaged 26 September 2026: getenv read with no setenv anywhere in the server; strerror for a message's text; sigprocmask in a forked child, which has one thread.
9a3ec8b17392cd872bb9	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Pst/PstReaderProcess.cpp:178	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether	Triaged 26 September 2026: deliberate - a destructor, or a best-effort step (a cache invalidated, a drain woken, a decision dropped, an optional PST part) that must not throw into its caller, most with the comment that says so.
cddb081579cfa5f39da5	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Pst/PstReaderProcess.cpp:1092	uninitialized record type: 'ready'	Triaged 26 September 2026: every field is assigned before it is read - a record filled field by field from a row or the file before it is kept, a system structure filled by the call it is passed to, a table its constructor fills.
ca05646149c0d5176bdd	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Pst/PstReaderProcess.cpp:1211	uninitialized record type: 'none'	Triaged 26 September 2026: every field is assigned before it is read - a record filled field by field from a row or the file before it is kept, a system structure filled by the call it is passed to, a table its constructor fills.
54904ef39f0c97874db8	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Pst/PstReaderProcess.cpp:1214	uninitialized record type: 'descriptors'	Triaged 26 September 2026: every field is assigned before it is read - a record filled field by field from a row or the file before it is kept, a system structure filled by the call it is passed to, a table its constructor fills.
a467131334ece658c7e7	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Pst/PstReaderProcess.cpp:1218	uninitialized record type: 'memory'	Triaged 26 September 2026: every field is assigned before it is read - a record filled field by field from a row or the file before it is kept, a system structure filled by the call it is passed to, a table its constructor fills.
da6c2831012e05c09747	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Pst/PstReaderProcess.cpp:1224	uninitialized record type: 'current'	Triaged 26 September 2026: every field is assigned before it is read - a record filled field by field from a row or the file before it is kept, a system structure filled by the call it is passed to, a table its constructor fills.
bf31641cfde4781b8a21	clang-tidy	clang-analyzer-unix.BlockInCriticalSection	hmailserver/source/Server/Common/Pst/PstReaderProcess.cpp:1319	Call to blocking function 'read' inside of critical section	Triaged 26 September 2026: no lock is held at that read - TakeSlot_ lets the slot's lock go before the reader is spawned, and the read waits only for the exec.
12efb879a979e6926890	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstReaderWire.cpp:298	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
5bc4fe974e709c95bb21	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstReaderWire.h:247	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
8d68308801362e7f3263	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstReaderWire.h:252	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
7f3c6d2a9d10045a9ef7	clang-tidy	bugprone-not-null-terminated-result	hmailserver/source/Server/Common/Pst/PstReaderWireTester.cpp:53	the result from calling 'memcpy' is not null-terminated	Triaged 26 September 2026: binary buffers, not strings - a tester's reader and the RTF decompressor's dictionary.
f32e48a82777669dcb73	clang-tidy	bugprone-misplaced-widening-cast	hmailserver/source/Server/Common/Pst/PstReaderWireTester.cpp:174	either cast from 'int' to 'size_t' (aka 'unsigned long') is ineffective, or there is loss of precision before the conversion	Triaged 26 September 2026: a sum or product of small non-negative ints (a tester's counts, an SNMP cipher's output lengths) - nothing is lost before the cast.
7e902d7109091c04ac3a	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstReaderWireTester.cpp:214	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'unsigned int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
28eb29d03e6231578a6a	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstReaderWireTester.cpp:220	performing an implicit widening conversion to type 'size_type' (aka 'unsigned long') of a multiplication performed in type 'unsigned int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
f850bf517ca71966347c	clang-tidy	bugprone-not-null-terminated-result	hmailserver/source/Server/Common/Pst/PstRtf.cpp:135	the result from calling 'memcpy' is not null-terminated	Triaged 26 September 2026: binary buffers, not strings - a tester's reader and the RTF decompressor's dictionary.
a1a39a23f11b03a555da	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Pst/PstSource.cpp:79	uninitialized record type: 'status'	Triaged 26 September 2026: every field is assigned before it is read - a record filled field by field from a row or the file before it is kept, a system structure filled by the call it is passed to, a table its constructor fills.
8038759dbd355f97bc05	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Pst/PstSource.cpp:113	uninitialized record type: 'status'	Triaged 26 September 2026: every field is assigned before it is read - a record filled field by field from a row or the file before it is kept, a system structure filled by the call it is passed to, a table its constructor fills.
321a9a31459f79fce587	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Pst/PstSource.cpp:134	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
47961bc6a3558ac600fb	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstStore.cpp:85	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
465e2fd2b7128dacb5ea	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstStore.cpp:86	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
d754f6a739f829c35976	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstStore.cpp:87	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
4b4d1d9b08fa9a60b907	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstStore.cpp:218	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
ca29c7114bcee01fd273	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Pst/PstStore.cpp:291	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether	Triaged 26 September 2026: deliberate - a destructor, or a best-effort step (a cache invalidated, a drain woken, a decision dropped, an optional PST part) that must not throw into its caller, most with the comment that says so.
174a4f7954c3dd54b972	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstStore.cpp:312	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
cb18204105bba3f04120	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstStore.cpp:312	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
dd0630e38742f1df4a7e	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Pst/PstStore.cpp:339	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether	Triaged 26 September 2026: deliberate - a destructor, or a best-effort step (a cache invalidated, a drain woken, a decision dropped, an optional PST part) that must not throw into its caller, most with the comment that says so.
72baf4508186b160507b	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Pst/PstStore.cpp:415	uninitialized record type: 'top'	Triaged 26 September 2026: every field is assigned before it is read - a record filled field by field from a row or the file before it is kept, a system structure filled by the call it is passed to, a table its constructor fills.
bcb7bd8ace51a64f916e	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstStore.cpp:486	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
a9b6cae7b4f446823364	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Pst/PstStore.cpp:523	uninitialized record type: 'next'	Triaged 26 September 2026: every field is assigned before it is read - a record filled field by field from a row or the file before it is kept, a system structure filled by the call it is passed to, a table its constructor fills.
5c9dbc238f42c5409b93	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstStore.h:208	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
8273d7c62b514d5359c1	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstStore.h:216	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
485972d8e268326357b8	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstStoreItems.cpp:96	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
c823acf3c3fcabee245f	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstStoreItems.cpp:97	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
1d3ac6e4b5d8e7f15034	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstStoreItems.cpp:98	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
68d62c5182a30f35c913	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstStoreItems.cpp:99	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
f6cef463f9bb0bd5d7db	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Pst/PstStoreItems.cpp:230	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
ead8f0d242315f056195	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstStoreItems.cpp:260	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
dee3f813feb64cbe60f6	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Pst/PstStoreItems.cpp:379	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
ca1a379b00a86c22634e	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstStoreItems.cpp:412	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
2978ee885d1f9589ef79	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstStoreItems.cpp:413	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
957c09b7440a3eb9691f	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstStoreItems.cpp:913	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
7114b3c761290db4aabe	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstStoreItems.cpp:918	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
cdae963f437bc4c7d1c7	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Pst/PstTester.cpp:307	uninitialized record type: 'child'	Triaged 26 September 2026: every field is assigned before it is read - a record filled field by field from a row or the file before it is kept, a system structure filled by the call it is passed to, a table its constructor fills.
1b9d716c3bd03e986eb4	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Pst/PstTester.cpp:325	uninitialized record type: 'child'	Triaged 26 September 2026: every field is assigned before it is read - a record filled field by field from a row or the file before it is kept, a system structure filled by the call it is passed to, a table its constructor fills.
