diff --git a/include/vlibc/features.h.in b/include/vlibc/features.h.in
index 1837cc3..6ef68a8 100644
--- a/include/vlibc/features.h.in
+++ b/include/vlibc/features.h.in
@@ -22,6 +22,7 @@
  * values baked in at configure time.
  */
 
+/* clang-format off */
 #ifndef VLIBC_LEVEL
 #define VLIBC_LEVEL @vlibc_level@
 #endif
@@ -29,6 +30,7 @@
 #ifndef VLIBC_PROFILE
 #define VLIBC_PROFILE "@vlibc_profile@"
 #endif
+/* clang-format on */
 
 /* True when the active profile is at least level n. */
 #define VLIBC_LEVEL_GE(n) (VLIBC_LEVEL >= (n))
diff --git a/src/string/memcpy.c b/src/string/memcpy.c
index 5e8fe5c..85ca458 100644
--- a/src/string/memcpy.c
+++ b/src/string/memcpy.c
@@ -16,9 +16,8 @@
  * self-recursion and stack overflow. Disable that one transformation for
  * this function only.
  */
-__attribute__((optimize("no-tree-loop-distribute-patterns")))
-void *
-memcpy(void *restrict dst, const void *restrict src, size_t n)
+__attribute__((optimize("no-tree-loop-distribute-patterns"))) void *
+memcpy(void *restrict dst, const void *restrict src, size_t n) // NOLINT(bugprone-*)
 {
     const unsigned long word = sizeof(unsigned long);
     unsigned char *d = dst;
@@ -35,8 +34,8 @@ memcpy(void *restrict dst, const void *restrict src, size_t n)
     {
         unsigned long w;
 
-        __builtin_memcpy(&w, s, sizeof w);
-        __builtin_memcpy(d, &w, sizeof w);
+        __builtin_memcpy(&w, s, sizeof w); // NOLINT(clang-analyzer-security.insecureAPI.*)
+        __builtin_memcpy(d, &w, sizeof w); // NOLINT(clang-analyzer-security.insecureAPI.*)
         d += word;
         s += word;
         n -= word;
diff --git a/src/string/memmove.c b/src/string/memmove.c
index 86645e2..b70051b 100644
--- a/src/string/memmove.c
+++ b/src/string/memmove.c
@@ -12,7 +12,7 @@
  * and tails; word loads and stores go through __builtin_memcpy.
  */
 void *
-memmove(void *dst, const void *src, size_t n)
+memmove(void *dst, const void *src, size_t n) // NOLINT(bugprone-easily-swappable-parameters)
 {
     const unsigned long word = sizeof(unsigned long);
     unsigned char *d = dst;
@@ -29,8 +29,8 @@ memmove(void *dst, const void *src, size_t n)
         {
             unsigned long w;
 
-            __builtin_memcpy(&w, s, sizeof w);
-            __builtin_memcpy(d, &w, sizeof w);
+            __builtin_memcpy(&w, s, sizeof w); // NOLINT(clang-analyzer-security.insecureAPI.*)
+            __builtin_memcpy(d, &w, sizeof w); // NOLINT(clang-analyzer-security.insecureAPI.*)
             d += word;
             s += word;
             n -= word;
@@ -56,8 +56,8 @@ memmove(void *dst, const void *src, size_t n)
 
             d -= word;
             s -= word;
-            __builtin_memcpy(&w, s, sizeof w);
-            __builtin_memcpy(d, &w, sizeof w);
+            __builtin_memcpy(&w, s, sizeof w); // NOLINT(clang-analyzer-security.insecureAPI.*)
+            __builtin_memcpy(d, &w, sizeof w); // NOLINT(clang-analyzer-security.insecureAPI.*)
             n -= word;
         }
         while (n != 0)
diff --git a/src/string/memset.c b/src/string/memset.c
index f6ad6a2..ef00b6d 100644
--- a/src/string/memset.c
+++ b/src/string/memset.c
@@ -11,7 +11,7 @@
  * carry between bytes because each byte is at most 0xff.
  */
 void *
-memset(void *dst, int c, size_t n)
+memset(void *dst, int c, size_t n) // NOLINT(bugprone-easily-swappable-parameters)
 {
     const unsigned long word = sizeof(unsigned long);
     const unsigned char byte = (unsigned char)c;
@@ -27,7 +27,7 @@ memset(void *dst, int c, size_t n)
     /* Fill whole words. */
     while (n >= word)
     {
-        __builtin_memcpy(d, &fill, sizeof fill);
+        __builtin_memcpy(d, &fill, sizeof fill); // NOLINT(clang-analyzer-security.insecureAPI.*)
         d += word;
         n -= word;
     }
diff --git a/src/string/strcmp.c b/src/string/strcmp.c
index 6badf91..1f0619a 100644
--- a/src/string/strcmp.c
+++ b/src/string/strcmp.c
@@ -52,8 +52,8 @@ strcmp(const char *lhs, const char *rhs)
             unsigned long wl;
             unsigned long wr;
 
-            __builtin_memcpy(&wl, l, sizeof wl);
-            __builtin_memcpy(&wr, r, sizeof wr);
+            __builtin_memcpy(&wl, l, sizeof wl); // NOLINT(clang-analyzer-security.insecureAPI.*)
+            __builtin_memcpy(&wr, r, sizeof wr); // NOLINT(clang-analyzer-security.insecureAPI.*)
             if (wl != wr || haszero(wl))
             {
                 break;
diff --git a/src/string/strlen.c b/src/string/strlen.c
index 176316e..8738655 100644
--- a/src/string/strlen.c
+++ b/src/string/strlen.c
@@ -42,7 +42,7 @@ strlen(const char *s)
     {
         unsigned long w;
 
-        __builtin_memcpy(&w, p, sizeof w);
+        __builtin_memcpy(&w, p, sizeof w); // NOLINT(clang-analyzer-security.insecureAPI.*)
         if (haszero(w))
         {
             break;