diff --git a/controller/Controller.h b/controller/Controller.h
index 6b93173..a029109 100644
--- a/controller/Controller.h
+++ b/controller/Controller.h
@@ -22,6 +22,7 @@
 #include "core/ConfigurationFactory.h"
 #include "io/ClientSocket.h"
 #include "c2/ControllerSocketProtocol.h"
+#include "utils/gsl.h"
 
 /**
  * Sends a single argument comment
@@ -35,7 +36,7 @@
   minifi::io::BufferStream stream;
   stream.write(&op, 1);
   stream.write(value);
-  return socket->write(const_cast<uint8_t*>(stream.getBuffer()), stream.size()) == stream.size();
+  return socket->write(const_cast<uint8_t*>(stream.getBuffer()), gsl::narrow<int>(stream.size())) == stream.size();
 }
 
 /**
@@ -76,7 +77,7 @@
   stream.write(&op, 1);
   stream.write("flow");
   stream.write(file);
-  if (socket->write(const_cast<uint8_t*>(stream.getBuffer()), stream.size()) < 0) {
+  if (socket->write(const_cast<uint8_t*>(stream.getBuffer()), gsl::narrow<int>(stream.size())) < 0) {
     return -1;
   }
   // read the response
@@ -106,7 +107,7 @@
   minifi::io::BufferStream stream;
   stream.write(&op, 1);
   stream.write("getfull");
-  if (socket->write(const_cast<uint8_t*>(stream.getBuffer()), stream.size()) < 0) {
+  if (socket->write(const_cast<uint8_t*>(stream.getBuffer()), gsl::narrow<int>(stream.size())) < 0) {
     return -1;
   }
   // read the response
@@ -132,7 +133,7 @@
   minifi::io::BufferStream stream;
   stream.write(&op, 1);
   stream.write("jstack");
-  if (socket->write(const_cast<uint8_t*>(stream.getBuffer()), stream.size()) < 0) {
+  if (socket->write(const_cast<uint8_t*>(stream.getBuffer()), gsl::narrow<int>(stream.size())) < 0) {
     return -1;
   }
   // read the response
@@ -172,7 +173,7 @@
   stream.write(&op, 1);
   stream.write("queue");
   stream.write(connection);
-  if (socket->write(const_cast<uint8_t*>(stream.getBuffer()), stream.size()) < 0) {
+  if (socket->write(const_cast<uint8_t*>(stream.getBuffer()), gsl::narrow<int>(stream.size())) < 0) {
     return -1;
   }
   // read the response
@@ -192,7 +193,7 @@
   uint8_t op = minifi::c2::Operation::DESCRIBE;
   stream.write(&op, 1);
   stream.write("components");
-  if (socket->write(const_cast<uint8_t*>(stream.getBuffer()), stream.size()) < 0) {
+  if (socket->write(const_cast<uint8_t*>(stream.getBuffer()), gsl::narrow<int>(stream.size())) < 0) {
     return -1;
   }
   uint16_t responses = 0;
@@ -216,7 +217,7 @@
   uint8_t op = minifi::c2::Operation::DESCRIBE;
   stream.write(&op, 1);
   stream.write("connections");
-  if (socket->write(const_cast<uint8_t*>(stream.getBuffer()), stream.size()) < 0) {
+  if (socket->write(const_cast<uint8_t*>(stream.getBuffer()), gsl::narrow<int>(stream.size())) < 0) {
     return -1;
   }
   uint16_t responses = 0;
diff --git a/extensions/civetweb/processors/ListenHTTP.cpp b/extensions/civetweb/processors/ListenHTTP.cpp
index 86dc62d..7a2b072 100644
--- a/extensions/civetweb/processors/ListenHTTP.cpp
+++ b/extensions/civetweb/processors/ListenHTTP.cpp
@@ -20,6 +20,8 @@
  */
 #include "ListenHTTP.h"
 
+#include "utils/gsl.h"
+
 namespace org {
 namespace apache {
 namespace nifi {
@@ -504,7 +506,7 @@
 }
 
 int64_t ListenHTTP::WriteCallback::process(const std::shared_ptr<io::BaseStream>& stream) {
-  return stream->write(const_cast<uint8_t*>(request_content_->getBuffer()), request_content_->size());
+  return stream->write(const_cast<uint8_t*>(request_content_->getBuffer()), gsl::narrow<int>(request_content_->size()));
 }
 
 bool ListenHTTP::isSecure() const {
diff --git a/extensions/http-curl/client/HTTPClient.cpp b/extensions/http-curl/client/HTTPClient.cpp
index 2c4384b..f628b4f 100644
--- a/extensions/http-curl/client/HTTPClient.cpp
+++ b/extensions/http-curl/client/HTTPClient.cpp
@@ -16,7 +16,7 @@
  * limitations under the License.
  */
 #include "HTTPClient.h"
-#include "Exception.h"
+
 #include <memory>
 #include <climits>
 #include <cinttypes>
@@ -24,6 +24,9 @@
 #include <vector>
 #include <string>
 #include <algorithm>
+
+#include "Exception.h"
+#include "utils/gsl.h"
 #include "utils/StringUtils.h"
 #include "utils/RegexUtils.h"
 
@@ -213,7 +216,7 @@
 }
 
 std::string HTTPClient::escape(std::string string_to_escape) {
-  return curl_easy_escape(http_session_, string_to_escape.c_str(), string_to_escape.length());
+  return curl_easy_escape(http_session_, string_to_escape.c_str(), gsl::narrow<int>(string_to_escape.length()));
 }
 
 void HTTPClient::setPostFields(const std::string& input) {
diff --git a/extensions/http-curl/client/HTTPStream.cpp b/extensions/http-curl/client/HTTPStream.cpp
index eb3b633..5ba7f3f 100644
--- a/extensions/http-curl/client/HTTPStream.cpp
+++ b/extensions/http-curl/client/HTTPStream.cpp
@@ -27,6 +27,8 @@
 
 #include "HTTPCallback.h"
 #include "io/validation.h"
+#include "utils/gsl.h"
+
 namespace org {
 namespace apache {
 namespace nifi {
@@ -95,7 +97,7 @@
         started_ = true;
       }
     }
-    return http_read_callback_.readFully((char*) buf, buflen);
+    return gsl::narrow<int>(http_read_callback_.readFully((char*) buf, buflen));
 
   } else {
     return -1;
diff --git a/extensions/http-curl/processors/InvokeHTTP.cpp b/extensions/http-curl/processors/InvokeHTTP.cpp
index 8b173fb..c0b2b87 100644
--- a/extensions/http-curl/processors/InvokeHTTP.cpp
+++ b/extensions/http-curl/processors/InvokeHTTP.cpp
@@ -45,6 +45,7 @@
 #include "io/BufferStream.h"
 #include "io/StreamFactory.h"
 #include "ResourceClaim.h"
+#include "utils/gsl.h"
 #include "utils/StringUtils.h"
 
 namespace org {
@@ -382,7 +383,7 @@
         response_flow->addAttribute(STATUS_MESSAGE, response_headers.at(0));
       response_flow->addAttribute(REQUEST_URL, url);
       response_flow->addAttribute(TRANSACTION_ID, tx_id);
-      io::BufferStream stream((const uint8_t*) response_body.data(), response_body.size());
+      io::BufferStream stream((const uint8_t*) response_body.data(), gsl::narrow<unsigned int>(response_body.size()));
       // need an import from the data stream.
       session->importFrom(stream, response_flow);
     }
diff --git a/extensions/http-curl/protocols/AgentPrinter.cpp b/extensions/http-curl/protocols/AgentPrinter.cpp
index 672652a..58b567f 100644
--- a/extensions/http-curl/protocols/AgentPrinter.cpp
+++ b/extensions/http-curl/protocols/AgentPrinter.cpp
@@ -17,6 +17,7 @@
  */
 
 #include "AgentPrinter.h"
+
 #include <algorithm>
 #include <memory>
 #include <utility>
@@ -25,6 +26,8 @@
 #include <string>
 #include <vector>
 
+#include "utils/gsl.h"
+
 namespace org {
 namespace apache {
 namespace nifi {
@@ -51,7 +54,7 @@
 
   rapidjson::Value opReqStrVal;
   std::string operation_request_str = getOperation(payload);
-  opReqStrVal.SetString(operation_request_str.c_str(), operation_request_str.length(), alloc);
+  opReqStrVal.SetString(operation_request_str.c_str(), gsl::narrow<rapidjson::SizeType>(operation_request_str.length()), alloc);
   json_payload.AddMember("operation", opReqStrVal, alloc);
 
   std::string operationid = payload.getIdentifier();
diff --git a/extensions/http-curl/sitetosite/HTTPProtocol.cpp b/extensions/http-curl/sitetosite/HTTPProtocol.cpp
index 50cdca8..827c640 100644
--- a/extensions/http-curl/sitetosite/HTTPProtocol.cpp
+++ b/extensions/http-curl/sitetosite/HTTPProtocol.cpp
@@ -41,12 +41,12 @@
 std::shared_ptr<utils::IdGenerator> HttpSiteToSiteClient::id_generator_ = utils::IdGenerator::getIdGenerator();
 
 utils::optional<utils::Identifier> HttpSiteToSiteClient::parseTransactionId(const std::string &uri) {
-  int i = 0;
-  for (i = uri.length() - 1; i >= 0; i--) {
-    if (uri.at(i) == '/')
-      break;
+  const size_t last_slash_pos = uri.find_last_of('/');
+  size_t id_start_pos = 0;
+  if (last_slash_pos != std::string::npos) {
+    id_start_pos = last_slash_pos + 1;
   }
-  return utils::Identifier::parse(uri.substr(i + 1, uri.length() - (i + 1)));
+  return utils::Identifier::parse(uri.substr(id_start_pos));
 }
 
 std::shared_ptr<Transaction> HttpSiteToSiteClient::createTransaction(TransferDirection direction) {
diff --git a/extensions/http-curl/tests/C2UpdateAgentTest.cpp b/extensions/http-curl/tests/C2UpdateAgentTest.cpp
index 3ab4409..5e61f7e 100644
--- a/extensions/http-curl/tests/C2UpdateAgentTest.cpp
+++ b/extensions/http-curl/tests/C2UpdateAgentTest.cpp
@@ -19,6 +19,7 @@
 #undef NDEBUG
 #include "HTTPIntegrationBase.h"
 #include "HTTPHandlers.h"
+#include "utils/gsl.h"
 
 int main(int argc, char **argv) {
   const cmd_args args = parse_cmdline_args(argc, argv, "update");
@@ -34,6 +35,6 @@
 
   const auto then = std::chrono::system_clock::now();
   const auto seconds = std::chrono::duration_cast<std::chrono::seconds>(then - start).count();
-  assert(handler.calls_ <= (seconds) + 2);
+  assert(handler.calls_ <= gsl::narrow<size_t>(seconds + 2));
   return 0;
 }
diff --git a/extensions/http-curl/tests/C2UpdateTest.cpp b/extensions/http-curl/tests/C2UpdateTest.cpp
index 2c85a79..24d4693 100644
--- a/extensions/http-curl/tests/C2UpdateTest.cpp
+++ b/extensions/http-curl/tests/C2UpdateTest.cpp
@@ -19,6 +19,7 @@
 #undef NDEBUG
 #include "HTTPIntegrationBase.h"
 #include "HTTPHandlers.h"
+#include "utils/gsl.h"
 #include "utils/IntegrationTestUtils.h"
 
 int main(int argc, char **argv) {
@@ -35,6 +36,6 @@
 
   const auto then = std::chrono::system_clock::now();
   const auto seconds = std::chrono::duration_cast<std::chrono::seconds>(then - start).count();
-  assert(handler.calls_ <= seconds + 1);
+  assert(handler.calls_ <= gsl::narrow<size_t>(seconds + 1));
   return 0;
 }
diff --git a/extensions/http-curl/tests/HTTPHandlers.h b/extensions/http-curl/tests/HTTPHandlers.h
index 1063665..4e7d62b 100644
--- a/extensions/http-curl/tests/HTTPHandlers.h
+++ b/extensions/http-curl/tests/HTTPHandlers.h
@@ -29,6 +29,7 @@
 #include "rapidjson/document.h"
 #include "HTTPUtils.h"
 #include "ServerAwareHandler.h"
+#include "utils/gsl.h"
 
 static std::atomic<int> transaction_id;
 static std::atomic<int> transaction_id_output;
@@ -280,7 +281,7 @@
       minifi::io::BufferStream serializer;
       minifi::io::CRCStream < minifi::io::BaseStream > stream(gsl::make_not_null(&serializer));
       for (const auto& flow : flows) {
-        uint32_t num_attributes = flow->attributes.size();
+        uint32_t num_attributes = gsl::narrow<uint32_t>(flow->attributes.size());
         stream.write(num_attributes);
         for (const auto& entry : flow->attributes) {
           stream.write(entry.first);
diff --git a/extensions/http-curl/tests/HTTPIntegrationBase.h b/extensions/http-curl/tests/HTTPIntegrationBase.h
index 48724bb..29e5672 100644
--- a/extensions/http-curl/tests/HTTPIntegrationBase.h
+++ b/extensions/http-curl/tests/HTTPIntegrationBase.h
@@ -207,7 +207,7 @@
 
   void runAssertions() override {
     using org::apache::nifi::minifi::utils::verifyLogLinePresenceInPollTime;
-    assert(verifyLogLinePresenceInPollTime(std::chrono::seconds(10), "removing file", "May not have command processor"));
+    assert(verifyLogLinePresenceInPollTime(std::chrono::seconds(10), "removing file", "Executed update command"));
   }
 };
 
diff --git a/extensions/http-curl/tests/unit/InvokeHTTPTests.cpp b/extensions/http-curl/tests/unit/InvokeHTTPTests.cpp
index 2a4220f..06a7bf0 100644
--- a/extensions/http-curl/tests/unit/InvokeHTTPTests.cpp
+++ b/extensions/http-curl/tests/unit/InvokeHTTPTests.cpp
@@ -39,6 +39,7 @@
 #include "processors/InvokeHTTP.h"
 #include "processors/ListenHTTP.h"
 #include "processors/LogAttribute.h"
+#include "utils/gsl.h"
 
 TEST_CASE("HTTPTestsWithNoResourceClaimPOST", "[httptest1]") {
   TestController testController;
@@ -153,7 +154,7 @@
   virtual int64_t process(const std::shared_ptr<minifi::io::BaseStream>& stream) {
     // leaving the typo for posterity sake
     std::string st = "we're gnna write some test stuff";
-    return stream->write(reinterpret_cast<uint8_t*>(const_cast<char*>(st.c_str())), st.length());
+    return stream->write(reinterpret_cast<uint8_t*>(const_cast<char*>(st.c_str())), gsl::narrow<int>(st.length()));
   }
 };
 
diff --git a/extensions/libarchive/ArchiveMetadata.cpp b/extensions/libarchive/ArchiveMetadata.cpp
index eea31a8..69af90a 100644
--- a/extensions/libarchive/ArchiveMetadata.cpp
+++ b/extensions/libarchive/ArchiveMetadata.cpp
@@ -29,6 +29,7 @@
 #include <iostream>
 