514add68380145921c51	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstTester.cpp:1104	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
8defcf176a67fb1ed892	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstTester.cpp:1294	performing an implicit widening conversion to type 'size_type' (aka 'unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
e894a64b048006666881	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Pst/PstTester.cpp:1517	performing an implicit widening conversion to type 'size_type' (aka 'unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
645e0b868a0fe8ca34bd	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Pst/PstTester.cpp:1569	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
31c737393a6c583caa45	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Pst/PstTester.cpp:1571	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
b8559c3655ca52b966e1	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/SQL/DatabaseTls.cpp:436	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
277486fa0a1bdcc07ce3	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/SQL/DatabaseTls.cpp:437	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
834425b8f00e1b32f248	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/SQL/MySQLConnection.cpp:40	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
201998d6c774c7f08d63	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/SQL/MySQLInterface.cpp:65	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
f5f608c74a1e15756593	clang-tidy	concurrency-mt-unsafe	hmailserver/source/Server/Common/SQL/MySQLInterface.cpp:201	function is not thread safe
9e142bb66e8611b52204	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/SQL/MySQLRecordset.cpp:33	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
1b5003466c0be0ef4e4f	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/SQL/PGConnection.cpp:39	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
a68953baa8111774c4dc	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/SQL/PGRecordset.cpp:32	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
3159ac5b8249c79a3716	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/Common/SQL/SQLScriptParser.cpp:102	repeated branch body in conditional chain
c7967b968ec1269abecb	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/SQL/SQLScriptRunner.cpp:75	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
584609d487d75dc9eb51	clang-tidy	bugprone-signed-char-misuse	hmailserver/source/Server/Common/Scripting/ScriptBinding.cpp:95	'signed char' to 'uint32_t' (aka 'unsigned int') conversion; consider casting to 'unsigned char' first. (also cert-str34-c)
68685c65ad857dd6a8be	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Scripting/ScriptBinding.cpp:1747	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'
fc018f562ebe7cb9d54d	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Scripting/ScriptBinding.cpp:2202	uninitialized record type: 'member'
3919c342290e6919f6e9	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Scripting/ScriptBinding.h:85	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
b06626e8aa2613575227	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Scripting/ScriptBinding.h:88	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
91309422e0e7ae817c5e	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Scripting/ScriptServer.cpp:983	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'
474ba799629bfa132bd6	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Scripting/ScriptServer.cpp:1154	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'
99b5888b6344585708c7	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Scripting/ScriptServer.cpp:1565	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'
36c19cf50ea7cb081322	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Sieve/ManageSieveServer.cpp:781	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
0e3746fe35d6bb224631	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Sieve/ManageSieveServer.cpp:1020	performing an implicit widening conversion to type 'size_type' (aka 'unsigned long') of a multiplication performed in type 'int'
0856d7ad6d4f58537bb6	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Sieve/ManageSieveServer.cpp:1044	performing an implicit widening conversion to type 'size_type' (aka 'unsigned long') of a multiplication performed in type 'int'
37113da9a29b4f636ce1	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Sieve/SieveDuplicateTracker.cpp:38	performing an implicit widening conversion to type 'const long' of a multiplication performed in type 'int'
89c622fcd467a9e476c8	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Sieve/SieveVacationTracker.cpp:57	performing an implicit widening conversion to type 'const long' of a multiplication performed in type 'int'
ac3484788af19a584c00	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/TCPIP/DnssecResolver.cpp:584	the value returned by this function should not be disregarded; neglecting it may lead to errors
63f651ff63874548953b	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/TCPIP/DnssecResolver.cpp:640	uninitialized record type: 'timeout'
dc4ade16d2f143230027	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/TCPIP/DnssecResolver.cpp:642	performing an implicit widening conversion to type '__suseconds_t' (aka 'long') of a multiplication performed in type 'DWORD' (aka 'unsigned int')
fcee48fb2d466f061d16	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/TCPIP/DnssecResolver.cpp:1158	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
1968bccd43b9feddce3b	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/TCPIP/DnssecResolver.cpp:1159	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
7226683afcf999c30a32	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/TCPIP/DnssecResolver.cpp:1160	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
776ffaf5053d1bed178d	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/TCPIP/DnssecResolver.cpp:2039	uninitialized record type: 'address'
675b732c32a06030e3ad	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/TCPIP/DnssecResolver.cpp:2050	uninitialized record type: 'address'
5145ff922e8d5816fe43	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/TCPIP/IPAddress.cpp:208	the value returned by this function should not be disregarded; neglecting it may lead to errors
8443eceed875ab06208d	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/TCPIP/IPAddress.cpp:221	the value returned by this function should not be disregarded; neglecting it may lead to errors
914657647563559a659f	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/Common/TCPIP/IPAddress.cpp:267	repeated branch body in conditional chain
fea732f441c5de756807	clang-tidy	concurrency-mt-unsafe	hmailserver/source/Server/Common/TCPIP/LocalIPAddresses.cpp:41	function is not thread safe	Triaged 26 September 2026 for the 6.3.4 release gate (.gitlab/security-exceptions.yml), the same line in the same file then: On Windows Winsock returns the hostent from thread-local storage; on Linux glibc's static hostent is shared only with other gethostbyname calls, and the only other caller in the tree, Utilities::IsLocalHost, is reached solely from COM InterfaceUtilities and UtilitiesTester via ClassTester (CMakeLists.txt:415: COM and the Windows /Test switch only). LoadIPAddresses itself runs in Configuration::Load (InitInstance, or a CLI verb's own process) and then in IOService::DoWork (StartServers), one after the other on start, and Application::Reinitialize serialises restarts under reinitialize_mutex_, so two gethostbyname calls never overlap. inet_ntoa (line 50) uses a per-thread buffer in both glibc and Winsock.
7ebf2698d791df3e955d	clang-tidy	concurrency-mt-unsafe	hmailserver/source/Server/Common/TCPIP/LocalIPAddresses.cpp:52	function is not thread safe
5d817e27560e55010635	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/TCPIP/SynchronousConnection.cpp:46	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
abcf055a924b5a1c41fd	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/TCPIP/SynchronousConnection.cpp:47	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
5bfc2ab7b859e76068ec	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/TCPIP/SynchronousConnection.cpp:49	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
6905972cf9830563b726	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/TCPIP/SynchronousConnection.cpp:232	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
5f79d89a61e9de0270ec	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/TCPIP/TCPConnection.cpp:94	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
f2467d16c3d5b8dac4f0	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/TCPIP/TCPConnection.cpp:153	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
9c22426f8666807d3983	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/TCPIP/TCPConnection.cpp:155	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
03c4ab2f6091916159ea	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/TCPIP/TCPConnection.cpp:165	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
d02bbaaadab9570824a7	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/TCPIP/TCPConnection.cpp:175	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
9876494e6e64c0632872	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/TCPIP/TCPConnection.cpp:272	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
75b8b5a96a9929826e0e	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/TCPIP/TCPConnection.cpp:308	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
1e1c19e839adfd5547b3	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/TCPIP/TCPConnection.cpp:568	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
4ba9d52ec7cd37f7146f	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/TCPIP/TCPConnection.cpp:608	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
9f722de9d0a6e0f4638e	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/TCPIP/TCPConnection.cpp:750	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
aeb765c6cebfab691333	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/TCPIP/TCPConnection.cpp:771	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
16118e679dde377528c5	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/TCPIP/TCPServer.cpp:76	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
9ee0f9ed5cc271d5d86f	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/TCPIP/TCPServer.cpp:209	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
1e900594603977b8f086	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/TCPIP/TCPServer.cpp:228	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
3d036cf44a00dedb2aaa	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/TCPIP/TCPServer.cpp:312	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
e85acc927925c7810556	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/TCPIP/TCPServer.cpp:388	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
e1fd120864501ba2a8ec	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Threading/WorkQueue.cpp:134	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
ffe6cae174e1b8000e33	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Threading/WorkQueue.cpp:654	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
683661f8dee6fcfe8116	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Threading/WorkQueue.cpp:762	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
8e3f249050c9eb525cc9	clang-tidy	readability-suspicious-call-argument	hmailserver/source/Server/Common/Util/AWStats.cpp:38	3rd argument 'sFromAddress' (passed to 'sender') looks like it might be swapped with the 5th, 'senderIP' (passed to 'sourceIP')
3eb7df8ea4103118024b	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Util/AccountLockout.cpp:65	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
b4535d023f52a159bb2b	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/AccountRecovery.cpp:73	performing an implicit widening conversion to type 'const time_t' (aka 'const long') of a multiplication performed in type 'int'
be6e09258627c2b6cbfc	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/AcmeClient.cpp:79	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
c7b904d4b589af60a3f9	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/AlertManager.cpp:234	the value returned by this function should not be disregarded; neglecting it may lead to errors
fee42a68b7cfc114bbe6	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/AlertManager.cpp:896	the value returned by this function should not be disregarded; neglecting it may lead to errors
394b6545a6e18414715a	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/AlertManager.cpp:1175	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'
eea9da92ee7ce9c390ac	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/ApiSends.cpp:213	uninitialized record type: 'cutoffTm'
4319759528a7b43be3fb	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/AutoBanFirewall.cpp:141	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
a9a339ba56aac344a01d	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/BrandLogo.cpp:29	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
f457966abf3d77f6663b	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/BrandLogo.cpp:30	performing an implicit widening conversion to type 'const time_t' (aka 'const long') of a multiplication performed in type 'int'
e663626cb7b50eead0af	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/BrandLogo.cpp:48	performing an implicit widening conversion to type 'const time_t' (aka 'const long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
33da6eaeb0b1add024b2	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/CalDavServer.cpp:83	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
068b9c341fbcfb8ca7a0	clang-tidy	readability-suspicious-call-argument	hmailserver/source/Server/Common/Util/CalendarStore.cpp:618	1st argument 'reachingCalendars' (passed to 'calendars') looks like it might be swapped with the 3rd, 'calendars' (passed to 'mergedCalendars')
d2bf9476623873962944	clang-tidy	readability-suspicious-call-argument	hmailserver/source/Server/Common/Util/CalendarStore.cpp:618	2nd argument 'reachingShares' (passed to 'shares') looks like it might be swapped with the 4th, 'shares' (passed to 'mergedShares')
0c12bd1084ee9a6094a1	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/CardDavServer.cpp:1979	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
b3382a47dec38b4343a5	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/CardDavServer.cpp:2216	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
a9322ae702a3ca161c69	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/ClassTester.cpp:1417	performing an implicit widening conversion to type 'time_t' (aka 'long') of a multiplication performed in type 'int'
0ea1eabab7d09859495d	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/ClassTester.cpp:1972	performing an implicit widening conversion to type 'time_t' (aka 'long') of a multiplication performed in type 'int'
d9f31821e3cfa4f0f40d	clang-tidy	bugprone-misplaced-widening-cast	hmailserver/source/Server/Common/Util/ClassTester.cpp:2226	either cast from 'int' to 'size_t' (aka 'unsigned long') is ineffective, or there is loss of precision before the conversion	Triaged 26 September 2026: a sum or product of small non-negative ints (a tester's counts, an SNMP cipher's output lengths) - nothing is lost before the cast.
