github · MichaelRFairhurst · Oct 29, 2025 · Nov 5, 2025 · Dec 4, 2025 · Dec 4, 2025
diff --git a/.codeqlmanifest.json b/.codeqlmanifest.json
@@ -1,7 +1,9 @@
 {
   "provide": [
+    "cpp/baseline_suites/qlpack.yml",
     "cpp/*/src/qlpack.yml",
     "cpp/*/test/qlpack.yml",
+    "c/baseline_suites/qlpack.yml",
     "c/*/src/qlpack.yml",
     "c/*/test/qlpack.yml",
     "scripts/generate_modules/queries/qlpack.yml"

diff --git a/README.md b/README.md
@@ -25,6 +25,10 @@ The following standards are under active development for [C++17](https://www.iso
 
 - [MISRA C++ 2023](https://misra.org.uk/product/misra-cpp2023/) - under development - _scheduled for release 2026 Q1/Q2_
 
+## Baseline suites
+
+In addition to supporting the above coding standards, we also export "baseline" query suites for C and C++ which contain a selection of well-supported, less opinionated, low false positive rate rules. These baseline suites are intended to be suitable for a wide variety of C/C++ projects that are interested in additional code quality and safety checks without the full strictness of a specific coding standard.
+
 ## How do I use the CodeQL Coding Standards Queries?
 
 The use of the CodeQL Coding Standards is extensively documented in the [user manual](docs/user_manual.md).

diff --git a/c/baseline_suites/codeql-pack.lock.yml b/c/baseline_suites/codeql-pack.lock.yml
@@ -0,0 +1,24 @@
+---
+lockVersion: 1.0.0
+dependencies:
+  codeql/cpp-all:
+    version: 4.0.3
+  codeql/dataflow:
+    version: 2.0.3
+  codeql/mad:
+    version: 1.0.19
+  codeql/rangeanalysis:
+    version: 1.0.19
+  codeql/ssa:
+    version: 1.0.19
+  codeql/tutorial:
+    version: 1.0.19
+  codeql/typeflow:
+    version: 1.0.19
+  codeql/typetracking:
+    version: 2.0.3
+  codeql/util:
+    version: 2.0.6
+  codeql/xml:
+    version: 1.0.19
+compiled: false
diff --git a/c/baseline_suites/codeql-suites/c-baseline-default.qls b/c/baseline_suites/codeql-suites/c-baseline-default.qls
@@ -0,0 +1,10 @@
+- description: C Baseline Coding Standards Queries
+- qlpack: codeql/cert-c-coding-standards
+- qlpack: codeql/misra-c-coding-standards
+- include:
+    kind:
+    - problem
+    - path-problem
+    tags contain:
+    - coding-standards/baseline/safety
+    - coding-standards/baseline/style
diff --git a/c/baseline_suites/codeql-suites/c-baseline-safety.qls b/c/baseline_suites/codeql-suites/c-baseline-safety.qls
@@ -0,0 +1,8 @@
+- description: C Baseline Safety Coding Standards Queries
+- qlpack: codeql/misra-c-coding-standards
+- include:
+    kind:
+    - problem
+    - path-problem
+    tags contain:
+    - coding-standards/baseline/safety
diff --git a/c/baseline_suites/codeql-suites/c-baseline-style.qls b/c/baseline_suites/codeql-suites/c-baseline-style.qls
@@ -0,0 +1,8 @@
+- description: C Baseline Style Coding Standards Queries
+- qlpack: codeql/coding-standards-c-baseline
+- include:
+    kind:
+    - problem
+    - path-problem
+    tags contain:
+    - coding-standards/baseline/style
diff --git a/c/baseline_suites/qlpack.yml b/c/baseline_suites/qlpack.yml
@@ -0,0 +1,9 @@
+name: advanced-security/coding-standards-c-baseline
+version: 0.0.2
+description: A set of baseline coding standards for C projects, combining hand picked rules from MISRA C and CERT C.