 #include "utils/file/FileManager.h"
+#include "utils/gsl.h"
 #include "Exception.h"
 
 using org::apache::nifi::minifi::Exception;
@@ -38,7 +39,7 @@
     rapidjson::Value entryVal(rapidjson::kObjectType);
 
     rapidjson::Value entryNameVal;
-    entryNameVal.SetString(entryName.c_str(), entryName.length());
+    entryNameVal.SetString(entryName.c_str(), gsl::narrow<rapidjson::SizeType>(entryName.length()));
     entryVal.AddMember("entry_name", entryNameVal, alloc);
 
     entryVal.AddMember("entry_type", entryType, alloc);
@@ -51,7 +52,7 @@
 
     if (entryType == AE_IFREG) {
         rapidjson::Value stashKeyVal;
-        stashKeyVal.SetString(stashKey.c_str(), stashKey.length());
+        stashKeyVal.SetString(stashKey.c_str(), gsl::narrow<rapidjson::SizeType>(stashKey.length()));
         entryVal.AddMember("stash_key", stashKeyVal, alloc);
     }
 
@@ -107,7 +108,7 @@
     rapidjson::Value lensVal(rapidjson::kObjectType);
 
     rapidjson::Value archiveFormatNameVal;
-    archiveFormatNameVal.SetString(archiveFormatName.c_str(), archiveFormatName.length());
+    archiveFormatNameVal.SetString(archiveFormatName.c_str(), gsl::narrow<rapidjson::SizeType>(archiveFormatName.length()));
     lensVal.AddMember("archive_format_name", archiveFormatNameVal, alloc);
 
     lensVal.AddMember("archive_format", archiveFormat, alloc);
@@ -115,12 +116,12 @@
 
     if (!archiveName.empty()) {
         rapidjson::Value archiveNameVal;
-        archiveNameVal.SetString(archiveName.c_str(), archiveName.length());
+        archiveNameVal.SetString(archiveName.c_str(), gsl::narrow<rapidjson::SizeType>(archiveName.length()));
         lensVal.AddMember("archive_name", archiveNameVal, alloc);
     }
 
    rapidjson::Value focusedEntryVal;
-    focusedEntryVal.SetString(focusedEntry.c_str(), focusedEntry.length());
+    focusedEntryVal.SetString(focusedEntry.c_str(), gsl::narrow<rapidjson::SizeType>(focusedEntry.length()));
     lensVal.AddMember("focused_entry", focusedEntryVal, alloc);
 
     return lensVal;
diff --git a/extensions/libarchive/BinFiles.h b/extensions/libarchive/BinFiles.h
index 604474e..6914618 100644
--- a/extensions/libarchive/BinFiles.h
+++ b/extensions/libarchive/BinFiles.h
@@ -30,6 +30,7 @@
 #include "core/Core.h"
 #include "core/Resource.h"
 #include "core/logging/LoggerConfiguration.h"
+#include "utils/gsl.h"
 #include "utils/Id.h"
 
 namespace org {
@@ -113,7 +114,7 @@
     return creation_dated_;
   }
   int getSize() {
-    return queue_.size();
+    return gsl::narrow<int>(queue_.size());
   }
 
   utils::SmallString<36> getUUIDStr() {
diff --git a/extensions/libarchive/CompressContent.h b/extensions/libarchive/CompressContent.h
index 5c3a775..1a43217 100644
--- a/extensions/libarchive/CompressContent.h
+++ b/extensions/libarchive/CompressContent.h
@@ -34,6 +34,7 @@
 #include "core/logging/LoggerConfiguration.h"
 #include "io/ZlibStream.h"
 #include "utils/Enum.h"
+#include "utils/gsl.h"
 
 namespace org {
 namespace apache {
@@ -183,7 +184,7 @@
 
     static la_ssize_t archive_write(struct archive* /*arch*/, void *context, const void *buff, size_t size) {
       WriteCallback *callback = (WriteCallback *) context;
-      la_ssize_t ret = callback->stream_->write(reinterpret_cast<uint8_t*>(const_cast<void*>(buff)), size);
+      la_ssize_t ret = callback->stream_->write(reinterpret_cast<uint8_t*>(const_cast<void*>(buff)), gsl::narrow<int>(size));
       if (ret > 0)
         callback->size_ += (int64_t) ret;
       return ret;
@@ -332,16 +333,16 @@
         size_ = 0;
         while (size_ < entry_size) {
           char buffer[8192];
-          int ret = archive_read_data(arch, buffer, sizeof(buffer));
-          if (ret < 0) {
+          const auto read_result = archive_read_data(arch, buffer, sizeof(buffer));
+          if (read_result < 0) {
             archive_read_log_error_cleanup(arch);
             return -1;
           }
-          if (ret == 0)
+          if (read_result == 0)
             break;
-          size_ += ret;
-          ret = stream_->write(reinterpret_cast<uint8_t*>(buffer), ret);
-          if (ret < 0) {
+          size_ += read_result;
+          const auto write_result = stream_->write(reinterpret_cast<uint8_t*>(buffer), gsl::narrow<int>(read_result));
+          if (write_result < 0) {
             archive_read_log_error_cleanup(arch);
             return -1;
           }
@@ -382,7 +383,7 @@
           std::vector<uint8_t> buffer(16 * 1024U);
           int64_t read_size = 0;
           while (read_size < gsl::narrow<int64_t>(writer_.flow_->getSize())) {
-            int ret = inputStream->read(buffer.data(), buffer.size());
+            int ret = inputStream->read(buffer.data(), gsl::narrow<int>(buffer.size()));
             if (ret < 0) {
               return -1;
             } else if (ret == 0) {
diff --git a/extensions/libarchive/MergeContent.h b/extensions/libarchive/MergeContent.h
index 341ddca..092b37f 100644
--- a/extensions/libarchive/MergeContent.h
+++ b/extensions/libarchive/MergeContent.h
@@ -26,6 +26,7 @@
 #include "archive.h"
 #include "core/logging/LoggerConfiguration.h"
 #include "serialization/FlowFileSerializer.h"
+#include "utils/gsl.h"
 
 namespace org {
 namespace apache {
@@ -79,7 +80,7 @@
     int64_t process(const std::shared_ptr<io::BaseStream>& stream) {
       int64_t ret = 0;
       if (!header_.empty()) {
-        int64_t len = stream->write(reinterpret_cast<uint8_t*>(const_cast<char*>(header_.data())), header_.size());
+        int64_t len = stream->write(reinterpret_cast<uint8_t*>(const_cast<char*>(header_.data())), gsl::narrow<int>(header_.size()));
         if (len < 0)
           return len;
         ret += len;
@@ -87,7 +88,7 @@
       bool isFirst = true;
       for (auto flow : flows_) {
         if (!isFirst && !demarcator_.empty()) {
-          int64_t len = stream->write(reinterpret_cast<uint8_t*>(const_cast<char*>(demarcator_.data())), demarcator_.size());
+          int64_t len = stream->write(reinterpret_cast<uint8_t*>(const_cast<char*>(demarcator_.data())), gsl::narrow<int>(demarcator_.size()));
           if (len < 0)
             return len;
           ret += len;
@@ -99,7 +100,7 @@
         isFirst = false;
       }
       if (!footer_.empty()) {
-        int64_t len = stream->write(reinterpret_cast<uint8_t*>(const_cast<char*>(footer_.data())), footer_.size());
+        int64_t len = stream->write(reinterpret_cast<uint8_t*>(const_cast<char*>(footer_.data())), gsl::narrow<int>(footer_.size()));
         if (len < 0)
           return len;
         ret += len;
@@ -131,7 +132,7 @@
       int totalWrote = 0;
       int remaining = size;
       while (remaining > 0) {
-        int ret = archive_write_data(arch_, data + totalWrote, remaining);
+        const auto ret = archive_write_data(arch_, data + totalWrote, remaining);
         if (ret < 0) {
           return ret;
         }
@@ -171,7 +172,7 @@
       WriteCallback *callback = (WriteCallback *) context;
       uint8_t* data = reinterpret_cast<uint8_t*>(const_cast<void*>(buff));
       la_ssize_t totalWrote = 0;
-      size_t remaining = size;
+      int remaining = gsl::narrow<int>(size);
       while (remaining > 0) {
         la_ssize_t ret = callback->stream_->write(data + totalWrote, remaining);
         if (ret < 0) {
diff --git a/extensions/libarchive/UnfocusArchiveEntry.cpp b/extensions/libarchive/UnfocusArchiveEntry.cpp
index 1569c34..af1b428 100644
--- a/extensions/libarchive/UnfocusArchiveEntry.cpp
+++ b/extensions/libarchive/UnfocusArchiveEntry.cpp
@@ -31,6 +31,7 @@
 
 #include "core/ProcessContext.h"
 #include "core/ProcessSession.h"
+#include "utils/gsl.h"
 
 namespace org {
 namespace apache {
@@ -155,7 +156,7 @@
 la_ssize_t UnfocusArchiveEntry::WriteCallback::write_cb(struct archive *, void *d, const void *buffer, size_t length) {
   auto data = static_cast<UnfocusArchiveEntryWriteData *>(d);
   const uint8_t *ui_buffer = static_cast<const uint8_t*>(buffer);
-  return data->stream->write(const_cast<uint8_t*>(ui_buffer), length);
+  return data->stream->write(const_cast<uint8_t*>(ui_buffer), gsl::narrow<int>(length));
 }
 
 int64_t UnfocusArchiveEntry::WriteCallback::process(const std::shared_ptr<io::BaseStream>& stream) {
diff --git a/extensions/librdkafka/PublishKafka.cpp b/extensions/librdkafka/PublishKafka.cpp
index 7437f75..d58c8e5 100644
--- a/extensions/librdkafka/PublishKafka.cpp
+++ b/extensions/librdkafka/PublishKafka.cpp
@@ -27,6 +27,7 @@
 #include <set>
 #include <vector>
 
+#include "utils/gsl.h"
 #include "utils/TimeUtil.h"
 #include "utils/StringUtils.h"
 #include "utils/GeneralUtils.h"
@@ -407,7 +408,7 @@
     }
 
     for (size_t segment_num = 0; read_size_ < flow_size_; ++segment_num) {
-      const int readRet = stream->read(buffer.data(), buffer.size());
+      const int readRet = stream->read(buffer.data(), gsl::narrow<int>(buffer.size()));
       if (readRet < 0) {
         status_ = -1;
         error_ = "Failed to read from stream";
diff --git a/extensions/rocksdb-repos/DatabaseContentRepository.cpp b/extensions/rocksdb-repos/DatabaseContentRepository.cpp
index b2a78b0..54e42d4 100644
--- a/extensions/rocksdb-repos/DatabaseContentRepository.cpp
+++ b/extensions/rocksdb-repos/DatabaseContentRepository.cpp
@@ -17,11 +17,14 @@
  */
 
 #include "DatabaseContentRepository.h"
+
 #include <memory>
 #include <string>
+
 #include "RocksDbStream.h"
 #include "rocksdb/merge_operator.h"
 #include "utils/GeneralUtils.h"
+#include "utils/gsl.h"
 #include "Exception.h"
 
 namespace org {
@@ -84,7 +87,7 @@
     if (outStream == nullptr) {
       throw Exception(REPOSITORY_EXCEPTION, "Couldn't open the underlying resource for write: " + resource.first->getContentFullPath());
     }
-    const auto size = resource.second->size();
+    const int size = gsl::narrow<int>(resource.second->size());
     if (outStream->write(const_cast<uint8_t*>(resource.second->getBuffer()), size) != size) {
       throw Exception(REPOSITORY_EXCEPTION, "Failed to write new resource: " + resource.first->getContentFullPath());
     }
@@ -94,7 +97,7 @@
     if (outStream == nullptr) {
       throw Exception(REPOSITORY_EXCEPTION, "Couldn't open the underlying resource for append: " + resource.first->getContentFullPath());
     }
-    const auto size = resource.second->size();
+    const int size = gsl::narrow<int>(resource.second->size());
     if (outStream->write(const_cast<uint8_t*>(resource.second->getBuffer()), size) != size) {
       throw Exception(REPOSITORY_EXCEPTION, "Failed to append to resource: " + resource.first->getContentFullPath());
     }
diff --git a/extensions/rocksdb-repos/FlowFileRepository.cpp b/extensions/rocksdb-repos/FlowFileRepository.cpp
index a7dc5e6..0360143 100644
--- a/extensions/rocksdb-repos/FlowFileRepository.cpp
+++ b/extensions/rocksdb-repos/FlowFileRepository.cpp
@@ -15,13 +15,8 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-#include "FlowFileRecord.h"
 #include "FlowFileRepository.h"
 
-#include "rocksdb/options.h"
-#include "rocksdb/write_batch.h"
-#include "rocksdb/slice.h"
-
 #include <chrono>
 #include <memory>
 #include <string>
@@ -29,6 +24,12 @@
 #include <vector>
 #include <list>
 
+#include "rocksdb/options.h"
+#include "rocksdb/write_batch.h"
+#include "rocksdb/slice.h"
+#include "FlowFileRecord.h"
+#include "utils/gsl.h"
+
 namespace org {
 namespace apache {
 namespace nifi {
@@ -68,7 +69,7 @@
     }
 
     utils::Identifier containerId;
-    auto eventRead = FlowFileRecord::DeSerialize(reinterpret_cast<const uint8_t *>(values[i].data()), values[i].size(), content_repo_, containerId);
+    auto eventRead = FlowFileRecord::DeSerialize(reinterpret_cast<const uint8_t *>(values[i].data()), gsl::narrow<int>(values[i].size()), content_repo_, containerId);
     if (eventRead) {
       purgeList.push_back(eventRead);
     }
@@ -152,7 +153,7 @@
   auto it = opendb->NewIterator(rocksdb::ReadOptions());
   for (it->SeekToFirst(); it->Valid(); it->Next()) {
     utils::Identifier containerId;
-    auto eventRead = FlowFileRecord::DeSerialize(reinterpret_cast<const uint8_t *>(it->value().data()), it->value().size(), content_repo_, containerId);
+    auto eventRead = FlowFileRecord::DeSerialize(reinterpret_cast<const uint8_t *>(it->value().data()), gsl::narrow<int>(it->value().size()), content_repo_, containerId);
     std::string key = it->key().ToString();
     if (eventRead) {
       // on behalf of the just resurrected persisted instance
diff --git a/extensions/standard-processors/processors/GenerateFlowFile.cpp b/extensions/standard-processors/processors/GenerateFlowFile.cpp
index a2dc1b3..bf38689 100644
--- a/extensions/standard-processors/processors/GenerateFlowFile.cpp
+++ b/extensions/standard-processors/processors/GenerateFlowFile.cpp
@@ -34,6 +34,7 @@
 #include <utility>
 #include <vector>
 
+#include "utils/gsl.h"
 #include "utils/StringUtils.h"
 #include "core/ProcessContext.h"
 #include "core/ProcessSession.h"
@@ -62,7 +63,7 @@
 
 core::Relationship GenerateFlowFile::Success("success", "success operational on the flow record");
 