5feae82942ce104a1d49	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/Compression.cpp:249	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
5f643fd43f1984f2246f	clang-tidy	concurrency-mt-unsafe	hmailserver/source/Server/Common/Util/Compression.cpp:686	function is not thread safe
f1b11f01ce4ffdde232d	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/CompromiseDetector.cpp:1288	performing an implicit widening conversion to type 'time_t' (aka 'long') of a multiplication performed in type 'int'
ba4118234ccf17e82fde	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/ConfidentialMessages.cpp:52	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'
7bece1fab9f176e32c11	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/ConfidentialMessages.cpp:53	performing an implicit widening conversion to type 'const time_t' (aka 'const long') of a multiplication performed in type 'int'
4bc8eb23cae788e20d85	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/ConfidentialMessages.cpp:55	performing an implicit widening conversion to type 'const time_t' (aka 'const long') of a multiplication performed in type 'int'
3bde531243892e008783	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/ConfidentialMessages.cpp:56	performing an implicit widening conversion to type 'const time_t' (aka 'const long') of a multiplication performed in type 'int'
26e71397338484419dc6	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/ConfidentialMessages.cpp:59	performing an implicit widening conversion to type 'const time_t' (aka 'const long') of a multiplication performed in type 'int'
f3d60d55436844e7cb36	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/ConfidentialMessages.cpp:60	performing an implicit widening conversion to type 'const time_t' (aka 'const long') of a multiplication performed in type 'int'
bdd82ef1d9d491c09002	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/ContentPolicy.cpp:855	performing an implicit widening conversion to type 'size_type' (aka 'unsigned long') of a multiplication performed in type 'int'	Triaged 27 September 2026: a product of constants, 400000 * 5 = 2,000,000, far inside int - nothing overflows before the widening. It reserves room for the 400,000 five-character &amp; that ContentPolicyTester::Test strips to time StripHtml.
c08b8f121d415604fa94	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Util/CountryBlocking.cpp:498	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
e681a7262f9435503de5	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/CrashOracle.cpp:239	the value returned by this function should not be disregarded; neglecting it may lead to errors
70c30e9334f982d92a06	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/CrashOracle.cpp:258	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
257e8a9bc390b5f4699d	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Util/CrashOracle.cpp:301	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
879aa184ab9b5ca8cfb3	clang-tidy	cert-err09-cpp	hmailserver/source/Server/Common/Util/CrashSimulation.cpp:26	throw expression throws a pointer; it should throw a non-pointer value instead (also cert-err61-cpp, misc-throw-by-value-catch-by-reference)
3be85e17bf10a732107c	clang-tidy	clang-analyzer-core.NonNullParamChecker	hmailserver/source/Server/Common/Util/CrashSimulation.cpp:31	Null pointer passed to 1st parameter expecting 'nonnull'	Triaged 6 October 2026: deliberate, and not reachable without an administrator. Case 3 of CrashSimulation::Execute writes through a null pointer to raise the access violation the crash handler's tests provoke (ExceptionHandlerTests, ExceptionHandlerDiagnosticsTests, CrashOracleTests: a minidump and the logged error). It runs only from the SMTP HELP command while Settings.CrashSimulationMode is 3, a setting only the COM API's Settings object sets, which only an authenticated server administrator reaches; it is held in memory, 0 at every start, and never set on Linux, which has no COM. No data of a peer reaches the address, the constant 0.
a9b0cb0ebbdfb2ff6186	cppcheck	nullPointer	hmailserver/source/Server/Common/Util/CrashSimulation.cpp:31	Null pointer dereference	Triaged 6 October 2026: deliberate, and not reachable without an administrator. Case 3 of CrashSimulation::Execute writes through a null pointer to raise the access violation the crash handler's tests provoke (ExceptionHandlerTests, ExceptionHandlerDiagnosticsTests, CrashOracleTests: a minidump and the logged error). It runs only from the SMTP HELP command while Settings.CrashSimulationMode is 3, a setting only the COM API's Settings object sets, which only an authenticated server administrator reaches; it is held in memory, 0 at every start, and never set on Linux, which has no COM. No data of a peer reaches the address, the constant 0.
e90f3b130fdb8a656045	clang-tidy	bugprone-signed-char-misuse	hmailserver/source/Server/Common/Util/Crypt.cpp:57	'signed char' to 'unsigned int' conversion; consider casting to 'unsigned char' first. (also cert-str34-c)	Triaged 26 September 2026 for the 6.3.4 release gate (.gitlab/security-exceptions.yml), the same line in the same file then: In CharactersAsBytes, password is a const String&, so password[i] is a wchar_t code unit, which the rule matches as a signed character type. `unit > 0xFF` needs the full unit as unsigned int to reject characters above Latin-1, and a negative 32-bit value becomes a value above 0xFF and returns false as it should. Casting through unsigned char would map U+0141 to 0x41 and wrongly accept it.
792ef7d1cc6f3730a9cd	clang-tidy	concurrency-mt-unsafe	hmailserver/source/Server/Common/Util/DataProtector.cpp:93	function is not thread safe
e94af86481dc2a5cb4e9	clang-tidy	misc-redundant-expression	hmailserver/source/Server/Common/Util/DataProtector.cpp:199	operator has equivalent nested operands
703aab514e39bbd65e75	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/DiscoverySearch.cpp:473	performing an implicit widening conversion to type 'size_type' (aka 'unsigned long') of a multiplication performed in type 'int'
f15f7b13eae660102403	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/DiscoverySearch.cpp:1407	performing an implicit widening conversion to type 'unsigned long long' of a multiplication performed in type 'int'
bee12f354487374aef65	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/DiskSpace.cpp:25	performing an implicit widening conversion to type 'const unsigned long long' of a multiplication performed in type 'int'
71dfb2cfaf50536a759e	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/DiskSpace.cpp:339	uninitialized record type: 'volume'
df57f39c96863deb2f21	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Util/DistributionListMembership.cpp:409	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
55fd571d7d913ba56e7c	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/DmarcRptStore.cpp:40	the value returned by this function should not be disregarded; neglecting it may lead to errors
e3a60c676afb1e1a608a	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/DomainReports.cpp:70	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
2954fef2fbdfcb782f9e	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/DomainReports.cpp:75	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
42aa4f5deb239b6a46f5	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/DomainReports.cpp:164	the value returned by this function should not be disregarded; neglecting it may lead to errors
feca015a7bfdc716f305	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/DomainReports.cpp:916	the value returned by this function should not be disregarded; neglecting it may lead to errors
ee229101a8a209f499c5	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/DomainReports.cpp:974	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'
075688db5dccedc2f700	clang-tidy	readability-suspicious-call-argument	hmailserver/source/Server/Common/Util/DomainReports.cpp:1925	1st argument 'raw' (passed to 'rawMessage') looks like it might be swapped with the 3rd, 'messageDmarc' (passed to 'result')
4b52cc100a41ac62f493	clang-tidy	readability-suspicious-call-argument	hmailserver/source/Server/Common/Util/DomainReports.cpp:1925	1st argument 'raw' (passed to 'rawMessage') looks like it might be swapped with the 4th, 'messageFrom' (passed to 'fromDomain')
b05881d041970b151231	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/DomainReports.cpp:1946	uninitialized record type: 'fresh'
55e06a8fb09fe076e49b	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Util/FolderManipulationLock.cpp:34	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
4f4f961e2dc17ea7042a	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/GUIDCreator.cpp:47	the value returned by this function should not be disregarded; neglecting it may lead to errors
cae10107d55557b1a42d	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/GUIDCreator.cpp:61	the value returned by this function should not be disregarded; neglecting it may lead to errors
bc6e645f873b46e9805c	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:402	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'
387ae5bcccddff51783e	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:490	uninitialized record type: 'parts'
447fead438c98c582bb5	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:504	uninitialized record type: 'parts'
d52c44443a39648f32b5	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:939	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
1b487601b6cd1e69dd95	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Util/GeoIpDatabase.cpp:674	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
c7b1b9a30d3718e0da8b	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/GeoIpDatabase.cpp:826	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'
6740bb26225ea343edfe	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/Hashing/HashCreator.cpp:38	the value returned by this function should not be disregarded; neglecting it may lead to errors
7322d36c9e14140587db	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/Hashing/HashCreator.cpp:292	performing an implicit widening conversion to type 'unsigned long long' of a multiplication performed in type 'int'
8dbdcab8e441d96e9f82	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/Hashing/HashCreator.cpp:345	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
bec129f79a34ebf6db11	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/Hashing/HashCreator.cpp:346	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
e3f2e12688046a2d27aa	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/Hashing/HashCreator.cpp:347	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
d5c4b6ab3bfb8e5a1c95	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/Hashing/HashCreator.cpp:408	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
3d12c60a6fb31018e3af	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/Hashing/HashCreator.cpp:417	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
ffecb2ed8ffe1b940f6c	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/Hashing/HashCreator.cpp:418	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
18975f10344b8bfeb4f5	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/Hashing/HashCreator.cpp:451	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
c172dac1add4925a9442	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/Hashing/HashCreator.cpp:452	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
25e786bfd9d97448b83f	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/Hashing/HashCreator.cpp:453	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
a24e8009a10f81078543	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/HttpServer.cpp:157	uninitialized record type: 'information'	Triaged 26 September 2026: every field is assigned before it is read - a record filled field by field from a row or the file before it is kept, a system structure filled by the call it is passed to, a table its constructor fills.
29a7d3f6336fc64293eb	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/HttpServer.cpp:261	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
f29012b0b8360301cd80	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/HttpServer.cpp:1073	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
75fff00b88aaa6d831ed	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/HttpServer.cpp:1087	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
db11768357072c64f7b7	clang-tidy	bugprone-exception-escape	hmailserver/source/Server/Common/Util/HttpServer.cpp:1161	an exception may be thrown in function '~HttpServer' which should not throw exceptions
38aa90a1283668ec9e6e	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/HttpServer.cpp:1185	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
c4f825c5c847b876bd65	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/HttpServer.cpp:1198	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
3237aaf48e2f0010a73a	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/HttpServer.cpp:1203	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
5fc64f71d08d10bef617	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/HttpServer.cpp:1205	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
b8253ebf1c0a6c092362	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/HttpServer.cpp:1207	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
34a167947882910ef815	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/HttpServer.cpp:1321	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
8117f946b0eecb5a4901	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/HttpServer.cpp:1434	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
db10d7ba1c9256b1bdcf	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/HttpServer.h:99	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'
2bd3600a785a37cadc59	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/HttpServer.h:135	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
4421cba6e24b5f1d6624	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/HttpServer.h:137	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
309cfc808cb71d287f34	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/HttpsClient.cpp:76	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
4fa5b70a2119dc747676	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/HttpsClient.cpp:306	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
215ecf53733629a657cf	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/HttpsClient.cpp:665	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
a68edbd4bc937efd5f78	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/HttpsClient.cpp:1074	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)	Triaged 26 September 2026: Boost.Asio's error_code overloads - the error is in the argument, checked after open, bind and set_option, and ignored on close on purpose.