+suites: codeql-suites
+license: MIT
+default-suite-file: codeql-suites/c-baseline-default.qls
+dependencies:
+  codeql/misra-c-coding-standards: 2.51.0
+  codeql/cert-c-coding-standards: 2.51.0
diff --git a/c/cert/src/rules/ARR32-C/VariableLengthArraySizeNotInValidRange.ql b/c/cert/src/rules/ARR32-C/VariableLengthArraySizeNotInValidRange.ql
@@ -14,6 +14,7 @@
  *       external/cert/remediation-cost/high
  *       external/cert/priority/p6
  *       external/cert/level/l2
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/ARR36-C/DoNotRelatePointersThatDoNotReferToTheSameArray.ql b/c/cert/src/rules/ARR36-C/DoNotRelatePointersThatDoNotReferToTheSameArray.ql
@@ -13,6 +13,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p8
  *       external/cert/level/l2
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/CON30-C/CleanUpThreadSpecificStorage.ql b/c/cert/src/rules/CON30-C/CleanUpThreadSpecificStorage.ql
@@ -14,6 +14,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p4
  *       external/cert/level/l3
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/CON31-C/DoNotAllowAMutexToGoOutOfScopeWhileLocked.ql b/c/cert/src/rules/CON31-C/DoNotAllowAMutexToGoOutOfScopeWhileLocked.ql
@@ -14,6 +14,7 @@
  *       external/cert/remediation-cost/high
  *       external/cert/priority/p4
  *       external/cert/level/l3
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/CON31-C/DoNotDestroyAMutexWhileItIsLocked.ql b/c/cert/src/rules/CON31-C/DoNotDestroyAMutexWhileItIsLocked.ql
@@ -13,6 +13,7 @@
  *       external/cert/remediation-cost/high
  *       external/cert/priority/p4
  *       external/cert/level/l3
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/CON32-C/PreventDataRacesWithMultipleThreads.ql b/c/cert/src/rules/CON32-C/PreventDataRacesWithMultipleThreads.ql
@@ -14,6 +14,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p8
  *       external/cert/level/l2
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/CON33-C/RaceConditionsWhenUsingLibraryFunctions.ql b/c/cert/src/rules/CON33-C/RaceConditionsWhenUsingLibraryFunctions.ql
@@ -13,6 +13,7 @@
  *       external/cert/remediation-cost/high
  *       external/cert/priority/p4
  *       external/cert/level/l3
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/CON36-C/WrapFunctionsThatCanSpuriouslyWakeUpInLoop.ql b/c/cert/src/rules/CON36-C/WrapFunctionsThatCanSpuriouslyWakeUpInLoop.ql
@@ -14,6 +14,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p2
  *       external/cert/level/l3
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/CON38-C/PreserveSafetyWhenUsingConditionVariables.ql b/c/cert/src/rules/CON38-C/PreserveSafetyWhenUsingConditionVariables.ql
@@ -14,6 +14,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p2
  *       external/cert/level/l3
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/CON39-C/ThreadWasPreviouslyJoinedOrDetached.ql b/c/cert/src/rules/CON39-C/ThreadWasPreviouslyJoinedOrDetached.ql
@@ -14,6 +14,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p6
  *       external/cert/level/l2
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/CON40-C/AtomicVariableTwiceInExpression.ql b/c/cert/src/rules/CON40-C/AtomicVariableTwiceInExpression.ql
@@ -14,6 +14,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p8
  *       external/cert/level/l2
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/CON41-C/WrapFunctionsThatCanFailSpuriouslyInLoop.ql b/c/cert/src/rules/CON41-C/WrapFunctionsThatCanFailSpuriouslyInLoop.ql
@@ -14,6 +14,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p2
  *       external/cert/level/l3
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/DCL30-C/AppropriateStorageDurationsFunctionReturn.ql b/c/cert/src/rules/DCL30-C/AppropriateStorageDurationsFunctionReturn.ql
@@ -13,6 +13,7 @@
  *       external/cert/remediation-cost/high