-static const char * TEXT_CHARS = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890!@#$%^&*()-_=+/?.,';:\"?<>\n\t ";
+constexpr const char * TEXT_CHARS = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890!@#$%^&*()-_=+/?.,';:\"?<>\n\t ";
 
 void GenerateFlowFile::initialize() {
   // Set the supported properties
@@ -82,7 +83,8 @@
   std::random_device rd;
   std::mt19937 eng(rd());
   if (textData) {
-    std::uniform_int_distribution<> distr(0, strlen(TEXT_CHARS) - 1);
+    const int index_of_last_char = gsl::narrow<int>(strlen(TEXT_CHARS)) - 1;
+    std::uniform_int_distribution<> distr(0, index_of_last_char);
     auto rand = std::bind(distr, eng);
     std::generate_n(data.begin(), data.size(), rand);
     std::for_each(data.begin(), data.end(), [](char & c) { c = TEXT_CHARS[c];});
diff --git a/extensions/standard-processors/processors/GenerateFlowFile.h b/extensions/standard-processors/processors/GenerateFlowFile.h
index b5d7dfd..608f7c0 100644
--- a/extensions/standard-processors/processors/GenerateFlowFile.h
+++ b/extensions/standard-processors/processors/GenerateFlowFile.h
@@ -30,6 +30,7 @@
 #include "core/ProcessSession.h"
 #include "core/Core.h"
 #include "core/Resource.h"
+#include "utils/gsl.h"
 
 namespace org {
 namespace apache {
@@ -73,7 +74,7 @@
     int64_t process(const std::shared_ptr<io::BaseStream>& stream) {
       int64_t ret = 0;
       if (data_.size() > 0)
-        ret = stream->write(reinterpret_cast<uint8_t*>(&data_[0]), data_.size());
+        ret = stream->write(reinterpret_cast<uint8_t*>(&data_[0]), gsl::narrow<int>(data_.size()));
       return ret;
     }
   };
diff --git a/extensions/standard-processors/processors/GetTCP.h b/extensions/standard-processors/processors/GetTCP.h
index 58cfb82..48883ed 100644
--- a/extensions/standard-processors/processors/GetTCP.h
+++ b/extensions/standard-processors/processors/GetTCP.h
@@ -35,6 +35,7 @@
 #include "utils/ThreadPool.h"
 #include "core/logging/LoggerConfiguration.h"
 #include "controllers/SSLContextService.h"
+#include "utils/gsl.h"
 
 namespace org {
 namespace apache {
@@ -94,7 +95,7 @@
   ~DataHandlerCallback() override = default;
 
   int64_t process(const std::shared_ptr<io::BaseStream>& stream) override {
-    return stream->write(message_, size_);
+    return stream->write(message_, gsl::narrow<int>(size_));
   }
 
  private:
diff --git a/extensions/standard-processors/processors/LogAttribute.h b/extensions/standard-processors/processors/LogAttribute.h
index d1df602..7694230 100644
--- a/extensions/standard-processors/processors/LogAttribute.h
+++ b/extensions/standard-processors/processors/LogAttribute.h
@@ -31,6 +31,7 @@
 #include "core/Core.h"
 #include "core/Resource.h"
 #include "core/logging/LoggerConfiguration.h"
+#include "utils/gsl.h"
 
 namespace org {
 namespace apache {
@@ -106,7 +107,7 @@
       if (buffer_.size() == 0U) {
         return 0U;
       }
-      int ret = stream->read(buffer_.data(), buffer_.size());
+      int ret = stream->read(buffer_.data(), gsl::narrow<int>(buffer_.size()));
       if (ret != buffer_.size()) {
         logger_->log_error("%zu bytes were requested from the stream but %d bytes were read. Rolling back.", buffer_.size(), ret);
         throw Exception(PROCESSOR_EXCEPTION, "Failed to read the entire FlowFile.");
diff --git a/extensions/standard-processors/tests/unit/GetTCPTests.cpp b/extensions/standard-processors/tests/unit/GetTCPTests.cpp
index e1470a7..27e223b 100644
--- a/extensions/standard-processors/tests/unit/GetTCPTests.cpp
+++ b/extensions/standard-processors/tests/unit/GetTCPTests.cpp
@@ -34,6 +34,7 @@
 #include "core/ProcessSession.h"
 #include "core/ProcessorNode.h"
 #include "core/reporting/SiteToSiteProvenanceReportingTask.h"
+#include "utils/gsl.h"
 
 TEST_CASE("GetTCPWithoutEOM", "[GetTCP1]") {
   utils::Identifier ident = utils::Identifier();
@@ -111,7 +112,7 @@
   std::shared_ptr<core::ProcessSessionFactory> factory = std::make_shared<core::ProcessSessionFactory>(context);
   processor->onSchedule(context, factory);
   processor->onTrigger(context, session);
-  server.write(buffer, buffer.size());
+  server.write(buffer, gsl::narrow<int>(buffer.size()));
   std::this_thread::sleep_for(std::chrono::seconds(2));
 
   logAttribute->initialize();
@@ -226,7 +227,7 @@
   std::shared_ptr<core::ProcessSessionFactory> factory = std::make_shared<core::ProcessSessionFactory>(context);
   processor->onSchedule(context, factory);
   processor->onTrigger(context, session);
-  server.write(buffer, buffer.size());
+  server.write(buffer, gsl::narrow<int>(buffer.size()));
   std::this_thread::sleep_for(std::chrono::seconds(2));
 
   logAttribute->initialize();
@@ -350,7 +351,7 @@
   std::shared_ptr<core::ProcessSessionFactory> factory = std::make_shared<core::ProcessSessionFactory>(context);
   processor->onSchedule(context, factory);
   processor->onTrigger(context, session);
-  server.write(buffer, buffer.size());
+  server.write(buffer, gsl::narrow<int>(buffer.size()));
   std::this_thread::sleep_for(std::chrono::seconds(2));
 
   logAttribute->initialize();
diff --git a/extensions/windows-event-log/CollectorInitiatedSubscription.cpp b/extensions/windows-event-log/CollectorInitiatedSubscription.cpp
index 54f6933..9215884 100644
--- a/extensions/windows-event-log/CollectorInitiatedSubscription.cpp
+++ b/extensions/windows-event-log/CollectorInitiatedSubscription.cpp
@@ -634,7 +634,7 @@
     }
 
     int64_t process(const std::shared_ptr<io::BaseStream>& stream) {
-      return stream->write((uint8_t*)&str_[0], str_.size());
+      return stream->write((uint8_t*)&str_[0], gsl::narrow<int>(str_.size()));
     }
 
     std::string str_;
diff --git a/extensions/windows-event-log/ConsumeWindowsEventLog.cpp b/extensions/windows-event-log/ConsumeWindowsEventLog.cpp
index e3b6ae9..22442f9 100644
--- a/extensions/windows-event-log/ConsumeWindowsEventLog.cpp
+++ b/extensions/windows-event-log/ConsumeWindowsEventLog.cpp
@@ -652,7 +652,7 @@
     }
 
     int64_t process(const std::shared_ptr<io::BaseStream>& stream) {
-      return stream->write(reinterpret_cast<uint8_t*>(const_cast<char*>(str_.c_str())), str_.size());
+      return stream->write(reinterpret_cast<uint8_t*>(const_cast<char*>(str_.c_str())), gsl::narrow<int>(str_.size()));
     }
 
     const std::string& str_;
diff --git a/extensions/windows-event-log/tests/BookmarkTests.cpp b/extensions/windows-event-log/tests/BookmarkTests.cpp
index d42ebad..ffe3026 100644
--- a/extensions/windows-event-log/tests/BookmarkTests.cpp
+++ b/extensions/windows-event-log/tests/BookmarkTests.cpp
@@ -56,7 +56,7 @@
   std::array<wchar_t, BUFFER_SIZE> buffer = {};
   DWORD buffer_used;
   DWORD property_count;
-  if (!EvtRender(nullptr, event, EvtRenderBookmark, buffer.size(), buffer.data(), &buffer_used, &property_count)) {
+  if (!EvtRender(nullptr, event, EvtRenderBookmark, gsl::narrow<DWORD>(buffer.size()), buffer.data(), &buffer_used, &property_count)) {
     FAIL("EvtRender() failed; error code: " << GetLastError());
   }
   return std::wstring{buffer.data()};
diff --git a/libminifi/include/FlowControlProtocol.h b/libminifi/include/FlowControlProtocol.h
index ac3b060..3238cc2 100644
--- a/libminifi/include/FlowControlProtocol.h
+++ b/libminifi/include/FlowControlProtocol.h
@@ -36,6 +36,7 @@
 #include "core/Property.h"
 #include "properties/Configure.h"
 #include "utils/file/FileUtils.h"
+#include "utils/gsl.h"
 
 namespace org {
 namespace apache {
@@ -244,8 +245,8 @@
   // encode std::string
   uint8_t *encode(uint8_t *buf, const std::string& value) {
     // add the \0 for size
-    buf = encode(buf, value.size() + 1);
-    buf = encode(buf, const_cast<uint8_t*>(reinterpret_cast<const uint8_t*>(value.c_str())), value.size() + 1);
+    buf = encode(buf, gsl::narrow<uint32_t>(value.size() + 1));
+    buf = encode(buf, const_cast<uint8_t*>(reinterpret_cast<const uint8_t*>(value.c_str())), gsl::narrow<int>(value.size() + 1));
     return buf;
   }
 
diff --git a/libminifi/include/agent/build_description.h b/libminifi/include/agent/build_description.h
index aeb9bed..de92612 100644
--- a/libminifi/include/agent/build_description.h
+++ b/libminifi/include/agent/build_description.h
@@ -127,7 +127,7 @@
         auto lastOfIdx = clazz.find_last_of("::");
         if (lastOfIdx != std::string::npos) {
           lastOfIdx++;  // if a value is found, increment to move beyond the .
-          int nameLength = clazz.length() - lastOfIdx;
+          size_t nameLength = clazz.length() - lastOfIdx;
           class_name = clazz.substr(lastOfIdx, nameLength);
         }
         auto obj = core::ClassLoader::getDefaultClassLoader().instantiate(class_name, class_name);
diff --git a/libminifi/include/c2/PayloadSerializer.h b/libminifi/include/c2/PayloadSerializer.h
index b03da5e..89042c9 100644
--- a/libminifi/include/c2/PayloadSerializer.h
+++ b/libminifi/include/c2/PayloadSerializer.h
@@ -27,6 +27,8 @@
 #include "core/state/Value.h"
 #include "c2/C2Protocol.h"
 #include "io/BaseStream.h"
+#include "utils/gsl.h"
+
 namespace org {
 namespace apache {
 namespace nifi {
@@ -74,7 +76,7 @@
   }
   static void serialize(uint16_t op, const C2Payload &payload, std::shared_ptr<io::BaseStream> stream) {
     uint8_t st;
-    uint32_t size = payload.getNestedPayloads().size();
+    uint32_t size = gsl::narrow<uint32_t>(payload.getNestedPayloads().size());
     stream->write(size);
     for (auto nested_payload : payload.getNestedPayloads()) {
       op = opToInt(nested_payload.getOperation());
@@ -83,11 +85,11 @@
       stream->write(nested_payload.getLabel());
       stream->write(nested_payload.getIdentifier());
       const std::vector<C2ContentResponse> &content = nested_payload.getContent();
-      size = content.size();
+      size = gsl::narrow<uint32_t>(content.size());
       stream->write(size);
       for (const auto &payload_content : content) {
         stream->write(payload_content.name);
-        size = payload_content.operation_arguments.size();
+        size = gsl::narrow<uint32_t>(payload_content.operation_arguments.size());
         stream->write(size);
         for (auto content : payload_content.operation_arguments) {
           stream->write(content.first);
@@ -152,11 +154,11 @@
 
     stream->write(payload.getIdentifier());
     const std::vector<C2ContentResponse> &content = payload.getContent();
-    uint32_t size = content.size();
+    uint32_t size = gsl::narrow<uint32_t>(content.size());
     stream->write(size);
     for (const auto &payload_content : content) {
       stream->write(payload_content.name);
-      size = payload_content.operation_arguments.size();
+      size = gsl::narrow<uint32_t>(payload_content.operation_arguments.size());
       stream->write(size);
       for (auto content : payload_content.operation_arguments) {
         stream->write(content.first);
@@ -247,7 +249,7 @@
     return true;
   }
   static bool deserialize(std::vector<uint8_t> data, C2Payload &payload) {
-    io::BufferStream stream(data.data(), data.size());
+    io::BufferStream stream(data.data(), gsl::narrow<unsigned int>(data.size()));
 
     uint8_t op, st = 0;
     uint16_t version = 0;
diff --git a/libminifi/include/core/repository/VolatileFlowFileRepository.h b/libminifi/include/core/repository/VolatileFlowFileRepository.h
index 88a2d80..73df967 100644
--- a/libminifi/include/core/repository/VolatileFlowFileRepository.h
+++ b/libminifi/include/core/repository/VolatileFlowFileRepository.h
@@ -23,6 +23,7 @@
 
 #include "VolatileRepository.h"
 #include "FlowFileRecord.h"
+#include "utils/gsl.h"
 
 namespace org {
 namespace apache {
@@ -62,7 +63,8 @@
       std::lock_guard<std::mutex> lock(purge_mutex_);
       for (auto purgeItem : purge_list_) {
         utils::Identifier containerId;
-        auto eventRead = FlowFileRecord::DeSerialize(reinterpret_cast<const uint8_t *>(purgeItem.data()), purgeItem.size(), content_repo_, containerId);
+        auto eventRead = FlowFileRecord::DeSerialize(reinterpret_cast<const uint8_t *>(purgeItem.data()), gsl::narrow<int>(purgeItem.size()),
+                                                     content_repo_, containerId);
         if (eventRead) {
           auto claim = eventRead->getResourceClaim();
           if (claim) claim->decreaseFlowFileRecordOwnedCount();
diff --git a/libminifi/include/core/state/nodes/AgentInformation.h b/libminifi/include/core/state/nodes/AgentInformation.h
index 63b1e36..4e70686 100644
--- a/libminifi/include/core/state/nodes/AgentInformation.h
+++ b/libminifi/include/core/state/nodes/AgentInformation.h
@@ -276,7 +276,7 @@
         std::string processorName = group.class_name_;
         if (lastOfIdx != std::string::npos) {
           lastOfIdx++;  // if a value is found, increment to move beyond the .
-          int nameLength = group.class_name_.length() - lastOfIdx;
+          size_t nameLength = group.class_name_.length() - lastOfIdx;
           processorName = group.class_name_.substr(lastOfIdx, nameLength);
         }
         std::string description;
diff --git a/libminifi/include/io/AtomicEntryStream.h b/libminifi/include/io/AtomicEntryStream.h
index 4be2847..13679ce 100644
--- a/libminifi/include/io/AtomicEntryStream.h
+++ b/libminifi/include/io/AtomicEntryStream.h
@@ -23,10 +23,13 @@
 #include <mutex>
 #include <cstring>
 #include <algorithm>
+
 #include "BaseStream.h"
 #include "core/repository/AtomicRepoEntries.h"
 #include "Exception.h"
 #include "core/logging/LoggerConfiguration.h"
+#include "utils/gsl.h"
+
 namespace org {
 namespace apache {
 namespace nifi {
@@ -137,7 +140,7 @@
     core::repository::RepoValue<T> *value;
     if (entry_->getValue(key_, &value)) {
       if (offset_ + len > value->getBufferSize()) {
-        len = value->getBufferSize() - offset_;
+        len = gsl::narrow<int>(value->getBufferSize()) - gsl::narrow<int>(offset_);
         if (len <= 0) {
           entry_->decrementOwnership();
           return 0;
diff --git a/libminifi/include/io/BufferStream.h b/libminifi/include/io/BufferStream.h
index c393abb..3f0bfdc 100644
--- a/libminifi/include/io/BufferStream.h
+++ b/libminifi/include/io/BufferStream.h
@@ -23,6 +23,7 @@
 #include <vector>
 #include <string>
 #include "BaseStream.h"
+#include "utils/gsl.h"
 
 namespace org {
 namespace apache {
@@ -39,7 +40,7 @@
   }
 
   explicit BufferStream(const std::string& data) {
-    write(reinterpret_cast<const uint8_t*>(data.c_str()), data.length());
+    write(reinterpret_cast<const uint8_t*>(data.c_str()), gsl::narrow<int>(data.length()));
   }
 
   using BaseStream::read;
diff --git a/libminifi/include/provenance/Provenance.h b/libminifi/include/provenance/Provenance.h
index 285a33f..3b7b4f7 100644
--- a/libminifi/include/provenance/Provenance.h
+++ b/libminifi/include/provenance/Provenance.h
@@ -18,12 +18,13 @@
 #ifndef LIBMINIFI_INCLUDE_PROVENANCE_PROVENANCE_H_
 #define LIBMINIFI_INCLUDE_PROVENANCE_PROVENANCE_H_
 