78852e19c4f457cc63f6	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/HttpsClient.cpp:1198	performing an implicit widening conversion to type 'size_type' (aka 'unsigned long') of a multiplication performed in type 'int'
fa999e1e0b939b0a8167	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/HttpsClient.cpp:1399	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
0a24f63740405b5e3c12	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/HttpsClient.h:59	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'
685dd2e768373b032104	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/HttpsClient.h:80	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
fa7f9e5c0065b3ecab42	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/HttpsClient.h:98	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
b141b49f39ce2d27e3af	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/ICalendar.cpp:445	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'
5f16b37d80f3621aab5a	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/ICalendar.cpp:445	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'
ae81168fefc0fd18c44b	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/ICalendar.cpp:578	uninitialized record type: 't'
659e6766d40b42d74526	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/ICalendar.cpp:1549	uninitialized record type: 'day'
b9625de27c19e37de132	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/ICalendar.cpp:1778	uninitialized record type: 'own'
1f8b499630e95007234c	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/Imip.cpp:40	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'
d256caac4585a0812665	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/InboundWebhooks.cpp:72	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
4cb993f52248dce8f5d9	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/InboundWebhooks.cpp:130	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
8f931ca6189b1dd351a5	clang-tidy	bugprone-signed-char-misuse	hmailserver/source/Server/Common/Util/InboundWebhooks.cpp:714	'signed char' to 'unsigned int' conversion; consider casting to 'unsigned char' first. (also cert-str34-c)	Triaged 26 September 2026: compared with ASCII only, where a byte above 0x7F matches nothing it should not; or read as unsigned and refused at 0x7F and above; or a wchar_t, which AppendUtf8 turns into U+FFFD when out of range.
9b7e46aa1dfdc5089fae	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/IniFile.cpp:382	the value returned by this function should not be disregarded; neglecting it may lead to errors
9f36d00c88ef7c2f2f6a	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/IniFile.cpp:518	uninitialized record type: 'replacement'
9635fed1cee9db2c6643	clang-tidy	concurrency-mt-unsafe	hmailserver/source/Server/Common/Util/IniFile.cpp:1033	function is not thread safe
7d47ecbbcfda515a4a55	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/JsonDocument.cpp:52	the value returned by this function should not be disregarded; neglecting it may lead to errors
1b07c46a80512193f518	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/ListArchive.cpp:40	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'
3ffb440e13b2dfe5bde6	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/ListArchive.cpp:45	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'
4a2a90af914daab2058c	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/ListArchive.cpp:743	uninitialized record type: 'local'
315c4ca65fa86f200554	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/ListManager.cpp:97	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
372ff2355a9024f0a56b	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/MailboxCrypto.cpp:79	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead	Triaged 26 September 2026: atoi over digits checked first, or where the 0 of a bad number is what the caller wants (a missing SEQUENCE; a limit clamped to 1-1000).
1af4b08a7dcf8f72fde5	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/MailboxCrypto.cpp:86	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
6a4fc9d828df6ed11e36	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/MailboxKeys.cpp:95	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
efb2555501a38790b9b8	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Util/MailboxKeys.cpp:638	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether	Triaged 26 September 2026: deliberate - a destructor, or a best-effort step (a cache invalidated, a drain woken, a decision dropped, an optional PST part) that must not throw into its caller, most with the comment that says so.
ccc0d29596ad94992a13	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/MessageTrace.cpp:309	uninitialized record type: 'cutoffTm'
8d4abe09ae744f65fff9	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Util/MetricsServer.cpp:897	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
9c27c36ecaea3f3accdf	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Util/MetricsServer.cpp:937	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
1216bd3613d92cfae359	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Util/MetricsServer.cpp:1989	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
4865b0f9d9dad1b3ae18	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/MigrationImapClient.cpp:39	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
9bb4b52f9ccc116c8f4a	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/MigrationImapClient.cpp:43	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'
75ae4747054562cca112	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/MigrationImapClient.cpp:280	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
9fecec3ea79e91b02356	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/MigrationImapClient.cpp:281	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
3d1b290af008173dc921	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/MigrationImapClient.cpp:328	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
c7dbd20d208d376af9e0	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Util/MigrationImapClient.cpp:396	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
70d9bf94a6945a7ea556	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/MigrationSources.cpp:77	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
1607f2aaf240aba4ba42	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/MigrationSources.cpp:78	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
903b65e40b1da2d7f790	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/MigrationSources.cpp:390	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'
2b4a0e29dfdf92f20235	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/MigrationSources.cpp:444	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'
0986f594e86169585659	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/MigrationSources.cpp:544	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'
d7b4b12e443c74f56640	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/OAuth2TokenValidator.cpp:51	the value returned by this function should not be disregarded; neglecting it may lead to errors
f767737eedd9b2cb1273	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/OAuth2TokenValidator.cpp:487	result of multiplication in type 'int' is used as a pointer offset after an implicit widening conversion to type 'ptrdiff_t'
c52ca98a5f2ce95ff6d9	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/ObjectStoreSignature.cpp:249	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
f29000a924bc3eb3103e	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/ObjectStoreSignature.cpp:265	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
da955fbfc0ea6c9dbd33	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/ObjectStoreSignature.cpp:370	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
dedd2f27c1368f8aea4c	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/OidcSignIn.cpp:45	performing an implicit widening conversion to type 'const time_t' (aka 'const long') of a multiplication performed in type 'int'
cc1f28f1b83ef9a5f04a	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/OidcSignIn.cpp:216	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'
aa1f26098529ffc7184c	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/OidcSignIn.cpp:569	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'
2f6fd0c64372850765ba	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/OpenPgpKeyStore.cpp:69	the value returned by this function should not be disregarded; neglecting it may lead to errors
73bce17cd8ce82ba9f0b	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/OpenPgpRing.cpp:75	the value returned by this function should not be disregarded; neglecting it may lead to errors
bcdf61a9d88c1b0edbe3	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/OpenPgpRing.cpp:609	performing an implicit widening conversion to type 'const time_t' (aka 'const long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
877f15e44dff0cbae32b	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/OpenPgpRing.h:88	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'
5543598d24b1821fb596	clang-tidy	readability-suspicious-call-argument	hmailserver/source/Server/Common/Util/OpenPgpWriter.cpp:1236	1st argument 'out' (passed to 'octets') looks like it might be swapped with the 2nd, 'body' (passed to 'out')
d891741944e4977fb688	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/OpenPgpWriter.cpp:1443	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
1e5c9133b63fc24946f2	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/OpenPgpWriter.cpp:1893	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'
b3d68beb5652f07f70cb	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/OpenPgpWriter.cpp:1894	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'
a0d57033945fd4e89267	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/OpenPgpWriter.cpp:1903	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'
f6dcd0c77f22db959327	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/OpenPgpWriter.cpp:1904	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'
d17c328f41ea88effda4	clang-tidy	bugprone-signed-char-misuse	hmailserver/source/Server/Common/Util/OrganisationCa.cpp:437	'signed char' to 'unsigned int' conversion; consider casting to 'unsigned char' first. (also cert-str34-c)
022c32bf056765f561b8	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/OtelExportChannel.cpp:72	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
edda5ebfa58a1162006e	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/OtelExportChannel.cpp:127	uninitialized record type: 'timeout'	Triaged 26 September 2026: every field is assigned before it is read - a record filled field by field from a row or the file before it is kept, a system structure filled by the call it is passed to, a table its constructor fills.
31ab4e64f1bc05094ee4	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/OutboundOAuth2TokenClient.cpp:36	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
38065b0e5d1f43fcfff4	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/OutboundOAuth2TokenClient.cpp:125	the value returned by this function should not be disregarded; neglecting it may lead to errors
cb089b34d5ff8dff726a	clang-tidy	bugprone-inc-dec-in-conditions	hmailserver/source/Server/Common/Util/Parsing/StringParser.cpp:360	incrementing and referencing a variable in a complex condition can cause unintended side-effects due to C++'s order of evaluation, consider moving the modification outside of the condition to avoid mi
86e98b417471532bfa10	clang-tidy	bugprone-inc-dec-in-conditions	hmailserver/source/Server/Common/Util/Parsing/StringParser.cpp:363	incrementing and referencing a variable in a complex condition can cause unintended side-effects due to C++'s order of evaluation, consider moving the modification outside of the condition to avoid mi
fd215a6a9a4229715fde	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/PasswordBreachCheck.cpp:190	'atol' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
54ef386a384e30b40a71	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/PasswordBreachCheck.h:83	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
bf1a7d31836689f8dec8	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/PasswordHistory.cpp:197	uninitialized record type: 'cutoffTm'
f215eaa813cc3176ba5e	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/PersonExport.cpp:118	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
67f8bd4e1a6e9b8a0ca4	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/PersonExport.cpp:613	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'
98f6724263ed5f8d635a	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Util/Pop3LoginDelay.cpp:71	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
40887d9415b891cbb803	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/ProtectedMessages.cpp:55	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'
690853b3e2343f4854c7	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/ProtectedMessages.cpp:56	performing an implicit widening conversion to type 'const time_t' (aka 'const long') of a multiplication performed in type 'int'
78f9da5f1b316106dd46	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/PstImportPath.cpp:51	uninitialized record type: 'status'	Triaged 26 September 2026: every field is assigned before it is read - a record filled field by field from a row or the file before it is kept, a system structure filled by the call it is passed to, a table its constructor fills.