  *       external/cert/priority/p6
  *       external/cert/level/l2
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/DCL38-C/DeclaringAFlexibleArrayMember.ql b/c/cert/src/rules/DCL38-C/DeclaringAFlexibleArrayMember.ql
@@ -15,6 +15,7 @@
  *       external/cert/remediation-cost/low
  *       external/cert/priority/p3
  *       external/cert/level/l3
+ *       coding-standards/baseline/style
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/DCL41-C/VariablesInsideSwitchStatement.ql b/c/cert/src/rules/DCL41-C/VariablesInsideSwitchStatement.ql
@@ -15,6 +15,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p4
  *       external/cert/level/l3
+ *       coding-standards/baseline/style
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/ENV30-C/DoNotModifyTheReturnValueOfCertainFunctions.ql b/c/cert/src/rules/ENV30-C/DoNotModifyTheReturnValueOfCertainFunctions.ql
@@ -13,6 +13,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p4
  *       external/cert/level/l3
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/ENV31-C/EnvPointerIsInvalidAfterCertainOperations.ql b/c/cert/src/rules/ENV31-C/EnvPointerIsInvalidAfterCertainOperations.ql
@@ -13,6 +13,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p4
  *       external/cert/level/l3
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/ENV32-C/ExitHandlersMustReturnNormally.ql b/c/cert/src/rules/ENV32-C/ExitHandlersMustReturnNormally.ql
@@ -13,6 +13,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p12
  *       external/cert/level/l1
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/ENV34-C/DoNotStorePointersReturnedByEnvFunctions.ql b/c/cert/src/rules/ENV34-C/DoNotStorePointersReturnedByEnvFunctions.ql
@@ -14,6 +14,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p4
  *       external/cert/level/l3
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/ENV34-C/DoNotStorePointersReturnedByEnvironmentFunWarn.ql b/c/cert/src/rules/ENV34-C/DoNotStorePointersReturnedByEnvironmentFunWarn.ql
@@ -14,6 +14,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p4
  *       external/cert/level/l3
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/ERR30-C/ErrnoReadBeforeReturn.ql b/c/cert/src/rules/ERR30-C/ErrnoReadBeforeReturn.ql
@@ -13,6 +13,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p8
  *       external/cert/level/l2
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/ERR30-C/SetlocaleMightSetErrno.ql b/c/cert/src/rules/ERR30-C/SetlocaleMightSetErrno.ql
@@ -12,6 +12,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p8
  *       external/cert/level/l2
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/ERR32-C/DoNotRelyOnIndeterminateValuesOfErrno.ql b/c/cert/src/rules/ERR32-C/DoNotRelyOnIndeterminateValuesOfErrno.ql
@@ -12,6 +12,7 @@
  *       external/cert/remediation-cost/low
  *       external/cert/priority/p3
  *       external/cert/level/l3
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/EXP32-C/DoNotAccessVolatileObjectWithNonVolatileReference.ql b/c/cert/src/rules/EXP32-C/DoNotAccessVolatileObjectWithNonVolatileReference.ql
@@ -13,6 +13,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p6
  *       external/cert/level/l2
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/EXP35-C/DoNotModifyObjectsWithTemporaryLifetime.ql b/c/cert/src/rules/EXP35-C/DoNotModifyObjectsWithTemporaryLifetime.ql
@@ -13,6 +13,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p4
  *       external/cert/level/l3
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/EXP37-C/DoNotCallFunctionPointerWithIncompatibleType.ql b/c/cert/src/rules/EXP37-C/DoNotCallFunctionPointerWithIncompatibleType.ql
@@ -13,6 +13,7 @@
  *       external/cert/remediation-cost/high
  *       external/cert/priority/p4
  *       external/cert/level/l3
