diff --git a/lib/core-net/vhost.c b/lib/core-net/vhost.c
index c9cb96a5b..aa999e6eb 100644
--- a/lib/core-net/vhost.c
+++ b/lib/core-net/vhost.c
@@ -728,7 +728,7 @@ lws_create_vhost(struct lws_context *context,
 		p = getenv("http_proxy");
 		if (p) {
 			lws_strncpy(buf, p, sizeof(buf));
-
+			/* coverity[tainted_scalar] */
 			lws_set_proxy(vh, buf);
 		}
 #endif
diff --git a/lib/roles/http/client/client-http.c b/lib/roles/http/client/client-http.c
index 2b2281c7a..a57853ab9 100644
--- a/lib/roles/http/client/client-http.c
+++ b/lib/roles/http/client/client-http.c
@@ -850,6 +850,7 @@ lws_client_interpret_server_handshake(struct lws *wsi)
 			 */
 			lwsl_err("Redirect failed\n");
 			cce = "HS: Redirect failed";
+			/* coverity[reverse_inull] */
 			if (wsi)
 				goto bail3;
 
diff --git a/lib/roles/ws/client-ws.c b/lib/roles/ws/client-ws.c
index 67498da13..e2819c354 100644
--- a/lib/roles/ws/client-ws.c
+++ b/lib/roles/ws/client-ws.c
@@ -163,6 +163,7 @@ lws_generate_client_ws_handshake(struct lws *wsi, char *p, const char *conn1)
 		return NULL;
 	}
 
+	/* coverity[tainted_scalar] */
 	lws_b64_encode_string(hash, 16, key_b64, sizeof(key_b64));
 
 	p += sprintf(p, "Upgrade: websocket\x0d\x0a"
diff --git a/plugins/deaddrop/protocol_lws_deaddrop.c b/plugins/deaddrop/protocol_lws_deaddrop.c
index 132a3b486..84a10bdc6 100644
--- a/plugins/deaddrop/protocol_lws_deaddrop.c
+++ b/plugins/deaddrop/protocol_lws_deaddrop.c
@@ -169,6 +169,7 @@ scan_upload_dir(struct vhd_deaddrop *vhd)
 		if (de->d_name[strlen(de->d_name) - 1] == '~')
 			continue;
 
+		/* coverity[toctou] */
 		if (stat(filepath, &s))
 			continue;