ade58f89f8b3f3df8d12	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/PushNotifier.cpp:55	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'
6affaaf196ba1efcb73e	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/PushNotifier.cpp:69	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'
b6e921ebdcb71ba29f8e	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/PushNotifier.cpp:79	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
1ef05e3b7b935f5d845f	clang-tidy	bugprone-signed-char-misuse	hmailserver/source/Server/Common/Util/PushSubscriptions.cpp:233	'signed char' to 'unsigned int' conversion; consider casting to 'unsigned char' first. (also cert-str34-c)	Triaged 26 September 2026 for the 6.3.4 release gate (.gitlab/security-exceptions.yml), the same line in the same file then: In PushSubscriptions::Save, endpoint is a String copied from subscription.endpoint (212), so endpoint[i] is a whole wchar_t, which the rule matches as a signed character type. The cast to unsigned int keeps every bit, and a negative 32-bit wchar_t becomes a value above 0x7E and is refused by `unit < 0x21 || unit > 0x7E`. Casting through unsigned char would truncate, U+0141 to 0x41 for example, and let a non-ASCII character reach the push request line.
acc1743947410ae82469	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RateLimiter.cpp:86	performing an implicit widening conversion to type 'const unsigned long long' of a multiplication performed in type 'int'
6fc90714eb753505db19	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/RateLimiter.cpp:312	uninitialized record type: 'attributes'
3601bfddc9c085912951	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Util/RateLimiter.cpp:887	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
3a4c2121b71829fccb52	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/RateLimiter.cpp:1186	uninitialized record type: 'attributes'
b4e7bcb712e98e986d5d	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/ReaderOAuth.cpp:54	performing an implicit widening conversion to type 'const time_t' (aka 'const long') of a multiplication performed in type 'int'
2249355486993578bd13	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/ReaderOAuth.cpp:151	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'
2887989a5a058e441d08	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/ReaderOAuth.cpp:506	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'
c3f35cc23c0c25ab40ca	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/ReputationWatch.cpp:189	the value returned by this function should not be disregarded; neglecting it may lead to errors
e26ebbfa46025ade95f3	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/ReputationWatch.h:280	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'
0543e026bf41b01665df	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Util/ResourceBooking.cpp:2442	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether	Triaged 26 September 2026: deliberate - a destructor, or a best-effort step (a cache invalidated, a drain woken, a decision dropped, an optional PST part) that must not throw into its caller, most with the comment that says so.
4f3e19284210b2766634	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Util/ResourceBooking.cpp:3026	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether	Triaged 26 September 2026: deliberate - a destructor, or a best-effort step (a cache invalidated, a drain woken, a decision dropped, an optional PST part) that must not throw into its caller, most with the comment that says so.
64e1d2ec9b084bbb1bab	clang-tidy	readability-suspicious-call-argument	hmailserver/source/Server/Common/Util/ResourceBooking.cpp:3165	2nd argument 'attendee' (passed to 'address') looks like it might be swapped with the 5th, 'delegateAddress' (passed to 'sentBy')	Triaged 26 September 2026: the arguments are in the order the callee names them - a move made back after a failure goes new to old on purpose, SPF takes the connecting address as the sender's IP, a delegate is the reply's SENT-BY.
5fcade57692bb9a9a037	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiAccountResources.cpp:914	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'
edd3f213c29ae430064d	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiAudit.cpp:205	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
b8a997b76ea919da7590	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiAudit.cpp:209	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
352b88709c63d14b8c7d	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiAudit.cpp:359	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
958150e1f4f189ccdd67	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiBounces.cpp:86	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
36120d66b89f93e099d3	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiComplaints.cpp:68	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
ebfd948bfa0197e7bd7d	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiContacts.cpp:147	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
ac6d931b939285b287b2	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiDirectory.cpp:378	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
aad78cb8d87d3e02e5b4	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiDiscovery.cpp:78	performing an implicit widening conversion to type 'const unsigned long long' of a multiplication performed in type 'int'
ed3bd3be9005a43caeca	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiDiscovery.cpp:612	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
389e99c38f7a65009f90	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiDiscovery.cpp:617	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
73947f4a16e122d1a671	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiDiscovery.cpp:625	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
8e2c73b47a97934a6033	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiDiscovery.cpp:630	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
c2ae269ce366ab3424cd	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiDomainReports.cpp:45	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
79d1bd7e36065232f245	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiFiles.cpp:65	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'
f5527852437d6826c2f7	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiFiles.cpp:67	performing an implicit widening conversion to type 'const ULONGLONG' (aka 'const unsigned long') of a multiplication performed in type 'int'
d597fc19aa490f6cb56b	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/RestApiFiles.cpp:151	the value returned by this function should not be disregarded; neglecting it may lead to errors
48f716f4264d2014d2ad	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/RestApiFiles.cpp:320	uninitialized record type: 'policy'
10788dd71498092648e4	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiInboundWebhooks.cpp:581	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead	Triaged 26 September 2026: atoi over digits checked first, or where the 0 of a bad number is what the caller wants (a missing SEQUENCE; a limit clamped to 1-1000).
d496614e45ec0483512a	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/RestApiMailingLists.cpp:257	uninitialized record type: 'utc'
77ffa67154f673f29137	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiMessageReplies.cpp:349	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'
74fa5703cd1703ea2ae8	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiMessageReplies.cpp:428	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
8ba36f9e36eaee00279a	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/RestApiOffline.cpp:112	uninitialized record type: 'moment'
361ec43f08542f92eda9	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiOffline.cpp:281	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
8047f819f7029591760e	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiOpenPgp.cpp:73	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
889529ea1766d9f9b98e	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/RestApiOpenPgpKeys.cpp:127	the value returned by this function should not be disregarded; neglecting it may lead to errors
187089441c4aa5739c94	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiOperator.cpp:191	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
1a9ec2ca8ff97b5232e2	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiPreferences.cpp:50	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
2ab295350b65c8063e0d	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/RestApiProtectedMessages.cpp:102	the value returned by this function should not be disregarded; neglecting it may lead to errors
0b00e73f54565d3e7842	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiProtectedMessages.cpp:233	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'
3ddf99ec68b337585dd9	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiProtectedMessages.cpp:266	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'
f07cc99b42b37afc8a61	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiProtectedMessages.cpp:517	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'
24da77e8dd6218c877b9	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiPush.cpp:56	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
79245a71b2d5fc4e734d	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiReports.cpp:200	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
d856f6d464f26b4e8960	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiReports.cpp:201	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
2fc2f4ad01d5bd3b3e5d	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiReports.cpp:202	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
3c12dbc98c671948a7b8	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiReports.cpp:852	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'
04f4348608575322bb59	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiReports.cpp:914	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'
e6c079fdc1c1da708089	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiReports.cpp:932	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'
d3ba9684454703ee5d47	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiReports.cpp:990	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'
550cfa8d46819ab5abae	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiReports.cpp:1136	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'
17893a13e1ffc4f4596b	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiReports.cpp:1468	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
0482c78d3aea187e97a5	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/RestApiRules.cpp:234	the value returned by this function should not be disregarded; neglecting it may lead to errors
bfcaf4ea971fd9e7828e	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/RestApiRules.cpp:263	the value returned by this function should not be disregarded; neglecting it may lead to errors
785e3d6e2ee0910bd798	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/Common/Util/RestApiRules.cpp:446	switch has 2 consecutive identical branches
130884b79d28bb0b8cf8	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/Common/Util/RestApiRules.cpp:449	switch has 2 consecutive identical branches
22fabd63f9189dfc4c21	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiSandbox.cpp:62	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
21ca6d49b50ad4024de8	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiScheduled.cpp:52	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'
66115244159a3a44b704	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiScheduled.cpp:53	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
9d6abd7a0ac113183ce8	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiServer.cpp:205	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
dc305cd71708230578ae	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiServer.cpp:209	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
830ed83887f3f4023517	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiServer.cpp:217	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
c942dde5f2a1def67739	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiServer.cpp:308	performing an implicit widening conversion to type 'const ULONGLONG' (aka 'const unsigned long') of a multiplication performed in type 'int'
cb91663be5c689d2487f	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/RestApiServer.cpp:547	the value returned by this function should not be disregarded; neglecting it may lead to errors
7349794c62d2087a54ca	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiServer.cpp:643	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
c0f39116c70bac473043	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/RestApiServer.cpp:1767	uninitialized record type: 'entry'
514601b3f196203ba218	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiServer.cpp:4794	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
0b6729aa91614fb3968a	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/Common/Util/RestApiServer.cpp:7387	switch has 3 consecutive identical branches
638e85b07df79686146e	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/Common/Util/RestApiServer.cpp:8177	switch has 2 consecutive identical branches
0a7000c5671e42d73a62	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/Common/Util/RestApiServer.cpp:8601	switch has 2 consecutive identical branches
d8bc72fa202cee4d193f	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/Common/Util/RestApiServer.cpp:8968	switch has 2 consecutive identical branches
cfdb8e383f2c9bedcee0	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/Common/Util/RestApiServer.cpp:8998	switch has 3 consecutive identical branches	Triaged 26 September 2026: different conditions that end the same way, on purpose.
7bdb33b2d053f5f2ef29	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/Common/Util/RestApiServer.cpp:9038	switch has 2 consecutive identical branches
8608dc9f537f6db7b8ae	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/Common/Util/RestApiServer.cpp:9116	switch has 2 consecutive identical branches
a9ab2f53e63f9dc071d5	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiServer.cpp:12190	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
59ce48df5bd44b4b4a27	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiServer.cpp:12204	performing an implicit widening conversion to type 'const std::streamoff' (aka 'const long') of a multiplication performed in type 'int'
76147edfa01face0ab97	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiServer.cpp:12772	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
32c6579c25032d143662	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/Common/Util/RestApiServer.cpp:12888	switch has 2 consecutive identical branches
7d80bbbeea327f768209	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiServer.cpp:15246	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
e826e88b39c60a5a2ee0	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiServer.cpp:15476	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
5502c550a559ee837064	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/RestApiServer.cpp:15542	uninitialized record type: 'one'	Triaged 26 September 2026: every field is assigned before it is read - a record filled field by field from a row or the file before it is kept, a system structure filled by the call it is passed to, a table its constructor fills.