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/EXP37-C/DoNotCallFunctionsWithIncompatibleArguments.ql b/c/cert/src/rules/EXP37-C/DoNotCallFunctionsWithIncompatibleArguments.ql
@@ -13,6 +13,7 @@
  *       external/cert/remediation-cost/high
  *       external/cert/priority/p4
  *       external/cert/level/l3
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/EXP40-C/DoNotModifyConstantObjects.ql b/c/cert/src/rules/EXP40-C/DoNotModifyConstantObjects.ql
@@ -12,6 +12,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p2
  *       external/cert/level/l3
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/EXP43-C/DoNotPassAliasedPointerToRestrictQualifiedParam.ql b/c/cert/src/rules/EXP43-C/DoNotPassAliasedPointerToRestrictQualifiedParam.ql
@@ -12,6 +12,7 @@
  *       external/cert/remediation-cost/high
  *       external/cert/priority/p4
  *       external/cert/level/l3
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/EXP43-C/RestrictPointerReferencesOverlappingObject.ql b/c/cert/src/rules/EXP43-C/RestrictPointerReferencesOverlappingObject.ql
@@ -12,6 +12,7 @@
  *       external/cert/remediation-cost/high
  *       external/cert/priority/p4
  *       external/cert/level/l3
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/EXP46-C/DoNotUseABitwiseOperatorWithABooleanLikeOperand.ql b/c/cert/src/rules/EXP46-C/DoNotUseABitwiseOperatorWithABooleanLikeOperand.ql
@@ -14,6 +14,7 @@
  *       external/cert/remediation-cost/low
  *       external/cert/priority/p9
  *       external/cert/level/l2
+ *       coding-standards/baseline/style
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/FIO30-C/ExcludeUserInputFromFormatStrings.ql b/c/cert/src/rules/FIO30-C/ExcludeUserInputFromFormatStrings.ql
@@ -13,6 +13,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p18
  *       external/cert/level/l1
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/FIO37-C/SuccessfulFgetsOrFgetwsMayReturnAnEmptyString.ql b/c/cert/src/rules/FIO37-C/SuccessfulFgetsOrFgetwsMayReturnAnEmptyString.ql
@@ -12,6 +12,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p12
  *       external/cert/level/l1
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/FIO38-C/DoNotCopyAFileObject.ql b/c/cert/src/rules/FIO38-C/DoNotCopyAFileObject.ql
@@ -13,6 +13,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p4
  *       external/cert/level/l3
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/FIO39-C/DoNotAlternatelyIOFromAStreamWithoutPositioning.ql b/c/cert/src/rules/FIO39-C/DoNotAlternatelyIOFromAStreamWithoutPositioning.ql
@@ -13,6 +13,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p6
  *       external/cert/level/l2
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/FIO40-C/ResetStringsOnFgetsOrFgetwsFailure.ql b/c/cert/src/rules/FIO40-C/ResetStringsOnFgetsOrFgetwsFailure.ql
@@ -14,6 +14,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p4
  *       external/cert/level/l3
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/FIO41-C/DoNotCallGetcAndPutcWithSideEffects.ql b/c/cert/src/rules/FIO41-C/DoNotCallGetcAndPutcWithSideEffects.ql
@@ -13,6 +13,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p2
  *       external/cert/level/l3
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/FIO45-C/ToctouRaceConditionsWhileAccessingFiles.ql b/c/cert/src/rules/FIO45-C/ToctouRaceConditionsWhileAccessingFiles.ql
@@ -13,6 +13,7 @@
  *       external/cert/remediation-cost/high
  *       external/cert/priority/p6
  *       external/cert/level/l2
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */
 

diff --git a/c/cert/src/rules/FIO46-C/UndefinedBehaviorAccessingAClosedFile.ql b/c/cert/src/rules/FIO46-C/UndefinedBehaviorAccessingAClosedFile.ql
@@ -12,6 +12,7 @@
  *       external/cert/remediation-cost/medium
  *       external/cert/priority/p4
  *       external/cert/level/l3
+ *       coding-standards/baseline/safety
  *       external/cert/obligation/rule
  */