diff --git a/src/engine/lua.cc b/src/engine/lua.cc
index 9313a2ec7f..869acefd4b 100644
--- a/src/engine/lua.cc
+++ b/src/engine/lua.cc
@@ -297,7 +297,7 @@ int Lua::getvars(lua_State *L) {
     variables::Variable::stringMatchResolveMulti(t, varname, &l);
 
     lua_newtable(L);
-    for (auto i : l) {
+    for (auto* i : l) {
         lua_pushnumber(L, idx);
         lua_newtable(L);
 
diff --git a/src/rules_exceptions.cc b/src/rules_exceptions.cc
index 2fb0cf857f..e448256cda 100644
--- a/src/rules_exceptions.cc
+++ b/src/rules_exceptions.cc
@@ -195,7 +195,7 @@ bool RulesExceptions::contains(int a) {
         }
     }
 
-    for (auto z : m_ranges) {
+    for (auto& z : m_ranges) {
         if (z.first <= a && z.second >= a) {
             return true;
         }
@@ -212,7 +212,7 @@ bool RulesExceptions::merge(RulesExceptions *from) {
             return ret;
         }
     }
-    for (auto b : from->m_ranges) {
+    for (auto& b : from->m_ranges) {
         bool ret = addRange(b.first, b.second);
         if (ret == false) {
             return ret;
diff --git a/src/transaction.cc b/src/transaction.cc
index 6c8ae9744c..db3a4040cc 100644
--- a/src/transaction.cc
+++ b/src/transaction.cc
@@ -1700,7 +1700,7 @@ std::string Transaction::toJSON(int parts) {
             reinterpret_cast<const unsigned char*>("messages"),
             strlen("messages"));
         yajl_gen_array_open(g);
-        for (auto a : m_rulesMessages) {
+        for (auto& a : m_rulesMessages) {
             yajl_gen_map_open(g);
             LOGFY_ADD("message", a.m_message);
             yajl_gen_string(g,
@@ -1721,7 +1721,7 @@ std::string Transaction::toJSON(int parts) {
                 reinterpret_cast<const unsigned char*>("tags"),
                 strlen("tags"));
             yajl_gen_array_open(g);
-            for (auto b : a.m_tags) {
+            for (auto& b : a.m_tags) {
                 yajl_gen_string(g,
                     reinterpret_cast<const unsigned char*>(b.data()),
                     b.length());