0857775bdf2831e65530	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiServer.cpp:16343	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
8e0caa5af530a71a5e07	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/RestApiServer.cpp:16756	uninitialized record type: 'pick'	Triaged 26 September 2026: every field is assigned before it is read - a record filled field by field from a row or the file before it is kept, a system structure filled by the call it is passed to, a table its constructor fills.
eea7f11792a5d7934e75	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiServer.cpp:17014	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'
eaff86bbf42a3ab42367	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiServer.cpp:17253	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'
1a91f48de74a45b213b5	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiServer.cpp:17254	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'
e64b9cbc9e0a3645744b	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/RestApiServer.cpp:19380	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'
dbc2197e782910bfa378	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiSessionFollow.cpp:167	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
ffab7fd0d8571f044eb7	clang-tidy	bugprone-signed-char-misuse	hmailserver/source/Server/Common/Util/RestApiSettings.cpp:1143	'signed char' to 'unsigned int' conversion; consider casting to 'unsigned char' first. (also cert-str34-c)	Triaged 26 September 2026: compared with ASCII only, where a byte above 0x7F matches nothing it should not; or read as unsigned and refused at 0x7F and above; or a wchar_t, which AppendUtf8 turns into U+FFFD when out of range.
31a4740122f4ebbef419	clang-tidy	bugprone-signed-char-misuse	hmailserver/source/Server/Common/Util/RestApiSettings.cpp:1199	'signed char' to 'unsigned int' conversion; consider casting to 'unsigned char' first. (also cert-str34-c)	Triaged 26 September 2026: compared with ASCII only, where a byte above 0x7F matches nothing it should not; or read as unsigned and refused at 0x7F and above; or a wchar_t, which AppendUtf8 turns into U+FFFD when out of range.
9129333c042556d26d25	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/RestApiSmime.cpp:159	the value returned by this function should not be disregarded; neglecting it may lead to errors
edcb51be6cb711331c92	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiSpamTraps.cpp:115	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
dfac76620ee56a7ac5c7	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/RestApiWebhooks.cpp:413	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
2e76a9d4d97b081859f9	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/RestApiZeroAccess.cpp:80	the value returned by this function should not be disregarded; neglecting it may lead to errors
513c9163e8edac54c379	clang-tidy	readability-suspicious-call-argument	hmailserver/source/Server/Common/Util/RestrictedDelivery.cpp:254	1st argument 'current' (passed to 'pattern') looks like it might be swapped with the 2nd, 'patternRefusal' (passed to 'refusal')
54587c6a584f481f9765	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/SamlSignIn.cpp:235	uninitialized record type: 'parts'
f23b1055e8cc9577eff5	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/SamlSignIn.cpp:240	the value returned by this function should not be disregarded; neglecting it may lead to errors
a35fe84493de105beed7	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/SamlSignIn.cpp:253	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'
69e744b1f492afae4121	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/SamlSignIn.cpp:253	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'
415a6bebb6a506425742	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/SamlSignIn.cpp:589	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'
71c4fdc30ad1b8cb5a3d	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/SamlSignIn.cpp:589	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'
5f0b1e82457aa3065a51	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/SealedMessage.cpp:277	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
2ff82c59d1ba24d54172	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/SenderAddresses.cpp:44	performing an implicit widening conversion to type 'const time_t' (aka 'const long') of a multiplication performed in type 'int'
1026e98d0f6216b83cd9	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/ServiceAccount.cpp:79	performing an implicit widening conversion to type 'size_type' (aka 'unsigned long') of a multiplication performed in type 'int'	Triaged 26 September 2026: a product of constants, or of values bounded first (two-digit clock fields; a PST transition held to 1601-9999 and 23:59:59), far inside int - nothing overflows before the widening.
4904ed470311a538d47a	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/SigstoreVerifier.cpp:604	the value returned by this function should not be disregarded; neglecting it may lead to errors	Triaged 26 September 2026: the return of snprintf or sprintf_s into a buffer sized for what it formats, of gmtime_s into a zeroed struct tm, or of a diagnostic fprintf, fputs or fflush to stderr or stdout - no failure there has anything to change.
ae45ec5f4f6ca071af2f	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/SigstoreVerifier.cpp:786	performing an implicit widening conversion to type 'size_type' (aka 'unsigned long') of a multiplication performed in type 'int'
6e278d88f633ac94045f	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/SigstoreVerifier.cpp:793	performing an implicit widening conversion to type 'size_type' (aka 'unsigned long') of a multiplication performed in type 'int'
e10c7833d91bc2277e12	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/SigstoreVerifier.cpp:829	performing an implicit widening conversion to type 'size_type' (aka 'unsigned long') of a multiplication performed in type 'int'
abaa522dd0eae822f581	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/SigstoreVerifier.cpp:1087	the value returned by this function should not be disregarded; neglecting it may lead to errors
9da226789934ff504cf9	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/SigstoreVerifier.cpp:1089	the value returned by this function should not be disregarded; neglecting it may lead to errors
712647f0d9df1b71de8b	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/SnmpAgent.cpp:799	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)	Triaged 26 September 2026: Boost.Asio's error_code overloads - the error is in the argument, checked after open, bind and set_option, and ignored on close on purpose.
98923cc4a9bbedb500a8	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/SnmpAgent.cpp:802	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)	Triaged 26 September 2026: Boost.Asio's error_code overloads - the error is in the argument, checked after open, bind and set_option, and ignored on close on purpose.
71c4f4e720f1e7f6b5ba	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/SnmpAgent.cpp:805	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)	Triaged 26 September 2026: Boost.Asio's error_code overloads - the error is in the argument, checked after open, bind and set_option, and ignored on close on purpose.
306dc16fb97f967ebd40	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/SnmpAgent.cpp:810	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)	Triaged 26 September 2026: Boost.Asio's error_code overloads - the error is in the argument, checked after open, bind and set_option, and ignored on close on purpose.
f71ca8315620647acdae	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/SnmpAgent.cpp:813	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)	Triaged 26 September 2026: Boost.Asio's error_code overloads - the error is in the argument, checked after open, bind and set_option, and ignored on close on purpose.
fee7826e3a13e3aa37c4	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/SnmpAgent.cpp:816	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)	Triaged 26 September 2026: Boost.Asio's error_code overloads - the error is in the argument, checked after open, bind and set_option, and ignored on close on purpose.
f4ad34bdf11c1e53c79c	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/SnmpAgent.cpp:826	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)	Triaged 26 September 2026: Boost.Asio's error_code overloads - the error is in the argument, checked after open, bind and set_option, and ignored on close on purpose.
124124e21b24070498e1	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/SnmpAgent.cpp:829	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)	Triaged 26 September 2026: Boost.Asio's error_code overloads - the error is in the argument, checked after open, bind and set_option, and ignored on close on purpose.
34ef80bd26730969db46	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/SnmpAgent.cpp:836	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)	Triaged 26 September 2026: Boost.Asio's error_code overloads - the error is in the argument, checked after open, bind and set_option, and ignored on close on purpose.
5133da08188242036fd8	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/SnmpAgent.cpp:848	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)	Triaged 26 September 2026: Boost.Asio's error_code overloads - the error is in the argument, checked after open, bind and set_option, and ignored on close on purpose.
73dcaee696ccdb6b3728	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/SnmpAgent.cpp:987	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)	Triaged 26 September 2026: Boost.Asio's error_code overloads - the error is in the argument, checked after open, bind and set_option, and ignored on close on purpose.
5f49c2f2aef815324396	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Util/SnmpAgent.cpp:1010	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether	Triaged 26 September 2026: deliberate - a destructor, or a best-effort step (a cache invalidated, a drain woken, a decision dropped, an optional PST part) that must not throw into its caller, most with the comment that says so.
24d6a0bc3ae1efeb5fb0	clang-tidy	bugprone-misplaced-widening-cast	hmailserver/source/Server/Common/Util/SnmpTester.cpp:1162	either cast from 'int' to 'size_t' (aka 'unsigned long') is ineffective, or there is loss of precision before the conversion	Triaged 26 September 2026: a sum or product of small non-negative ints (a tester's counts, an SNMP cipher's output lengths) - nothing is lost before the cast.
7a14fa9e505d0d1c1805	clang-tidy	bugprone-misplaced-widening-cast	hmailserver/source/Server/Common/Util/SnmpTester.cpp:1261	either cast from 'int' to 'size_t' (aka 'unsigned long') is ineffective, or there is loss of precision before the conversion	Triaged 26 September 2026: a sum or product of small non-negative ints (a tester's counts, an SNMP cipher's output lengths) - nothing is lost before the cast.