-#include <memory>
+#include <algorithm>
 #include <atomic>
 #include <cstdint>
 #include <cstring>
 #include <iostream>
 #include <map>
+#include <memory>
 #include <set>
 #include <string>
 #include <thread>
@@ -37,6 +38,7 @@
 #include "FlowFileRecord.h"
 #include "core/logging/LoggerConfiguration.h"
 #include "ResourceClaim.h"
+#include "utils/gsl.h"
 #include "utils/Id.h"
 #include "utils/TimeUtil.h"
 
@@ -360,8 +362,8 @@
   bool DeSerialize(const std::shared_ptr<core::SerializableComponent> &repo);
 
   uint64_t getEventTime(const uint8_t *buffer, const size_t bufferSize) {
-    int size = bufferSize > 72 ? 72 : bufferSize;
-    org::apache::nifi::minifi::io::BufferStream outStream(buffer, size);
+    const auto size = std::min<size_t>(72, bufferSize);
+    org::apache::nifi::minifi::io::BufferStream outStream(buffer, gsl::narrow<int>(size));
 
     std::string uuid;
     int ret = outStream.read(uuid);
diff --git a/libminifi/include/utils/HTTPClient.h b/libminifi/include/utils/HTTPClient.h
index a03d248..82aa55b 100644
--- a/libminifi/include/utils/HTTPClient.h
+++ b/libminifi/include/utils/HTTPClient.h
@@ -35,6 +35,7 @@
 #include "ByteArrayCallback.h"
 #include "controllers/SSLContextService.h"
 #include "core/Deprecated.h"
+#include "utils/gsl.h"
 
 namespace org {
 namespace apache {
@@ -278,7 +279,7 @@
       size_to_read = data.size();
     }
     memcpy(buf, data.data(), size_to_read);
-    return size_to_read;
+    return gsl::narrow<int>(size_to_read);
   }
 
   size_t write_content(char* ptr, size_t size, size_t nmemb) {
diff --git a/libminifi/include/utils/StringUtils.h b/libminifi/include/utils/StringUtils.h
index 04201cb..7dcfc49 100644
--- a/libminifi/include/utils/StringUtils.h
+++ b/libminifi/include/utils/StringUtils.h
@@ -33,6 +33,7 @@
 #include <type_traits>
 #include "utils/FailurePolicy.h"
 #include "utils/GeneralUtils.h"
+#include "utils/gsl.h"
 #include "utils/OptionalUtils.h"
 
 #if defined(WIN32) || (__cplusplus >= 201103L && (!defined(__GLIBCXX__) || (__cplusplus >= 201402L) ||  (defined(_GLIBCXX_RELEASE) && _GLIBCXX_RELEASE > 4)))
@@ -134,7 +135,7 @@
    */
   static bool StringToFloat(std::string input, float &output, FailurePolicy cp = RETURN);
 
-  static std::string replaceEnvironmentVariables(std::string& original_string);
+  static std::string replaceEnvironmentVariables(std::string source_string);
 
   static std::string replaceOne(const std::string &input, const std::string &from, const std::string &to);
 
@@ -159,9 +160,9 @@
   }
 
   inline static std::string hex_ascii(const std::string& in) {
-    int len = in.length();
     std::string newString;
-    for (int i = 0; i < len; i += 2) {
+    newString.reserve(in.length() / 2);
+    for (size_t i = 0; i < in.length(); i += 2) {
       std::string sstr = in.substr(i, 2);
       char chr = (char) (int) strtol(sstr.c_str(), 0x00, 16); // NOLINT
       newString.push_back(chr);
@@ -498,7 +499,7 @@
 
   static std::pair<size_t, int> countOccurrences(const std::string &str, const std::string &pattern) {
     if (pattern.empty()) {
-      return {str.size(), str.size() + 1};
+      return {str.size(), gsl::narrow<int>(str.size() + 1)};
     }
 
     size_t last_pos = 0;
diff --git a/libminifi/include/utils/file/FileUtils.h b/libminifi/include/utils/file/FileUtils.h
index 603d171..721b455 100644
--- a/libminifi/include/utils/file/FileUtils.h
+++ b/libminifi/include/utils/file/FileUtils.h
@@ -85,6 +85,7 @@
 #include "core/logging/LoggerConfiguration.h"
 #include "utils/StringUtils.h"
 #include "utils/file/PathUtils.h"
+#include "utils/gsl.h"
 
 #ifndef S_ISDIR
 #define S_ISDIR(mode)  (((mode) & S_IFMT) == S_IFDIR)
@@ -729,7 +730,7 @@
     }
     std::vector<char> buf(1024U);
     while (true) {
-      size_t ret = GetModuleFileNameA(hModule, buf.data(), buf.size());
+      size_t ret = GetModuleFileNameA(hModule, buf.data(), gsl::narrow<DWORD>(buf.size()));
       if (ret == 0U) {
         return "";
       }
diff --git a/libminifi/src/FlowControlProtocol.cpp b/libminifi/src/FlowControlProtocol.cpp
index 5a2b0e2..8d8ad4a 100644
--- a/libminifi/src/FlowControlProtocol.cpp
+++ b/libminifi/src/FlowControlProtocol.cpp
@@ -193,7 +193,7 @@
   data = this->encode(data, this->_controller->getName());
 
   // send it
-  int status = sendData(buffer.data(), size);
+  int status = sendData(buffer.data(), gsl::narrow<int>(size));
   buffer.clear();
   if (status <= 0) {
     utils::file::FileUtils::close(_socket);
@@ -287,7 +287,7 @@
   data = this->encode(data, this->_controller->getName());
 
   // send it
-  int status = sendData(buffer.data(), size);
+  int status = sendData(buffer.data(), gsl::narrow<int>(size));
   buffer.clear();
   if (status <= 0) {
     utils::file::FileUtils::close(_socket);
diff --git a/libminifi/src/FlowFileRecord.cpp b/libminifi/src/FlowFileRecord.cpp
index eec81bf..813137b 100644
--- a/libminifi/src/FlowFileRecord.cpp
+++ b/libminifi/src/FlowFileRecord.cpp
@@ -31,6 +31,7 @@
 #include "core/logging/LoggerConfiguration.h"
 #include "core/Relationship.h"
 #include "core/Repository.h"
+#include "utils/gsl.h"
 
 namespace org {
 namespace apache {
@@ -55,7 +56,7 @@
     logger_->log_error("NiFi FlowFile Store event %s can not found", key);
     return nullptr;
   }
-  io::BufferStream stream((const uint8_t*) value.data(), value.length());
+  io::BufferStream stream((const uint8_t*) value.data(), gsl::narrow<int>(value.length()));
 
   auto record = DeSerialize(stream, content_repo, container);
 
@@ -100,7 +101,7 @@
     return false;
   }
   // write flow attributes
-  uint32_t numAttributes = attributes_.size();
+  uint32_t numAttributes = gsl::narrow<uint32_t>(attributes_.size());
   ret = outStream.write(numAttributes);
   if (ret != 4) {
     return false;
diff --git a/libminifi/src/c2/C2Agent.cpp b/libminifi/src/c2/C2Agent.cpp
index 36ff43c..eb49f3f 100644
--- a/libminifi/src/c2/C2Agent.cpp
+++ b/libminifi/src/c2/C2Agent.cpp
@@ -660,12 +660,16 @@
   }
 
   std::string command = cwd + "/bin/minifi.sh restart";
-  system(command.c_str());
+  if (system(command.c_str()) != 0) {
+    logger_->log_warn("System command '%s' failed", command);
+  }
 }
 
 void C2Agent::update_agent() {
-  if (!system(update_command_.c_str())) {
-    logger_->log_warn("May not have command processor");
+  if (system(update_command_.c_str()) == 0) {
+    logger_->log_info("Executed update command '%s'", update_command_);
+  } else {
+    logger_->log_warn("Update command %s failed; may not have command processor", update_command_);
   }
 }
 
diff --git a/libminifi/src/c2/ControllerSocketProtocol.cpp b/libminifi/src/c2/ControllerSocketProtocol.cpp
index dd6464d..8322302 100644
--- a/libminifi/src/c2/ControllerSocketProtocol.cpp
+++ b/libminifi/src/c2/ControllerSocketProtocol.cpp
@@ -24,6 +24,7 @@
 #include <utility>
 #include <vector>
 
+#include "utils/gsl.h"
 #include "utils/StringUtils.h"
 
 namespace org {
@@ -179,7 +180,7 @@
             io::BufferStream resp;
             resp.write(&head, 1);
             resp.write(response.str());
-            stream->write(const_cast<uint8_t*>(resp.getBuffer()), resp.size());
+            stream->write(const_cast<uint8_t*>(resp.getBuffer()), gsl::narrow<int>(resp.size()));
           } else if (what == "components") {
             io::BufferStream resp;
             resp.write(&head, 1);
@@ -189,7 +190,7 @@
               resp.write(component->getComponentName());
               resp.write(component->isRunning() ? "true" : "false");
             }
-            stream->write(const_cast<uint8_t*>(resp.getBuffer()), resp.size());
+            stream->write(const_cast<uint8_t*>(resp.getBuffer()), gsl::narrow<int>(resp.size()));
           } else if (what == "jstack") {
             io::BufferStream resp;
             resp.write(&head, 1);
@@ -205,7 +206,7 @@
                 resp.write(line);
               }
             }
-            stream->write(const_cast<uint8_t*>(resp.getBuffer()), resp.size());
+            stream->write(const_cast<uint8_t*>(resp.getBuffer()), gsl::narrow<int>(resp.size()));
           } else if (what == "connections") {
             io::BufferStream resp;
             resp.write(&head, 1);
@@ -214,7 +215,7 @@
             for (const auto &connection : queue_full_) {
               resp.write(connection.first, false);
             }
-            stream->write(const_cast<uint8_t*>(resp.getBuffer()), resp.size());
+            stream->write(const_cast<uint8_t*>(resp.getBuffer()), gsl::narrow<int>(resp.size()));
           } else if (what == "getfull") {
             std::vector<std::string> full_connections;
             {
@@ -232,7 +233,7 @@
             for (auto conn : full_connections) {
               resp.write(conn);
             }
-            stream->write(const_cast<uint8_t*>(resp.getBuffer()), resp.size());
+            stream->write(const_cast<uint8_t*>(resp.getBuffer()), gsl::narrow<int>(resp.size()));
           }
         }
         break;
diff --git a/libminifi/src/c2/protocols/RESTProtocol.cpp b/libminifi/src/c2/protocols/RESTProtocol.cpp
index 23a9e8d..8903c71 100644
--- a/libminifi/src/c2/protocols/RESTProtocol.cpp
+++ b/libminifi/src/c2/protocols/RESTProtocol.cpp
@@ -27,6 +27,7 @@
 #include <vector>
 
 #include "core/TypedValues.h"
+#include "utils/gsl.h"
 
 namespace org {
 namespace apache {
@@ -147,13 +148,13 @@
   rapidjson::Value valueVal;
   const char* c_key = key.c_str();
   auto base_type = value.getValue();
-  keyVal.SetString(c_key, key.length(), alloc);
+  keyVal.SetString(c_key, gsl::narrow<rapidjson::SizeType>(key.length()), alloc);
 
   auto type_index = base_type->getTypeIndex();
   if (auto sub_type = std::dynamic_pointer_cast<core::TransformableValue>(base_type)) {
     auto str = base_type->getStringValue();
     const char* c_val = str.c_str();
-    valueVal.SetString(c_val, str.length(), alloc);
+    valueVal.SetString(c_val, gsl::narrow<rapidjson::SizeType>(str.length()), alloc);
   } else {
     if (type_index == state::response::Value::BOOL_TYPE) {
       bool value = false;
@@ -178,7 +179,7 @@
     } else {
       auto str = base_type->getStringValue();
       const char* c_val = str.c_str();
-      valueVal.SetString(c_val, str.length(), alloc);
+      valueVal.SetString(c_val, gsl::narrow<rapidjson::SizeType>(str.length()), alloc);
     }
   }
   parent.AddMember(keyVal, valueVal, alloc);
@@ -186,7 +187,7 @@
 
 rapidjson::Value RESTProtocol::getStringValue(const std::string& value, rapidjson::Document::AllocatorType& alloc) {  // NOLINT
   rapidjson::Value Val;
-  Val.SetString(value.c_str(), value.length(), alloc);
+  Val.SetString(value.c_str(), gsl::narrow<rapidjson::SizeType>(value.length()), alloc);
   return Val;
 }
 
@@ -215,7 +216,7 @@
     for (const auto &payload_content : content) {
       for (const auto& op_arg : payload_content.operation_arguments) {
         rapidjson::Value keyVal;
-        keyVal.SetString(op_arg.first.c_str(), op_arg.first.length(), alloc);
+        keyVal.SetString(op_arg.first.c_str(), gsl::narrow<rapidjson::SizeType>(op_arg.first.length()), alloc);
         if (is_parent_array) {
           target.PushBack(keyVal, alloc);
         } else {
@@ -253,7 +254,7 @@
 
   rapidjson::Value opReqStrVal;
   std::string operation_request_str = getOperation(payload);
-  opReqStrVal.SetString(operation_request_str.c_str(), operation_request_str.length(), alloc);
+  opReqStrVal.SetString(operation_request_str.c_str(), gsl::narrow<rapidjson::SizeType>(operation_request_str.length()), alloc);
   json_payload.AddMember("operation", opReqStrVal, alloc);
 
   std::string operationid = payload.getIdentifier();
diff --git a/libminifi/src/controllers/LinuxPowerManagementService.cpp b/libminifi/src/controllers/LinuxPowerManagementService.cpp
index 5707b1b..4fcdc59 100644
--- a/libminifi/src/controllers/LinuxPowerManagementService.cpp
+++ b/libminifi/src/controllers/LinuxPowerManagementService.cpp
@@ -24,6 +24,7 @@
 #include <utility>
 #include <vector>
 
