I can provide at least one valid result from each of the added services/libs but as these are credential disclosure issues, I would like to do that through a private channel.

Should I move this into an experimental query?

This is straightforward enough that assuming seclab can confirm the results are reasonable I'd be happy to take it straight into the non-experimental library

This is straightforward enough that assuming seclab can confirm the results are reasonable I'd be happy to take it straight into the non-experimental library

I already have an issue open for this github/securitylab#432, just need to know about the best way to provide the seclab with the results as they contain potentially confidential information.

Please add to the tests in java/ql/test/security/CWE-798 (and needed stubs to java/ql/test/stubs) (this is basically checking that all the method prototypes you've given here are spelled correctly)

Please add a change note in java/change-notes briefly summarising what has changed.

Will sure do @smowton. I should push the changes in the next couple of days.