63004d145f6ec2368781	clang-tidy	bugprone-signed-char-misuse	hmailserver/source/Server/Common/Util/StdString.h:847	'signed char' to 'unsigned long' conversion; consider casting to 'unsigned char' first. (also cert-str34-c)
1aaeba91c790675dbf0b	clang-tidy	cert-oop54-cpp	hmailserver/source/Server/Common/Util/StdString.h:2097	operator=() does not handle self-assignment properly
486fe0fc1d12dcd41c4d	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/SyslogSink.cpp:66	uninitialized record type: 'deadline'
0215e1e464607c47eb92	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/SyslogSink.cpp:112	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)	Triaged 26 September 2026: Boost.Asio's error_code overloads - the error is in the argument, checked after open, bind and set_option, and ignored on close on purpose.
bf8372eb0229a77f6cb6	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/SyslogSink.cpp:827	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
5056f72c3c0db2afcf4a	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/SyslogSink.cpp:834	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
e68c4d796eed430edfab	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/Common/Util/SyslogSink.cpp:837	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
f61b99e1023698aa7a82	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/SyslogSink.cpp:854	uninitialized record type: 'details'
8e7d373d77d6a1380e33	clang-tidy	concurrency-mt-unsafe	hmailserver/source/Server/Common/Util/SyslogSink.cpp:861	function is not thread safe
32d078fc285269b6af0e	clang-tidy	concurrency-mt-unsafe	hmailserver/source/Server/Common/Util/SyslogSink.cpp:861	function is not thread safe
4af0b0d0fe098575201e	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/SyslogSink.cpp:883	uninitialized record type: 'deadline'
56f1316ee514f3c246a1	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/Time.cpp:104	uninitialized record type: 'local_parts'
e829190f1a406510e3ad	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/Common/Util/Time.cpp:200	repeated branch body in conditional chain
3f5a028e2d434f750f25	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/Common/Util/Time.cpp:204	repeated branch body in conditional chain
6145174b925fc167b99b	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/Common/Util/Time.cpp:208	repeated branch body in conditional chain
115ac26f85be70efd2f7	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/Common/Util/Time.cpp:214	repeated branch body in conditional chain
afcc80dda9104d367c7b	cppcheck	identicalConditionAfterEarlyExit	hmailserver/source/Server/Common/Util/Time.cpp:859	Identical condition 'dt6<dt5', second condition is always false
217ef6e0df6ebe4e72ab	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/Time.cpp:983	performing an implicit widening conversion to type 'time_t' (aka 'long') of a multiplication performed in type 'int'
aa47fb11078374ef91cc	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/TlsRptStore.cpp:26	the value returned by this function should not be disregarded; neglecting it may lead to errors
1c2a29b689fc8142370b	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/TokenIntrospection.cpp:192	performing an implicit widening conversion to type 'size_type' (aka 'unsigned long') of a multiplication performed in type 'unsigned int'
90d98feae9891ecdf1db	clang-tidy	bugprone-signed-char-misuse	hmailserver/source/Server/Common/Util/Unicode.cpp:348	'signed char' to 'unsigned int' conversion; consider casting to 'unsigned char' first. (also cert-str34-c)	Triaged 26 September 2026 for the 6.3.4 release gate (.gitlab/security-exceptions.yml), the same line in the same file then: In Unicode::IsWidenedUtf8, text is a String = CStdStr<wchar_t> (StdString.h:4125), so text[i] is a wchar_t code unit. The check matches any signed character type, which includes Linux's 32-bit signed wchar_t, and its message always says 'signed char'. Casting through unsigned char would truncate the unit, while the whole unit as unsigned int is what `unit > 0xFF` needs; a negative wchar_t becomes a value above 0x7FFFFFFF and returns false, the right answer.
5601578f58eb8b7351f4	clang-tidy	bugprone-signed-char-misuse	hmailserver/source/Server/Common/Util/Unicode.cpp:361	'signed char' to 'unsigned int' conversion; consider casting to 'unsigned char' first. (also cert-str34-c)	Triaged 26 September 2026 for the 6.3.4 release gate (.gitlab/security-exceptions.yml), the same line in the same file then: text[i] is a wchar_t, which the rule matches as a signed character type, not a signed char byte. This loop runs only after the loop at 339-346 has returned false for any unit above 0xFF, so every value here is 0..0xFF and the cast is exact.
8ead7bf13b595a24925f	clang-tidy	bugprone-signed-char-misuse	hmailserver/source/Server/Common/Util/Unicode.cpp:404	'signed char' to 'unsigned int' conversion; consider casting to 'unsigned char' first. (also cert-str34-c)	Triaged 26 September 2026 for the 6.3.4 release gate (.gitlab/security-exceptions.yml), the same line in the same file then: text[i + k] is a wchar_t that the first loop (339-346) has proven to be 0..0xFF. i + k stays below length because 392 returns false when i + trail >= length. The value is compared exactly against 0x80..0xBF, or the narrower range for the first trail byte.
63fed1449d52ea2571ad	clang-tidy	bugprone-signed-char-misuse	hmailserver/source/Server/Common/Util/Unicode.cpp:448	'signed char' to 'unsigned int' conversion; consider casting to 'unsigned char' first. (also cert-str34-c)	Triaged 26 September 2026 for the 6.3.4 release gate (.gitlab/security-exceptions.yml), the same line in the same file then: In Unicode::ToUtf8, text[i] is a wchar_t, and the whole unit as unsigned int is what the 0xD800-0xDFFF tests need; casting through unsigned char would truncate 0xD800 to 0x00 and break the repair. A negative Linux wchar_t becomes a value above 0x7FFFFFFF, is not a surrogate and passes to WideToMultiByte, which leaves the result empty on failure (455-456).
fcf8bd4b8e9342479037	clang-tidy	bugprone-signed-char-misuse	hmailserver/source/Server/Common/Util/Unicode.cpp:474	'signed char' to 'unsigned int' conversion; consider casting to 'unsigned char' first. (also cert-str34-c)	Triaged 26 September 2026 for the 6.3.4 release gate (.gitlab/security-exceptions.yml), the same line in the same file then: In Unicode::HasUnpairedSurrogate, text[i] is a wchar_t code unit (String = CStdStr<wchar_t>), and the surrogate-range comparisons (0xD800-0xDBFF, 0xD800-0xDFFF) need the whole unit as unsigned int. A negative 32-bit value becomes a value above 0x7FFFFFFF, is not a surrogate and is correctly not counted. Casting through unsigned char would truncate the unit and be wrong.
2037c2b4d094d651d037	clang-tidy	bugprone-signed-char-misuse	hmailserver/source/Server/Common/Util/Unicode.cpp:478	'signed char' to 'unsigned int' conversion; consider casting to 'unsigned char' first. (also cert-str34-c)	Triaged 26 September 2026 for the 6.3.4 release gate (.gitlab/security-exceptions.yml), the same line in the same file then: text[i + 1] is a wchar_t, read only after `i + 1 < length` is checked on 469. The whole unit as unsigned int is compared exactly against 0xDC00-0xDFFF, so a negative or large value is simply not a low surrogate.
9370524b43ae1abd42ec	clang-tidy	bugprone-signed-char-misuse	hmailserver/source/Server/Common/Util/Unicode.cpp:551	'signed char' to 'unsigned int' conversion; consider casting to 'unsigned char' first. (also cert-str34-c)
c9b871ff80b77887f710	clang-tidy	concurrency-mt-unsafe	hmailserver/source/Server/Common/Util/UpdateChecker.cpp:101	function is not thread safe	getenv in EnvironmentValue_ reads HM_INSTALL_KIND and snapd's SNAP variables, which nothing in the process sets while it runs; accepted in .gitlab/security-exceptions.yml as its twin getenv("APPIMAGE") is.
686cf88c4e935f5bb2bf	clang-tidy	concurrency-mt-unsafe	hmailserver/source/Server/Common/Util/UpdateChecker.cpp:192	function is not thread safe
86613932ad4e3e421703	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/UpdateChecker.cpp:349	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
3a192c8062bf7b1284b5	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/Common/Util/UpdateChecker.cpp:759	uninitialized record type: 'parts'
38516019a3870be239c5	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/UpdateChecker.cpp:941	the value returned by this function should not be disregarded; neglecting it may lead to errors
f5d05d6c4fb2e0616522	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/UpdateDownloader.cpp:39	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'unsigned int'
559f32fab98fba3917de	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/UpdateDownloader.cpp:40	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'unsigned int'
3f56634816448466f355	clang-tidy	concurrency-mt-unsafe	hmailserver/source/Server/Common/Util/UpdateInstaller.cpp:157	function is not thread safe
98bf60e5211efa726a2c	clang-tidy	concurrency-mt-unsafe	hmailserver/source/Server/Common/Util/UpdateInstaller.cpp:454	function is not thread safe
b7db62aa30f750b9a8ef	clang-tidy	concurrency-mt-unsafe	hmailserver/source/Server/Common/Util/UpdateInstaller.cpp:493	function is not thread safe
62bcd81f5dbe65f9a1e6	clang-tidy	concurrency-mt-unsafe	hmailserver/source/Server/Common/Util/UpdateInstaller.cpp:930	function is not thread safe
d6bc0ac2aa0005b9e4da	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/UpdateWindow.cpp:45	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
8d9aedbe8646e49b7dba	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/UpdateWindow.cpp:46	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
e7d0755c05e510c11f81	clang-tidy	concurrency-mt-unsafe	hmailserver/source/Server/Common/Util/Utilities.cpp:263	function is not thread safe
69fb93bd043d7721a06d	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/VCard.cpp:449	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
2771a2307897148fc97b	clang-tidy	cert-err34-c	hmailserver/source/Server/Common/Util/VCard.cpp:639	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
452e4e6cf3654b07fb41	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/WebServicesServer.cpp:67	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
ecc65008931beb012a53	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Util/WebServicesServer.cpp:280	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
b8faa10f993bbe158c2e	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/Common/Util/WebServicesServer.cpp:429	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
1bf31db00401cb43ed02	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/WebhookManager.cpp:58	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
c54df2e813a72c870711	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/WebhookManager.cpp:138	the value returned by this function should not be disregarded; neglecting it may lead to errors
9a0696dd20f2b7fb4edb	clang-tidy	bugprone-misplaced-widening-cast	hmailserver/source/Server/Common/Util/XmlDocument.cpp:444	either cast from 'int' to 'unsigned long' is ineffective, or there is loss of precision before the conversion
e4b14500f7c7fa60843e	clang-tidy	bugprone-misplaced-widening-cast	hmailserver/source/Server/Common/Util/XmlDocument.cpp:446	either cast from 'int' to 'unsigned long' is ineffective, or there is loss of precision before the conversion
aa7971d3a2be765dce06	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/XmlDocument.cpp:1700	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
f4df35d139bf53da26a9	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/Common/Util/XmlDocument.h:170	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
55e0461b48a17b3b087c	clang-tidy	cert-err33-c	hmailserver/source/Server/Common/Util/ZeroAccess.cpp:71	the value returned by this function should not be disregarded; neglecting it may lead to errors
944d3f53f3f8e40c498b	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/ExternalFetcher/ExternalFetchManager.cpp:50	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
4780562cae32b3e7bdc1	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/ExternalFetcher/FetchAccountLock.cpp:35	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
895b3a9bf2f0bbd0714a	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/ExternalFetcher/FetchAccountLock.cpp:43	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
76a68012e632d4465b10	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/ExternalFetcher/IMAPClientConnection.cpp:79	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
42090ea38ee964179ca6	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/ExternalFetcher/POP3ClientConnection.cpp:86	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
17aed7583a27c2503dbe	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/IMAP/IMAPCommandAppend.cpp:62	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
18c3842ecf376e9ca983	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/IMAP/IMAPCommandAppend.cpp:71	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether	Triaged 26 September 2026: deliberate - a destructor, or a best-effort step (a cache invalidated, a drain woken, a decision dropped, an optional PST part) that must not throw into its caller, most with the comment that says so.