+#include "utils/gsl.h"
 #include "utils/StringUtils.h"
 
 namespace org {
@@ -135,7 +136,7 @@
   }
 
   // average
-  battery_level_ = battery_sum / paths_.size();
+  battery_level_ = battery_sum / gsl::narrow<int>(paths_.size());
 
   // only reduce if we're still going down OR we've triggered the low battery threshold
   if (battery_level_ < trigger_ && (battery_level_ < prev_level || battery_level_ < low_battery_trigger_)) {
diff --git a/libminifi/src/core/ContentSession.cpp b/libminifi/src/core/ContentSession.cpp
index 8d761d3..14221ca 100644
--- a/libminifi/src/core/ContentSession.cpp
+++ b/libminifi/src/core/ContentSession.cpp
@@ -22,6 +22,7 @@
 #include "ResourceClaim.h"
 #include "io/BaseStream.h"
 #include "Exception.h"
+#include "utils/gsl.h"
 
 namespace org {
 namespace apache {
@@ -71,8 +72,9 @@
     if (outStream == nullptr) {
       throw Exception(REPOSITORY_EXCEPTION, "Couldn't open the underlying resource for write: " + resource.first->getContentFullPath());
     }
-    const auto size = resource.second->size();
-    if (outStream->write(const_cast<uint8_t*>(resource.second->getBuffer()), size) != size) {
+    const int size = gsl::narrow<int>(resource.second->size());
+    const int bytes_written = outStream->write(const_cast<uint8_t*>(resource.second->getBuffer()), size);
+    if (bytes_written != size) {
       throw Exception(REPOSITORY_EXCEPTION, "Failed to write new resource: " + resource.first->getContentFullPath());
     }
   }
@@ -81,8 +83,9 @@
     if (outStream == nullptr) {
       throw Exception(REPOSITORY_EXCEPTION, "Couldn't open the underlying resource for append: " + resource.first->getContentFullPath());
     }
-    const auto size = resource.second->size();
-    if (outStream->write(const_cast<uint8_t*>(resource.second->getBuffer()), size) != size) {
+    const int size = gsl::narrow<int>(resource.second->size());
+    const int bytes_written = outStream->write(const_cast<uint8_t*>(resource.second->getBuffer()), size);
+    if (bytes_written != size) {
       throw Exception(REPOSITORY_EXCEPTION, "Failed to append to resource: " + resource.first->getContentFullPath());
     }
   }
diff --git a/libminifi/src/core/ProcessSession.cpp b/libminifi/src/core/ProcessSession.cpp
index edb2a00..f8f885e 100644
--- a/libminifi/src/core/ProcessSession.cpp
+++ b/libminifi/src/core/ProcessSession.cpp
@@ -301,11 +301,11 @@
 
     stream->seek(flow->getOffset());
 
-    int ret = callback->process(stream);
+    auto ret = callback->process(stream);
     if (ret < 0) {
       throw Exception(FILE_OPERATION_EXCEPTION, "Failed to process flowfile content");
     }
-    return ret;
+    return gsl::narrow<int>(ret);
   } catch (std::exception &exception) {
     logger_->log_debug("Caught Exception %s", exception.what());
     throw;
@@ -326,7 +326,7 @@
  */
 void ProcessSession::importFrom(io::InputStream &stream, const std::shared_ptr<core::FlowFile> &flow) {
   std::shared_ptr<ResourceClaim> claim = content_session_->create();
-  size_t max_read = getpagesize();
+  int max_read = getpagesize();
   std::vector<uint8_t> charBuffer(max_read);
 
   try {
@@ -336,10 +336,10 @@
     if (nullptr == content_stream) {
       throw Exception(FILE_OPERATION_EXCEPTION, "Could not obtain claim for " + claim->getContentFullPath());
     }
-    size_t position = 0;
-    const size_t max_size = stream.size();
+    int position = 0;
+    const int max_size = gsl::narrow<int>(stream.size());
     while (position < max_size) {
-      const size_t read_size = std::min(max_read, max_size - position);
+      const int read_size = std::min(max_read, max_size - position);
       stream.read(charBuffer, read_size);
 
       content_stream->write(charBuffer.data(), read_size);
@@ -395,7 +395,7 @@
       while (input.good()) {
         input.read(reinterpret_cast<char*>(charBuffer.data()), size);
         if (input) {
-          if (stream->write(charBuffer.data(), size) < 0) {
+          if (stream->write(charBuffer.data(), gsl::narrow<int>(size)) < 0) {
             invalidWrite = true;
             break;
           }
diff --git a/libminifi/src/core/reporting/SiteToSiteProvenanceReportingTask.cpp b/libminifi/src/core/reporting/SiteToSiteProvenanceReportingTask.cpp
index 621370e..7dc203e 100644
--- a/libminifi/src/core/reporting/SiteToSiteProvenanceReportingTask.cpp
+++ b/libminifi/src/core/reporting/SiteToSiteProvenanceReportingTask.cpp
@@ -17,6 +17,11 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+#include <rapidjson/document.h>
+#include <rapidjson/writer.h>
+#include <rapidjson/stringbuffer.h>
+#include <rapidjson/prettywriter.h>
+
 #include <vector>
 #include <queue>
 #include <map>
@@ -27,6 +32,7 @@
 #include <functional>
 #include <iostream>
 #include <utility>
+
 #include "core/Repository.h"
 #include "core/reporting/SiteToSiteProvenanceReportingTask.h"
 #include "../include/io/StreamFactory.h"
@@ -36,12 +42,7 @@
 #include "core/ProcessSession.h"
 #include "provenance/Provenance.h"
 #include "FlowController.h"
-
-#include "rapidjson/document.h"
-#include "rapidjson/writer.h"
-#include "rapidjson/stringbuffer.h"
-#include "rapidjson/prettywriter.h"
-
+#include "utils/gsl.h"
 
 namespace org {
 namespace apache {
@@ -62,35 +63,35 @@
   const char* c_key = key.c_str();
   const char* c_val = value.c_str();
 
-  keyVal.SetString(c_key, key.length(), alloc);
-  valueVal.SetString(c_val, value.length(), alloc);
+  keyVal.SetString(c_key, gsl::narrow<rapidjson::SizeType>(key.length()), alloc);
+  valueVal.SetString(c_val, gsl::narrow<rapidjson::SizeType>(value.length()), alloc);
 
   parent.AddMember(keyVal, valueVal, alloc);
 }
 
 rapidjson::Value getStringValue(const std::string& value, rapidjson::Document::AllocatorType& alloc) {
   rapidjson::Value Val;
-  Val.SetString(value.c_str(), value.length(), alloc);
+  Val.SetString(value.c_str(), gsl::narrow<rapidjson::SizeType>(value.length()), alloc);
   return Val;
 }
 
 template<size_t N>
 rapidjson::Value getStringValue(const utils::SmallString<N>& value, rapidjson::Document::AllocatorType& alloc) {
   rapidjson::Value Val;
-  Val.SetString(value.c_str(), value.length(), alloc);
+  Val.SetString(value.c_str(), gsl::narrow<rapidjson::SizeType>(value.length()), alloc);
   return Val;
 }
 
 void appendJsonStr(const std::string& value, rapidjson::Value& parent, rapidjson::Document::AllocatorType& alloc) {
   rapidjson::Value valueVal;
-  valueVal.SetString(value.c_str(), value.length(), alloc);
+  valueVal.SetString(value.c_str(), gsl::narrow<rapidjson::SizeType>(value.length()), alloc);
   parent.PushBack(valueVal, alloc);
 }
 
 template<size_t N>
 void appendJsonStr(const utils::SmallString<N>& value, rapidjson::Value& parent, rapidjson::Document::AllocatorType& alloc) {
   rapidjson::Value valueVal;
-  valueVal.SetString(value.c_str(), value.length(), alloc);
+  valueVal.SetString(value.c_str(), gsl::narrow<rapidjson::SizeType>(value.length()), alloc);
   parent.PushBack(valueVal, alloc);
 }
 
@@ -144,7 +145,7 @@
     recordJson.AddMember("childIds", childUuidJson, alloc);
 
     rapidjson::Value applicationVal;
-    applicationVal.SetString(ProvenanceAppStr, std::strlen(ProvenanceAppStr));
+    applicationVal.SetString(ProvenanceAppStr, gsl::narrow<rapidjson::SizeType>(std::strlen(ProvenanceAppStr)));
     recordJson.AddMember("application", applicationVal, alloc);
 
     array.PushBack(recordJson, alloc);
diff --git a/libminifi/src/core/yaml/YamlConfiguration.cpp b/libminifi/src/core/yaml/YamlConfiguration.cpp
index 2f33f0b..2a9b17d 100644
--- a/libminifi/src/core/yaml/YamlConfiguration.cpp
+++ b/libminifi/src/core/yaml/YamlConfiguration.cpp
@@ -134,8 +134,7 @@
         auto lastOfIdx = procCfg.javaClass.find_last_of(".");
         if (lastOfIdx != std::string::npos) {
           lastOfIdx++;  // if a value is found, increment to move beyond the .
-          int nameLength = procCfg.javaClass.length() - lastOfIdx;
-          std::string processorName = procCfg.javaClass.substr(lastOfIdx, nameLength);
+          std::string processorName = procCfg.javaClass.substr(lastOfIdx);
           processor = this->createProcessor(processorName, procCfg.javaClass, uuid);
         } else {
           // Allow unqualified class names for core processors
@@ -498,8 +497,7 @@
           auto lastOfIdx = type.find_last_of(".");
           if (lastOfIdx != std::string::npos) {
             lastOfIdx++;  // if a value is found, increment to move beyond the .
-            int nameLength = type.length() - lastOfIdx;
-            type = type.substr(lastOfIdx, nameLength);
+            type = type.substr(lastOfIdx);
           }
 
           auto name = controllerServiceNode["name"].as<std::string>();
diff --git a/libminifi/src/io/BufferStream.cpp b/libminifi/src/io/BufferStream.cpp
index 3816ce9..6d3ebab 100644
--- a/libminifi/src/io/BufferStream.cpp
+++ b/libminifi/src/io/BufferStream.cpp
@@ -18,7 +18,9 @@
 #include <cstdint>
 #include <algorithm>
 #include <cstring>
+
 #include "io/BufferStream.h"
+#include "utils/gsl.h"
 
 namespace org {
 namespace apache {
@@ -36,7 +38,8 @@
 
 int BufferStream::read(uint8_t *buf, int len) {
   gsl_Expects(len >= 0);
-  len = (std::min<uint64_t>)(len, buffer_.size() - readOffset_);
+  int bytes_available_in_buffer = gsl::narrow<int>(buffer_.size() - readOffset_);
+  len = std::min(len, bytes_available_in_buffer);
   auto begin = buffer_.begin() + readOffset_;
   std::copy(begin, begin + len, buf);
 
diff --git a/libminifi/src/io/InputStream.cpp b/libminifi/src/io/InputStream.cpp
index 9905abf..cdd101e 100644
--- a/libminifi/src/io/InputStream.cpp
+++ b/libminifi/src/io/InputStream.cpp
@@ -21,6 +21,7 @@
 #include <string>
 #include <algorithm>
 #include "io/InputStream.h"
+#include "utils/gsl.h"
 #include "utils/OptionalUtils.h"
 
 namespace org {
@@ -30,7 +31,7 @@
 namespace io {
 
 int InputStream::read(std::vector<uint8_t>& buffer, int len) {
-  if (buffer.size() < len) {
+  if (buffer.size() < gsl::narrow<size_t>(len)) {
     buffer.resize(len);
   }
   int ret = read(buffer.data(), len);
@@ -83,7 +84,8 @@
   }
 
   std::vector<uint8_t> buffer(len);
-  if (read(buffer.data(), len) != len) {
+  uint32_t bytes_read = gsl::narrow<uint32_t>(read(buffer.data(), len));
+  if (bytes_read != len) {
     return -1;
   }
 
diff --git a/libminifi/src/io/OutputStream.cpp b/libminifi/src/io/OutputStream.cpp
index 4f82c63..355cea7 100644
--- a/libminifi/src/io/OutputStream.cpp
+++ b/libminifi/src/io/OutputStream.cpp
@@ -22,6 +22,7 @@
 #include <string>
 #include <algorithm>
 #include "io/OutputStream.h"
+#include "utils/gsl.h"
 
 namespace org {
 namespace apache {
@@ -30,7 +31,7 @@
 namespace io {
 
 int OutputStream::write(const std::vector<uint8_t>& buffer, int len) {
-  if (buffer.size() < len) {
+  if (buffer.size() < gsl::narrow<size_t>(len)) {
     return -1;
   }
   return write(buffer.data(), len);
@@ -46,11 +47,11 @@
 }
 
 int OutputStream::write(const std::string& str, bool widen) {
-  return write_str(str.c_str(), str.length(), widen);
+  return write_str(str.c_str(), gsl::narrow<uint32_t>(str.length()), widen);
 }
 
 int OutputStream::write(const char* str, bool widen) {
-  return write_str(str, std::strlen(str), widen);
+  return write_str(str, gsl::narrow<uint32_t>(std::strlen(str)), widen);
 }
 
 int OutputStream::write_str(const char* str, uint32_t len, bool widen) {
diff --git a/libminifi/src/io/ZlibStream.cpp b/libminifi/src/io/ZlibStream.cpp
index 8e58dc5..e944f3a 100644
--- a/libminifi/src/io/ZlibStream.cpp
+++ b/libminifi/src/io/ZlibStream.cpp
@@ -18,6 +18,8 @@
 
 #include "io/ZlibStream.h"
 #include "Exception.h"
+#include "utils/gsl.h"
+
 namespace org {
 namespace apache {
 namespace nifi {
@@ -81,7 +83,7 @@
     logger_->log_trace("writeData has %u B of input data left", strm_.avail_in);
 
     strm_.next_out = outputBuffer_.data();
-    strm_.avail_out = outputBuffer_.size();
+    strm_.avail_out = gsl::narrow<uInt>(outputBuffer_.size());
 
     int flush = value == nullptr ? Z_FINISH : Z_NO_FLUSH;
     logger_->log_trace("calling deflate with flush %d", flush);
@@ -92,7 +94,7 @@
       state_ = ZlibStreamState::ERRORED;
       return -1;
     }
-    int output_size = outputBuffer_.size() - strm_.avail_out;
+    int output_size = gsl::narrow<int>(outputBuffer_.size() - strm_.avail_out);
     logger_->log_trace("deflate produced %d B of output data", output_size);
     if (output_->write(outputBuffer_.data(), output_size) != output_size) {
       logger_->log_error("Failed to write to underlying stream");
@@ -149,7 +151,7 @@
     logger_->log_trace("writeData has %u B of input data left", strm_.avail_in);
 
     strm_.next_out = outputBuffer_.data();
-    strm_.avail_out = outputBuffer_.size();
+    strm_.avail_out = gsl::narrow<uInt>(outputBuffer_.size());
 
     ret = inflate(&strm_, Z_NO_FLUSH);
     if (ret == Z_STREAM_ERROR ||
@@ -160,7 +162,7 @@
       state_ = ZlibStreamState::ERRORED;
       return -1;
     }
-    int output_size = outputBuffer_.size() - strm_.avail_out;
+    int output_size = gsl::narrow<int>(outputBuffer_.size() - strm_.avail_out);
     logger_->log_trace("deflate produced %d B of output data", output_size);
     if (output_->write(outputBuffer_.data(), output_size) != output_size) {
       logger_->log_error("Failed to write to underlying stream");
diff --git a/libminifi/src/provenance/Provenance.cpp b/libminifi/src/provenance/Provenance.cpp
index 5bedec6..bff5e1d 100644
--- a/libminifi/src/provenance/Provenance.cpp
+++ b/libminifi/src/provenance/Provenance.cpp
@@ -17,16 +17,19 @@
  */
 
 #include "provenance/Provenance.h"
+
 #include <cstdint>
 #include <memory>
 #include <string>
 #include <vector>
 #include <list>
+
 #include "core/Repository.h"
 #include "io/BufferStream.h"
 #include "core/logging/Logger.h"
 #include "core/Relationship.h"
 #include "FlowController.h"
+#include "utils/gsl.h"
 
 namespace org {
 namespace apache {
@@ -71,7 +74,7 @@
     logger_->log_debug("NiFi Provenance Read event %s", getUUIDStr());
   }
 
-  org::apache::nifi::minifi::io::BufferStream stream((const uint8_t*) value.data(), value.length());
+  org::apache::nifi::minifi::io::BufferStream stream((const uint8_t*) value.data(), gsl::narrow<int>(value.length()));
 
   ret = DeSerialize(stream);
 
@@ -139,7 +142,7 @@
   }
 
   // write flow attributes
-  uint32_t numAttributes = this->_attributes.size();
+  uint32_t numAttributes = gsl::narrow<uint32_t>(this->_attributes.size());
   ret = outStream.write(numAttributes);
   if (ret != 4) {
     return false;
@@ -178,8 +181,8 @@
 
   if (this->_eventType == ProvenanceEventRecord::FORK || this->_eventType == ProvenanceEventRecord::CLONE || this->_eventType == ProvenanceEventRecord::JOIN) {
     // write UUIDs
-    uint32_t number = this->_parentUuids.size();
-    ret = outStream.write(number);
+    uint32_t parent_uuids_count = gsl::narrow<uint32_t>(this->_parentUuids.size());
+    ret = outStream.write(parent_uuids_count);
     if (ret != 4) {
       return false;
     }
@@ -189,8 +192,8 @@
         return false;
       }
     }
-    number = this->_childrenUuids.size();
-    ret = outStream.write(number);
+    uint32_t children_uuids_count = gsl::narrow<uint32_t>(this->_childrenUuids.size());
+    ret = outStream.write(children_uuids_count);
     if (ret != 4) {
       return false;
     }
@@ -234,7 +237,7 @@
 bool ProvenanceEventRecord::DeSerialize(const uint8_t *buffer, const size_t bufferSize) {
   int ret;
 
-  org::apache::nifi::minifi::io::BufferStream outStream(buffer, bufferSize);
+  org::apache::nifi::minifi::io::BufferStream outStream(buffer, gsl::narrow<unsigned int>(bufferSize));
 
   ret = outStream.read(uuid_);
   if (ret <= 0) {
diff --git a/libminifi/src/serialization/FlowFileV3Serializer.cpp b/libminifi/src/serialization/FlowFileV3Serializer.cpp
index 34a1087..1fa30a7 100644
--- a/libminifi/src/serialization/FlowFileV3Serializer.cpp
+++ b/libminifi/src/serialization/FlowFileV3Serializer.cpp
@@ -18,6 +18,7 @@
 
 #include "serialization/FlowFileV3Serializer.h"
 #include "core/ProcessSession.h"
+#include "utils/gsl.h"
 
 namespace org {
 namespace apache {
@@ -53,11 +54,11 @@
     return ret;
   }
   sum += ret;
-  ret = out->write(const_cast<uint8_t*>(reinterpret_cast<const uint8_t*>(str.data())), str.length());
+  ret = out->write(const_cast<uint8_t*>(reinterpret_cast<const uint8_t*>(str.data())), gsl::narrow<int>(str.length()));
   if (ret < 0) {
     return ret;
   }
-  if (ret != str.length()) {
+  if (gsl::narrow<size_t>(ret) != str.length()) {
     return -1;
   }
   sum += ret;
diff --git a/libminifi/src/sitetosite/RawSocketProtocol.cpp b/libminifi/src/sitetosite/RawSocketProtocol.cpp
index 5f1b55c..7ea213f 100644
--- a/libminifi/src/sitetosite/RawSocketProtocol.cpp
+++ b/libminifi/src/sitetosite/RawSocketProtocol.cpp
@@ -31,6 +31,7 @@
 #include "sitetosite/RawSocketProtocol.h"
 #include "io/CRCStream.h"
 #include "sitetosite/Peer.h"
+#include "utils/gsl.h"
 
 namespace org {
 namespace apache {
@@ -262,7 +263,7 @@
     }
   }
 
-  uint32_t size = properties.size();
+  uint32_t size = gsl::narrow<uint32_t>(properties.size());
   ret = peer_->write(size);
   if (ret <= 0) {
     return false;
diff --git a/libminifi/src/sitetosite/SiteToSiteClient.cpp b/libminifi/src/sitetosite/SiteToSiteClient.cpp
index 59d936b..2eabfa1 100644
--- a/libminifi/src/sitetosite/SiteToSiteClient.cpp
+++ b/libminifi/src/sitetosite/SiteToSiteClient.cpp
@@ -16,9 +16,13 @@
  * limitations under the License.
  */
 #include "sitetosite/SiteToSiteClient.h"
+
 #include <map>
 #include <string>
 #include <memory>
+
+#include "utils/gsl.h"
+
 namespace org {
 namespace apache {
 namespace nifi {
@@ -60,7 +64,7 @@
     if (ret <= 0)
       return -1;
   }
-  return 3 + message.size();
+  return gsl::narrow<int>(3 + message.size());
 }
 
 void SiteToSiteClient::deleteTransaction(const utils::Identifier& transactionID) {
@@ -441,7 +445,7 @@
     }
   }
   // start to read the packet
-  uint32_t numAttributes = packet->_attributes.size();
+  uint32_t numAttributes = gsl::narrow<uint32_t>(packet->_attributes.size());
   ret = transaction->getStream().write(numAttributes);
   if (ret != 4) {
     return -1;
diff --git a/libminifi/src/utils/ByteArrayCallback.cpp b/libminifi/src/utils/ByteArrayCallback.cpp
index c4545ec..33c9634 100644
--- a/libminifi/src/utils/ByteArrayCallback.cpp
+++ b/libminifi/src/utils/ByteArrayCallback.cpp
@@ -16,10 +16,14 @@
  * limitations under the License.
  */
 #include "utils/ByteArrayCallback.h"
+
 #include <vector>
 #include <utility>
 #include <string>
 #include <memory>
+
+#include "utils/gsl.h"
+
 namespace org {
 namespace apache {
 namespace nifi {
@@ -31,7 +35,7 @@
   if (stream->size() > 0) {
     std::unique_ptr<char> buffer = std::unique_ptr<char>(new char[stream->size()]);
     readFully(buffer.get(), stream->size());
-    stream->read(reinterpret_cast<uint8_t*>(buffer.get()), stream->size());
+    stream->read(reinterpret_cast<uint8_t*>(buffer.get()), gsl::narrow<int>(stream->size()));
     return stream->size();
   }
   return size_.load();
@@ -41,7 +45,7 @@
   stream->seek(0);
   std::unique_ptr<char> buffer = std::unique_ptr<char>(new char[size_.load()]);
   auto written = readFully(buffer.get(), size_);
-  stream->write(reinterpret_cast<uint8_t*>(buffer.get()), written);
+  stream->write(reinterpret_cast<uint8_t*>(buffer.get()), gsl::narrow<int>(written));
   return stream->size();
 }
 
diff --git a/libminifi/src/utils/Environment.cpp b/libminifi/src/utils/Environment.cpp
index 35a7763..edc426f 100644
--- a/libminifi/src/utils/Environment.cpp
+++ b/libminifi/src/utils/Environment.cpp
@@ -28,6 +28,8 @@
 #include <vector>
 #include <iostream>
 
+#include "utils/gsl.h"
+
 namespace org {
 namespace apache {
 namespace nifi {
@@ -52,7 +54,7 @@
     // GetEnvironmentVariableA does not set last error to 0 on success, so an error from a pervious API call would influence the GetLastError() later,
     // so we set the last error to 0 before calling
     SetLastError(ERROR_SUCCESS);
-    uint32_t ret = GetEnvironmentVariableA(name, buffer.data(), buffer.size());
+    uint32_t ret = GetEnvironmentVariableA(name, buffer.data(), gsl::narrow<DWORD>(buffer.size()));
     if (ret > 0U) {
       exists = true;
       value = std::string(buffer.data(), ret);
@@ -118,7 +120,7 @@
     // the return value specifies the required size of the buffer,
     // in characters, including the null-terminating character."
     while (true) {
-      len = GetCurrentDirectoryA(buffer.size(), buffer.data());
+      len = GetCurrentDirectoryA(gsl::narrow<DWORD>(buffer.size()), buffer.data());
       if (len < buffer.size()) {
         break;
       }
diff --git a/libminifi/src/utils/StringUtils.cpp b/libminifi/src/utils/StringUtils.cpp
index e80adf1..7a02720 100644
--- a/libminifi/src/utils/StringUtils.cpp
+++ b/libminifi/src/utils/StringUtils.cpp
@@ -94,37 +94,36 @@
   return true;
 }
 
-std::string StringUtils::replaceEnvironmentVariables(std::string& original_string) {
-  int32_t beg_seq = 0;
-  int32_t end_seq = 0;
-  std::string source_string = original_string;
+std::string StringUtils::replaceEnvironmentVariables(std::string source_string) {
+  std::string::size_type beg_seq = 0;
+  std::string::size_type end_seq = 0;
   do {
     beg_seq = source_string.find("${", beg_seq);
+    if (beg_seq == std::string::npos) {
+      break;
+    }
     if (beg_seq > 0 && source_string.at(beg_seq - 1) == '\\') {
       beg_seq += 2;
       continue;
     }
-    if (beg_seq < 0)
-      break;
     end_seq = source_string.find("}", beg_seq + 2);
-    if (end_seq < 0)
+    if (end_seq == std::string::npos) {
       break;
-    if (end_seq - (beg_seq + 2) < 0) {
+    }
+    if (end_seq <= beg_seq + 2) {
       beg_seq += 2;
       continue;
     }
-    const std::string env_field = source_string.substr(beg_seq + 2, end_seq - (beg_seq + 2));
-    const std::string env_field_wrapped = source_string.substr(beg_seq, end_seq + 1);
-    if (env_field.empty()) {
-      continue;
-    }
+    auto env_var_length = end_seq - (beg_seq + 2);
+    const std::string env_var = source_string.substr(beg_seq + 2, env_var_length);
+    const std::string env_var_wrapped = source_string.substr(beg_seq, env_var_length + 3);
 
     std::string env_value;
-    std::tie(std::ignore, env_value) = utils::Environment::getEnvironmentVariable(env_field.c_str());
+    std::tie(std::ignore, env_value) = utils::Environment::getEnvironmentVariable(env_var.c_str());
 
-    source_string = replaceAll(source_string, env_field_wrapped, env_value);
+    source_string = replaceAll(source_string, env_var_wrapped, env_value);
     beg_seq = 0;  // restart
-  } while (beg_seq >= 0);
+  } while (beg_seq < source_string.size());
 
   source_string = replaceAll(source_string, "\\$", "$");
 
diff --git a/libminifi/src/utils/file/PathUtils.cpp b/libminifi/src/utils/file/PathUtils.cpp
index 394c2e2..4923845 100644
--- a/libminifi/src/utils/file/PathUtils.cpp
+++ b/libminifi/src/utils/file/PathUtils.cpp
@@ -64,7 +64,7 @@
   std::vector<char> buffer(MAX_PATH);
   uint32_t len = 0U;
   while (true) {
-    len = GetFullPathNameA(path.c_str(), buffer.size(), buffer.data(), nullptr /*lpFilePart*/);
+    len = GetFullPathNameA(path.c_str(), gsl::narrow<DWORD>(buffer.size()), buffer.data(), nullptr /*lpFilePart*/);
     if (len < buffer.size()) {
       break;
     }
diff --git a/libminifi/src/utils/tls/TLSUtils.cpp b/libminifi/src/utils/tls/TLSUtils.cpp
index 046be91..24be2e7 100644
--- a/libminifi/src/utils/tls/TLSUtils.cpp
+++ b/libminifi/src/utils/tls/TLSUtils.cpp
@@ -20,6 +20,7 @@
 #include <cstring>
 #include <string>
 
+#include "utils/gsl.h"
 #include "utils/StringUtils.h"
 
 namespace org {
@@ -45,7 +46,7 @@
     // a null terminator. Per their documentation:
     // "The actual length of the password must be returned to the calling function. "
     memset(buf, 0x00, size);
-    return pass.copy(buf, size);
+    return gsl::narrow<int>(pass.copy(buf, size));
   }
   return -1;
 }
diff --git a/libminifi/test/BufferReader.h b/libminifi/test/BufferReader.h
index 783c95b..2b4bf73 100644
--- a/libminifi/test/BufferReader.h
+++ b/libminifi/test/BufferReader.h
@@ -20,6 +20,7 @@
 #define NIFI_MINIFI_CPP_BUFFERREADER_H
 