914deb2ae12a3b6a663d	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/IMAP/IMAPCommandIdle.cpp:38	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
3a8645c0c884da8cb829	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/IMAP/IMAPConnection.cpp:105	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
8af6edd9002658f58f99	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/IMAP/IMAPConnection.cpp:566	performing an implicit widening conversion to type 'const long long' of a multiplication performed in type 'int'
f7094675a687c089e01e	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/IMAP/IMAPNotificationClient.cpp:46	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
1d668dd6854a7f9b8ddc	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/IMAP/IMAPNotificationClient.cpp:116	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
10e30ff941ac49d01b5c	cppcheck	nullPointerRedundantCheck	hmailserver/source/Server/IMAP/IMAPStore.cpp:231	Either the condition 'pFolder' is redundant or there is possible null pointer dereference: pConnection->GetCurrentFolder().	Triaged 26 September 2026: STORE runs with a folder selected, so GetCurrentFolder() is not null there; the later check is defensive.
de23911c4abab3ef9125	cppcheck	nullPointerRedundantCheck	hmailserver/source/Server/IMAP/IMAPStore.cpp:232	Either the condition 'pFolder' is redundant or there is possible null pointer dereference: pConnection->GetCurrentFolder().	Triaged 26 September 2026: STORE runs with a folder selected, so GetCurrentFolder() is not null there; the later check is defensive.
4048714e72323552c663	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/IMAP/IMAPThread.cpp:880	repeated branch body in conditional chain
adcd0a1e67a08b532005	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/IMAP/MessagesContainer.cpp:24	performing an implicit widening conversion to type 'size_t' (aka 'unsigned long') of a multiplication performed in type 'int'
a166497a3e589db6d745	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/POP3/POP3Connection.cpp:98	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
c8edd0bb1b50e8bde0b0	clang-tidy	cert-err33-c	hmailserver/source/Server/SMTP/BounceTracker.cpp:100	the value returned by this function should not be disregarded; neglecting it may lead to errors
870d87f568c3ce3f3ff8	clang-tidy	readability-suspicious-call-argument	hmailserver/source/Server/SMTP/BounceTracker.cpp:1093	1st argument 'sendersIP' (passed to 'senderIP') looks like it might be swapped with the 2nd, 'sender' (passed to 'sFromAddress')
61483d708a5052d349f1	clang-tidy	cert-err33-c	hmailserver/source/Server/SMTP/ComplaintTracker.cpp:94	the value returned by this function should not be disregarded; neglecting it may lead to errors
5fde1443f79191885ab5	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/SMTP/DeliveryReportParser.cpp:626	performing an implicit widening conversion to type 'size_type' (aka 'unsigned long') of a multiplication performed in type 'int'
a0b7d0bbab8f1ad9ea6c	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/SMTP/DeliveryReportParser.h:43	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
db3974cbb78eb09f5a91	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/SMTP/DestinationBackoff.cpp:284	uninitialized record type: 'moment'
151bee90c8e1b7cdea58	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/SMTP/ExternalDelivery.cpp:146	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
78f4d38e7c77e0c454bb	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/SMTP/FeedbackReportParser.h:52	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
2a57a31b4ae4e509d5ee	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/SMTP/RecipientCallout.cpp:35	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
adf3305b75a510d8730c	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/SMTP/RecipientCallout.cpp:61	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
6bdb9f833b8dba158857	clang-tidy	bugprone-unused-return-value	hmailserver/source/Server/SMTP/RecipientCallout.cpp:158	the value returned by this function should not be disregarded; neglecting it may lead to errors (also cert-err33-c)
25143bfb4e6784a3112f	clang-tidy	cert-err34-c	hmailserver/source/Server/SMTP/RecipientCallout.cpp:194	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
6fe52ee850adfc97df40	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/SMTP/RuleApplier.cpp:349	uninitialized record type: 'scope'	Triaged 26 September 2026: every field is assigned before it is read - a record filled field by field from a row or the file before it is kept, a system structure filled by the call it is passed to, a table its constructor fills.
fdac21bb18796e83e64c	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/SMTP/RuleApplier.cpp:360	uninitialized record type: 'scope'	Triaged 26 September 2026: every field is assigned before it is read - a record filled field by field from a row or the file before it is kept, a system structure filled by the call it is passed to, a table its constructor fills.
2e24ce0b305a297d63e0	clang-tidy	cert-err34-c	hmailserver/source/Server/SMTP/SMTPClientConnection.cpp:219	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
39bf1ffffe61110da9b6	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/SMTP/SMTPClientConnection.cpp:280	switch has 2 consecutive identical branches
63d1833c9a3b0ca584ef	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/SMTP/SMTPConnection.cpp:192	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
d95878baad6fc7de3dea	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/SMTP/SMTPConnection.cpp:488	switch has 2 consecutive identical branches
d6b957e0b9259fb386cd	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/SMTP/SMTPConnection.cpp:937	repeated branch body in conditional chain
911315c6177f2cc3b234	clang-tidy	bugprone-empty-catch	hmailserver/source/Server/SMTP/SMTPDeliveryManager.cpp:51	empty catch statements hide issues; to handle exceptions appropriately, consider re-throwing, handling, or avoiding catch altogether
95cf13916c0058a3e050	clang-tidy	clang-analyzer-core.NullDereference	hmailserver/source/Server/SMTP/SPF/Conformance/SPFConformanceTester.cpp:136	Dereference of null pointer
b83404bbb0fbcc118a39	clang-tidy	clang-analyzer-core.NullDereference	hmailserver/source/Server/SMTP/SPF/Conformance/SPFConformanceTester.cpp:161	Array access (via field 'acceptedResults') results in a null pointer dereference
4b2121b569d87305bae1	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/SMTP/SPF/SPFAddress.cpp:154	result of multiplication in type 'int' is used as a pointer offset after an implicit widening conversion to type 'ptrdiff_t'
6d4d79b1b7bcee03c2fd	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/SMTP/SPF/SPFAddress.cpp:164	result of multiplication in type 'int' is used as a pointer offset after an implicit widening conversion to type 'ptrdiff_t'
80edf86b7d5700731ec8	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/SMTP/SPF/SPFAddress.cpp:342	result of multiplication in type 'int' is used as a pointer offset after an implicit widening conversion to type 'ptrdiff_t'
c06ff73675bb6675ecb0	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/SMTP/SPF/SPFEvaluator.cpp:275	switch has 2 consecutive identical branches
dac96241272e5c5e964e	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/SMTP/TlsPolicy.cpp:61	performing an implicit widening conversion to type 'const size_t' (aka 'const unsigned long') of a multiplication performed in type 'int'
2becb698e61dcd4d63a9	clang-tidy	cert-err34-c	hmailserver/source/Server/SMTP/TlsPolicy.cpp:333	'atoi' used to convert a string to an integer value, but function will not report conversion errors; consider using 'strtol' instead
7953af4e2c7886896cab	clang-tidy	bugprone-branch-clone	hmailserver/source/Server/SMTP/TlsPolicy.cpp:582	switch has 2 consecutive identical branches
ce3272cd5e75145bc105	clang-tidy	cert-err33-c	hmailserver/source/Server/SMTP/TlsPolicy.cpp:820	the value returned by this function should not be disregarded; neglecting it may lead to errors
95d5484e50b0c771776e	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/SMTP/WarmupPlanTester.cpp:114	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'
0673475abe345bdb834a	clang-tidy	bugprone-implicit-widening-of-multiplication-result	hmailserver/source/Server/SMTP/WarmupPlanTester.cpp:115	performing an implicit widening conversion to type 'long long' of a multiplication performed in type 'int'
77ea08b8071b98946d69	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/platform/hm_platform.h:498	uninitialized record type: 'request'
b18818815d9dd1002dcb	cppcheck	CastIntegerToAddressAtReturn	hmailserver/source/Server/platform/hm_platform.h:857	Returning an integer in a function with pointer return type is not portable.
2ea741bad67b3769847d	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/platform/main.cpp:699	uninitialized record type: 'original'
49497f3bed87474745a6	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/platform/main.cpp:1028	uninitialized record type: 'directory'	Triaged 26 September 2026: every field is assigned before it is read - a record filled field by field from a row or the file before it is kept, a system structure filled by the call it is passed to, a table its constructor fills.
f67ad025cc492b2dc42a	clang-tidy	bugprone-exception-escape	hmailserver/source/Server/platform/main.cpp:1499	an exception may be thrown in function 'main' which should not throw exceptions	main lets an exception it does not expect reach std::terminate on purpose: the C++ runtime then aborts at the throw with the stack intact, and CrashOracle::Install, which handles SIGABRT, records where it was; catching it in main would unwind the stack first and lose that.
f25c76572325b004ffbc	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/platform/main.cpp:1786	uninitialized record type: 'original'
d50e2f0e195696f898ba	clang-tidy	cppcoreguidelines-pro-type-member-init	hmailserver/source/Server/platform/main.cpp:2031	uninitialized record type: 'pause'