 #include "FlowFileRecord.h"
+#include "utils/gsl.h"
 
 class BufferReader : public org::apache::nifi::minifi::InputStreamCallback {
  public:
@@ -30,7 +31,7 @@
     std::size_t remaining_len = len;
     int total_read = 0;
     while (remaining_len > 0) {
-      auto ret = input.read(tmpBuffer, std::min(remaining_len, sizeof(tmpBuffer)));
+      auto ret = input.read(tmpBuffer, gsl::narrow<int>(std::min(remaining_len, sizeof(tmpBuffer))));
       if (ret == 0) break;
       if (ret < 0) return ret;
       remaining_len -= ret;
diff --git a/libminifi/test/archive-tests/MergeFileTests.cpp b/libminifi/test/archive-tests/MergeFileTests.cpp
index 384f9f1..60e233f 100644
--- a/libminifi/test/archive-tests/MergeFileTests.cpp
+++ b/libminifi/test/archive-tests/MergeFileTests.cpp
@@ -39,6 +39,7 @@
 #include "serialization/FlowFileV3Serializer.h"
 #include "serialization/PayloadSerializer.h"
 #include "../Utils.h"
+#include "utils/gsl.h"
 
 std::string FLOW_FILE;
 std::string EXPECT_MERGE_CONTENT_FIRST;
@@ -87,7 +88,7 @@
     REQUIRE(size_ + len <= capacity_);
     int total_read = 0;
     do {
-      auto ret = input.read(end(), len);
+      auto ret = input.read(end(), gsl::narrow<int>(len));
       if (ret == 0) break;
       if (ret < 0) return ret;
       size_ += ret;
@@ -111,7 +112,7 @@
    public:
     explicit ArchiveEntryReader(archive* arch) : arch(arch) {}
     int read(uint8_t* out, std::size_t len) {
-      return archive_read_data(arch, out, len);
+      return gsl::narrow<int>(archive_read_data(arch, out, len));
     }
    private:
     archive* arch;
@@ -677,7 +678,7 @@
 }
 
 void writeString(const std::string& str, const std::shared_ptr<minifi::io::BaseStream>& out) {
-  out->write(const_cast<uint8_t*>(reinterpret_cast<const uint8_t*>(str.data())), str.length());
+  out->write(const_cast<uint8_t*>(reinterpret_cast<const uint8_t*>(str.data())), gsl::narrow<int>(str.length()));
 }
 
 TEST_CASE("FlowFile serialization", "[testFlowFileSerialization]") {
diff --git a/libminifi/test/archive-tests/util/ArchiveTests.cpp b/libminifi/test/archive-tests/util/ArchiveTests.cpp
index 5f94cf9..a643b26 100644
--- a/libminifi/test/archive-tests/util/ArchiveTests.cpp
+++ b/libminifi/test/archive-tests/util/ArchiveTests.cpp
@@ -19,15 +19,16 @@
  */
 #include "ArchiveTests.h"
 
+#include <archive.h>
+#include <archive_entry.h>
+
 #include <algorithm>
 #include <set>
 #include <string>
 #include <utility>
 
-#include <archive.h> // NOLINT
-#include <archive_entry.h> // NOLINT
-
 #include "../../TestBase.h"
+#include "utils/gsl.h"
 
 TAE_MAP_T build_test_archive_map(int NUM_FILES, const char** FILE_NAMES, const char** FILE_CONTENT) {
   TAE_MAP_T test_entries;
@@ -138,13 +139,12 @@
       REQUIRE(size == test_entry.size);
 
       if (size > 0) {
-        int rlen, nlen = 0;
+        size_t nlen = 0;
         std::vector<char> buf(size);
         bool read_ok = true;
 
         for (;;) {
-          rlen = archive_read_data(a, buf.data(), size);
-          nlen += rlen;
+          const auto rlen = archive_read_data(a, buf.data(), size);
           if (rlen == 0)
             break;
           if (rlen < 0) {
@@ -152,6 +152,7 @@
             read_ok = false;
             break;
           }
+          nlen += rlen;
         }
 
         if (read_ok) {
diff --git a/libminifi/test/persistence-tests/PersistenceTests.cpp b/libminifi/test/persistence-tests/PersistenceTests.cpp
index 962ab40..7919426 100644
--- a/libminifi/test/persistence-tests/PersistenceTests.cpp
+++ b/libminifi/test/persistence-tests/PersistenceTests.cpp
@@ -34,6 +34,7 @@
 #include "../test/BufferReader.h"
 #include "core/repository/VolatileFlowFileRepository.h"
 #include "../../extensions/rocksdb-repos/DatabaseContentRepository.h"
+#include "utils/gsl.h"
 #include "utils/IntegrationTestUtils.h"
 
 using Connection = minifi::Connection;
@@ -95,7 +96,7 @@
     processor->onSchedule(processorContext.get(), new core::ProcessSessionFactory(processorContext));
   }
   std::shared_ptr<core::FlowFile> write(const std::string& data) {
-    minifi::io::BufferStream stream(reinterpret_cast<const uint8_t*>(data.c_str()), data.length());
+    minifi::io::BufferStream stream(reinterpret_cast<const uint8_t*>(data.c_str()), gsl::narrow<int>(data.length()));
     core::ProcessSession sessionGenFlowFile(inputContext);
     std::shared_ptr<core::FlowFile> flow = std::static_pointer_cast<core::FlowFile>(sessionGenFlowFile.create());
     sessionGenFlowFile.importFrom(stream, flow);
@@ -246,7 +247,7 @@
   void onTrigger(core::ProcessContext* /*context*/, core::ProcessSession *session) override {
     auto ff = session->get();
     std::string data = "<override>";
-    minifi::io::BufferStream stream(reinterpret_cast<const uint8_t*>(data.c_str()), data.length());
+    minifi::io::BufferStream stream(reinterpret_cast<const uint8_t*>(data.c_str()), gsl::narrow<int>(data.length()));
     session->importFrom(stream, ff);
     session->transfer(ff, {"success", "d"});
   }
diff --git a/libminifi/test/rocksdb-tests/ContentSessionTests.cpp b/libminifi/test/rocksdb-tests/ContentSessionTests.cpp
index ecc987c..0b58d0d 100644
--- a/libminifi/test/rocksdb-tests/ContentSessionTests.cpp
+++ b/libminifi/test/rocksdb-tests/ContentSessionTests.cpp
@@ -25,6 +25,7 @@
 #include "DatabaseContentRepository.h"
 #include "FlowFileRecord.h"
 #include "../TestBase.h"
+#include "utils/gsl.h"
 
 template<typename ContentRepositoryClass>
 class ContentSessionController : public TestController {
@@ -46,7 +47,8 @@
 };
 
 const std::shared_ptr<minifi::io::BaseStream>& operator<<(const std::shared_ptr<minifi::io::BaseStream>& stream, const std::string& str) {
-  REQUIRE(stream->write(const_cast<uint8_t*>(reinterpret_cast<const uint8_t*>(str.data())), str.length()) == str.length());
+  int length = gsl::narrow<int>(str.length());
+  REQUIRE(stream->write(const_cast<uint8_t*>(reinterpret_cast<const uint8_t*>(str.data())), length) == length);
   return stream;
 }
 
diff --git a/libminifi/test/rocksdb-tests/RepoTests.cpp b/libminifi/test/rocksdb-tests/RepoTests.cpp
index 6f21ce1..9248dc8 100644
--- a/libminifi/test/rocksdb-tests/RepoTests.cpp
+++ b/libminifi/test/rocksdb-tests/RepoTests.cpp
@@ -31,6 +31,7 @@
 #include "properties/Configure.h"
 #include "../unit/ProvenanceTestHelper.h"
 #include "../TestBase.h"
+#include "utils/gsl.h"
 #include "utils/IntegrationTestUtils.h"
 
 namespace {
@@ -292,7 +293,7 @@
       prov_repo, ff_repository, config, std::move(flowConfig), content_repo, "", true);
 
   std::string data = "banana";
-  minifi::io::BufferStream content(reinterpret_cast<const uint8_t*>(data.c_str()), data.length());
+  minifi::io::BufferStream content(reinterpret_cast<const uint8_t*>(data.c_str()), gsl::narrow<int>(data.length()));
 
   /**
    * Currently it is the Connection's responsibility to persist the incoming
diff --git a/libminifi/test/unit/CRCTests.cpp b/libminifi/test/unit/CRCTests.cpp
index 6880eee..17c62da 100644
--- a/libminifi/test/unit/CRCTests.cpp
+++ b/libminifi/test/unit/CRCTests.cpp
@@ -21,6 +21,7 @@
 #include "io/CRCStream.h"
 #include "io/BufferStream.h"
 #include "../TestBase.h"
+#include "utils/gsl.h"
 
 TEST_CASE("Test CRC1", "[testcrc1]") {
   org::apache::nifi::minifi::io::BufferStream base;
@@ -34,7 +35,7 @@
   org::apache::nifi::minifi::io::CRCStream<org::apache::nifi::minifi::io::BaseStream> test(gsl::make_not_null(&base));
   std::string fox = "the quick brown fox jumped over the brown fox";
   std::vector<uint8_t> charvect(fox.begin(), fox.end());
-  test.write(charvect, charvect.size());
+  test.write(charvect, gsl::narrow<int>(charvect.size()));
   REQUIRE(1922388889 == test.getCRC());
 }
 
@@ -73,8 +74,8 @@
   std::vector<uint8_t> textVector1(textString.begin(), textString.end());
   std::vector<uint8_t> textVector2(textString.begin(), textString.end());
 
-  test_noinit.write(textVector1, textVector1.size());
-  test_initzero.write(textVector2, textVector2.size());
+  test_noinit.write(textVector1, gsl::narrow<int>(textVector1.size()));
+  test_initzero.write(textVector2, gsl::narrow<int>(textVector2.size()));
   REQUIRE(test_noinit.getCRC() == test_initzero.getCRC());
 }
 
@@ -84,17 +85,17 @@
   org::apache::nifi::minifi::io::BufferStream base_full;
   org::apache::nifi::minifi::io::CRCStream<org::apache::nifi::minifi::io::BaseStream> test_full(gsl::make_not_null(&base_full), 0);
   std::vector<uint8_t> textVector_full(textString.begin(), textString.end());
-  test_full.write(textVector_full, textVector_full.size());
+  test_full.write(textVector_full, gsl::narrow<int>(textVector_full.size()));
 
   org::apache::nifi::minifi::io::BufferStream base_piece1;
   org::apache::nifi::minifi::io::CRCStream<org::apache::nifi::minifi::io::BaseStream> test_piece1(gsl::make_not_null(&base_piece1), 0);
   std::vector<uint8_t> textVector_piece1(textString.begin(), textString.begin() + 15);
-  test_piece1.write(textVector_piece1, textVector_piece1.size());
+  test_piece1.write(textVector_piece1, gsl::narrow<int>(textVector_piece1.size()));
 
   org::apache::nifi::minifi::io::BufferStream base_piece2;
   org::apache::nifi::minifi::io::CRCStream<org::apache::nifi::minifi::io::BaseStream> test_piece2(gsl::make_not_null(&base_piece2), test_piece1.getCRC());
   std::vector<uint8_t> textVector_piece2(textString.begin() + 15, textString.end());
-  test_piece2.write(textVector_piece2, textVector_piece2.size());
+  test_piece2.write(textVector_piece2, gsl::narrow<int>(textVector_piece2.size()));
 
   REQUIRE(test_full.getCRC() == test_piece2.getCRC());
 }
diff --git a/libminifi/test/unit/EncryptionUtilsTests.cpp b/libminifi/test/unit/EncryptionUtilsTests.cpp
index 977be35..934b889 100644
--- a/libminifi/test/unit/EncryptionUtilsTests.cpp
+++ b/libminifi/test/unit/EncryptionUtilsTests.cpp
@@ -73,7 +73,7 @@
   utils::crypto::Bytes key = utils::crypto::generateKey();
   std::string plaintext = "my social security number is 914-52-5373";
 
-  const auto base64_length = [](int raw_length) { return (raw_length + 2) / 3 * 4; };
+  const auto base64_length = [](size_t raw_length) { return (raw_length + 2) / 3 * 4; };
 
   std::string encrypted_text = utils::crypto::encrypt(plaintext, key);
   REQUIRE(encrypted_text.size() ==
diff --git a/libminifi/test/unit/FileStreamTests.cpp b/libminifi/test/unit/FileStreamTests.cpp
index 66d2c15..5a74035 100644
--- a/libminifi/test/unit/FileStreamTests.cpp
+++ b/libminifi/test/unit/FileStreamTests.cpp
@@ -23,6 +23,7 @@
 
 #include "io/FileStream.h"
 #include "../TestBase.h"
+#include "utils/gsl.h"
 
 TEST_CASE("TestFileOverWrite", "[TestFiles]") {
   TestController testController;
@@ -39,7 +40,7 @@
 
   minifi::io::FileStream stream(path, 0, true);
   std::vector<uint8_t> readBuffer;
-  REQUIRE(stream.read(readBuffer, stream.size()) == stream.size());
+  REQUIRE(stream.read(readBuffer, gsl::narrow<int>(stream.size())) == stream.size());
 
   uint8_t* data = readBuffer.data();
 
@@ -53,7 +54,7 @@
 
   std::vector<uint8_t> verifybuffer;
 
-  REQUIRE(stream.read(verifybuffer, stream.size()) == stream.size());
+  REQUIRE(stream.read(verifybuffer, gsl::narrow<int>(stream.size())) == stream.size());
 
   data = verifybuffer.data();
 
@@ -77,7 +78,7 @@
 
   minifi::io::FileStream stream(path, 0, true);
   std::vector<uint8_t> readBuffer;
-  REQUIRE(stream.read(readBuffer, stream.size()) == stream.size());
+  REQUIRE(stream.read(readBuffer, gsl::narrow<int>(stream.size())) == stream.size());
 
   uint8_t* data = readBuffer.data();
 
@@ -91,7 +92,7 @@
 
   std::vector<uint8_t> verifybuffer;
 
-  REQUIRE(stream.read(verifybuffer, stream.size()) == stream.size());
+  REQUIRE(stream.read(verifybuffer, gsl::narrow<int>(stream.size())) == stream.size());
 
   data = verifybuffer.data();
 
@@ -115,7 +116,7 @@
 
   minifi::io::FileStream stream(path, 0, true);
   std::vector<uint8_t> readBuffer;
-  REQUIRE(stream.read(readBuffer, stream.size()) == stream.size());
+  REQUIRE(stream.read(readBuffer, gsl::narrow<int>(stream.size())) == stream.size());
 
   uint8_t* data = readBuffer.data();
 
@@ -129,7 +130,7 @@
 
   std::vector<uint8_t> verifybuffer;
 
-  REQUIRE(stream.read(verifybuffer, stream.size()) == stream.size());
+  REQUIRE(stream.read(verifybuffer, gsl::narrow<int>(stream.size())) == stream.size());
 
   data = verifybuffer.data();
 
@@ -153,7 +154,7 @@
 
   minifi::io::FileStream stream(path, 0, true);
   std::vector<uint8_t> readBuffer;
-  REQUIRE(stream.read(readBuffer, stream.size()) == stream.size());
+  REQUIRE(stream.read(readBuffer, gsl::narrow<int>(stream.size())) == stream.size());
 
   uint8_t* data = readBuffer.data();
 
@@ -167,7 +168,7 @@
 
   std::vector<uint8_t> verifybuffer;
 
-  REQUIRE(stream.read(nullptr, stream.size()) == -1);
+  REQUIRE(stream.read(nullptr, gsl::narrow<int>(stream.size())) == -1);
 
   data = verifybuffer.data();
 
@@ -191,7 +192,7 @@
 
   minifi::io::FileStream stream(path, 0, true);
   std::vector<uint8_t> readBuffer;
-  REQUIRE(stream.read(readBuffer, stream.size()) == stream.size());
+  REQUIRE(stream.read(readBuffer, gsl::narrow<int>(stream.size())) == stream.size());
 
   uint8_t* data = readBuffer.data();
 
@@ -226,7 +227,7 @@
 
   minifi::io::FileStream stream(path, 0, true);
   std::vector<uint8_t> readBuffer;
-  REQUIRE(stream.read(readBuffer, stream.size()) == stream.size());
+  REQUIRE(stream.read(readBuffer, gsl::narrow<int>(stream.size())) == stream.size());
 
   uint8_t* data = readBuffer.data();
 
diff --git a/libminifi/test/unit/FlowFileSerializationTests.cpp b/libminifi/test/unit/FlowFileSerializationTests.cpp
index d89e335..fef1327 100644
--- a/libminifi/test/unit/FlowFileSerializationTests.cpp
+++ b/libminifi/test/unit/FlowFileSerializationTests.cpp
@@ -24,6 +24,7 @@
 #include "serialization/PayloadSerializer.h"
 #include "core/FlowFile.h"
 #include "../TestBase.h"
+#include "utils/gsl.h"
 
 std::shared_ptr<minifi::FlowFileRecord> createEmptyFlowFile() {
   auto flowFile = std::make_shared<minifi::FlowFileRecord>();
@@ -34,7 +35,7 @@
 TEST_CASE("Payload Serializer", "[testPayload]") {
   std::string content = "flowFileContent";
   auto contentStream = std::make_shared<minifi::io::BufferStream>();
-  contentStream->write(const_cast<uint8_t*>(reinterpret_cast<const uint8_t*>(content.data())), content.length());
+  contentStream->write(const_cast<uint8_t*>(reinterpret_cast<const uint8_t*>(content.data())), gsl::narrow<int>(content.length()));
 
   auto result = std::make_shared<minifi::io::BufferStream>();
 
@@ -44,7 +45,7 @@
   flowFile->addAttribute("second", "two");
 
   minifi::PayloadSerializer serializer([&] (const std::shared_ptr<core::FlowFile>&, minifi::InputStreamCallback* cb) {
-    return cb->process(contentStream);
+    return gsl::narrow<int>(cb->process(contentStream));
   });
   serializer.serialize(flowFile, result);
 
@@ -56,7 +57,7 @@
 TEST_CASE("FFv3 Serializer", "[testFFv3]") {
   std::string content = "flowFileContent";
   auto contentStream = std::make_shared<minifi::io::BufferStream>();
-  contentStream->write(const_cast<uint8_t*>(reinterpret_cast<const uint8_t*>(content.data())), content.length());
+  contentStream->write(const_cast<uint8_t*>(reinterpret_cast<const uint8_t*>(content.data())), gsl::narrow<int>(content.length()));
 
   auto result = std::make_shared<minifi::io::BufferStream>();
 
@@ -66,7 +67,7 @@
   flowFile->addAttribute("second", "two");
 
   minifi::FlowFileV3Serializer serializer([&] (const std::shared_ptr<core::FlowFile>&, minifi::InputStreamCallback* cb) {
-    return cb->process(contentStream);
+    return gsl::narrow<int>(cb->process(contentStream));
   });
   serializer.serialize(flowFile, result);
 
diff --git a/libminifi/test/unit/LoggerConfigurationTests.cpp b/libminifi/test/unit/LoggerConfigurationTests.cpp
index bdb16b9..5e2f03e 100644
--- a/libminifi/test/unit/LoggerConfigurationTests.cpp
+++ b/libminifi/test/unit/LoggerConfigurationTests.cpp
@@ -41,6 +41,7 @@
   REQUIRE(expected == actual);
 }
 
+#ifndef WIN32
 class TestLoggerConfiguration : public logging::LoggerConfiguration {
  public:
   static std::shared_ptr<logging::internal::LoggerNamespace> initialize_namespaces(const std::shared_ptr<logging::LoggerProperties> &logger_properties) {
@@ -50,7 +51,7 @@
     return logging::LoggerConfiguration::get_logger(LogTestController::getInstance().logger_, root_namespace, name, formatter);
   }
 };
-#ifndef WIN32
+
 TEST_CASE("TestLoggerConfiguration::initialize_namespaces", "[test initialize_namespaces]") {
   TestController test_controller;
   LogTestController &logTestController = LogTestController::getInstance();
diff --git a/libminifi/test/unit/MinifiConcurrentQueueTests.cpp b/libminifi/test/unit/MinifiConcurrentQueueTests.cpp
index 1b0dc0f..42b4987 100644
--- a/libminifi/test/unit/MinifiConcurrentQueueTests.cpp
+++ b/libminifi/test/unit/MinifiConcurrentQueueTests.cpp
@@ -24,6 +24,7 @@
 #include <set>
 
 #include "../TestBase.h"
+#include "utils/gsl.h"
 #include "utils/MinifiConcurrentQueue.h"
 #include "utils/StringUtils.h"
 #include "utils/IntegrationTestUtils.h"
@@ -121,7 +122,7 @@
       while (queue.dequeueWait(s)) {
         if (!std::count(results.begin(), results.end(), s)) {
           results.push_back(s);
-          results_size = results.size();
+          results_size = gsl::narrow<int>(results.size());
         }
         // The consumer is busy enqueing so noone is waiting for this ;(
         queue.enqueue(std::move(s));
diff --git a/libminifi/test/unit/SiteToSiteHelper.h b/libminifi/test/unit/SiteToSiteHelper.h
index 693ec31..b4d5e8f 100644
--- a/libminifi/test/unit/SiteToSiteHelper.h
+++ b/libminifi/test/unit/SiteToSiteHelper.h
@@ -22,6 +22,8 @@
 #include "io/BufferStream.h"
 #include "io/EndianCheck.h"
 #include "core/Core.h"
+#include "utils/gsl.h"
+
 /**
  * Test repository
  */
@@ -37,7 +39,7 @@
   }
 
   void push_response(const std::string& resp) {
-    server_responses_.write(reinterpret_cast<const uint8_t*>(resp.data()), resp.length());
+    server_responses_.write(reinterpret_cast<const uint8_t*>(resp.data()), gsl::narrow<int>(resp.length()));
   }
 
   int write(const uint8_t *value, int size) override {
diff --git a/libminifi/test/unit/StringUtilsTests.cpp b/libminifi/test/unit/StringUtilsTests.cpp
index e76fa0e..2ecc8de 100644
--- a/libminifi/test/unit/StringUtilsTests.cpp
+++ b/libminifi/test/unit/StringUtilsTests.cpp
@@ -50,54 +50,24 @@
   REQUIRE(expected == StringUtils::split(org::apache::nifi::minifi::core::getClassName<org::apache::nifi::minifi::utils::StringUtils>(), "::"));
 }
 
-TEST_CASE("TestStringUtils::testEnv1", "[test split classname]") {
-  std::string test_string = "hello world ${blahblahnamenamenotexist}";
-
-
+TEST_CASE("StringUtils::replaceEnvironmentVariables works correctly", "[replaceEnvironmentVariables]") {
   utils::Environment::setEnvironmentVariable("blahblahnamenamenotexist", "computer", 0);
 
-  std::string expected = "hello world computer";
+  REQUIRE("hello world computer" == StringUtils::replaceEnvironmentVariables("hello world ${blahblahnamenamenotexist}"));
+  REQUIRE("hello world ${blahblahnamenamenotexist" == StringUtils::replaceEnvironmentVariables("hello world ${blahblahnamenamenotexist"));
+  REQUIRE("hello world $computer" == StringUtils::replaceEnvironmentVariables("hello world $${blahblahnamenamenotexist}"));
+  REQUIRE("hello world ${blahblahnamenamenotexist}" == StringUtils::replaceEnvironmentVariables("hello world \\${blahblahnamenamenotexist}"));
+  REQUIRE("the computer costs $123" == StringUtils::replaceEnvironmentVariables("the ${blahblahnamenamenotexist} costs \\$123"));
+  REQUIRE("computer bug" == StringUtils::replaceEnvironmentVariables("${blahblahnamenamenotexist} bug"));
+  REQUIRE("O computer! My computer!" == StringUtils::replaceEnvironmentVariables("O ${blahblahnamenamenotexist}! My ${blahblahnamenamenotexist}!"));
 
-  REQUIRE(expected == StringUtils::replaceEnvironmentVariables(test_string));
-}
+  utils::Environment::setEnvironmentVariable("blahblahnamenamenotexist_2", "no", 0);
+  REQUIRE("computer says 'no'" == StringUtils::replaceEnvironmentVariables("${blahblahnamenamenotexist} says '${blahblahnamenamenotexist_2}'"));
+  REQUIRE("no computer can say no to computer nougats" == StringUtils::replaceEnvironmentVariables(
+      "${blahblahnamenamenotexist_2} ${blahblahnamenamenotexist} can say ${blahblahnamenamenotexist_2} to ${blahblahnamenamenotexist} ${blahblahnamenamenotexist_2}ugats"));
 
-TEST_CASE("TestStringUtils::testEnv2", "[test split classname]") {
-  std::string test_string = "hello world ${blahblahnamenamenotexist";
-
-  utils::Environment::setEnvironmentVariable("blahblahnamenamenotexist", "computer");
-
-  std::string expected = "hello world ${blahblahnamenamenotexist";
-
-  REQUIRE(expected == StringUtils::replaceEnvironmentVariables(test_string));
-}
-
-TEST_CASE("TestStringUtils::testEnv3", "[test split classname]") {
-  std::string test_string = "hello world $${blahblahnamenamenotexist}";
-
-  utils::Environment::setEnvironmentVariable("blahblahnamenamenotexist", "computer");
-
-  std::string expected = "hello world $computer";
-
-  REQUIRE(expected == StringUtils::replaceEnvironmentVariables(test_string));
-}
-
-TEST_CASE("TestStringUtils::testEnv4", "[test split classname]") {
-  std::string test_string = "hello world \\${blahblahnamenamenotexist}";
-
-  utils::Environment::setEnvironmentVariable("blahblahnamenamenotexist", "computer");
-
-  std::string expected = "hello world ${blahblahnamenamenotexist}";
-
-  REQUIRE(expected == StringUtils::replaceEnvironmentVariables(test_string));
-}
-
-TEST_CASE("TestStringUtils::testEnv5", "[test split classname]") {
-  // can't use blahblahnamenamenotexist because the utils::Environment::setEnvironmentVariable in other functions may have already set it
-  std::string test_string = "hello world ${blahblahnamenamenotexist2}";
-
-  std::string expected = "hello world ";
-
-  REQUIRE(expected == StringUtils::replaceEnvironmentVariables(test_string));
+  REQUIRE("hello world ${}" == StringUtils::replaceEnvironmentVariables("hello world ${}"));
+  REQUIRE("hello world " == StringUtils::replaceEnvironmentVariables("hello world ${blahblahnamenamenotexist_reallydoesnotexist}"));
 }
 
 TEST_CASE("TestStringUtils::testJoin", "[test string join]") {
diff --git a/libminifi/test/unit/ZlibStreamTests.cpp b/libminifi/test/unit/ZlibStreamTests.cpp
index 7a81f06..3418448 100644
--- a/libminifi/test/unit/ZlibStreamTests.cpp
+++ b/libminifi/test/unit/ZlibStreamTests.cpp
@@ -21,6 +21,7 @@
 #include <algorithm>
 #include "../TestBase.h"
 #include "io/ZlibStream.h"
+#include "utils/gsl.h"
 #include "utils/StringUtils.h"
 
 namespace io = org::apache::nifi::minifi::io;
@@ -34,13 +35,17 @@
   SECTION("Empty") {
   }
   SECTION("Simple content in one write") {
-    REQUIRE(strlen("foobar") == compressStream.write(reinterpret_cast<uint8_t*>(const_cast<char*>("foobar")), strlen("foobar")));
+    int length = gsl::narrow<int>(strlen("foobar"));
+    REQUIRE(length == compressStream.write(reinterpret_cast<uint8_t*>(const_cast<char*>("foobar")), length));
     original += "foobar";
   }
   SECTION("Simple content in two writes") {
-    REQUIRE(strlen("foo") == compressStream.write(reinterpret_cast<uint8_t*>(const_cast<char*>("foo")), strlen("foo")));
+    int foo_length = gsl::narrow<int>(strlen("foo"));
+    REQUIRE(foo_length == compressStream.write(reinterpret_cast<uint8_t*>(const_cast<char*>("foo")), foo_length));
     original += "foo";
-    REQUIRE(strlen("bar") == compressStream.write(reinterpret_cast<uint8_t*>(const_cast<char*>("bar")), strlen("bar")));
+
+    int bar_length = gsl::narrow<int>(strlen("bar"));
+    REQUIRE(bar_length == compressStream.write(reinterpret_cast<uint8_t*>(const_cast<char*>("bar")), bar_length));
     original += "bar";
   }
   SECTION("Large data") {
@@ -50,7 +55,7 @@
     for (size_t i = 0U; i < 1024U; i++) {
       std::generate(buf.begin(), buf.end(), [&](){return dist(gen);});
       original += std::string(reinterpret_cast<const char*>(buf.data()), buf.size());
-      REQUIRE(-1 != compressStream.write(buf.data(), buf.size()));
+      REQUIRE(-1 != compressStream.write(buf.data(), gsl::narrow<int>(buf.size())));
     }
   }
 
@@ -66,7 +71,7 @@
   io::BufferStream decompressBuffer;
   io::ZlibDecompressStream decompressStream(gsl::make_not_null(&decompressBuffer));
 
-  decompressStream.write(const_cast<uint8_t*>(compressBuffer.getBuffer()), compressBuffer.size());
+  decompressStream.write(const_cast<uint8_t*>(compressBuffer.getBuffer()), gsl::narrow<int>(compressBuffer.size()));
 
   REQUIRE(decompressStream.isFinished());
   REQUIRE(original == std::string(reinterpret_cast<const char*>(decompressBuffer.getBuffer()), decompressBuffer.size()));
@@ -81,13 +86,17 @@
   SECTION("Empty") {
   }
   SECTION("Simple content in one write") {
-    REQUIRE(strlen("foobar") == compressStream.write(reinterpret_cast<uint8_t*>(const_cast<char*>("foobar")), strlen("foobar")));
+    int foobar_length = gsl::narrow<int>(strlen("foobar"));
+    REQUIRE(foobar_length == compressStream.write(reinterpret_cast<uint8_t*>(const_cast<char*>("foobar")), foobar_length));
     original += "foobar";
   }
   SECTION("Simple content in two writes") {
-    REQUIRE(strlen("foo") == compressStream.write(reinterpret_cast<uint8_t*>(const_cast<char*>("foo")), strlen("foo")));
+    int foo_length = gsl::narrow<int>(strlen("foo"));
+    REQUIRE(foo_length == compressStream.write(reinterpret_cast<uint8_t*>(const_cast<char*>("foo")), foo_length));
     original += "foo";
-    REQUIRE(strlen("bar") == compressStream.write(reinterpret_cast<uint8_t*>(const_cast<char*>("bar")), strlen("bar")));
+
+    int bar_length = gsl::narrow<int>(strlen("bar"));
+    REQUIRE(bar_length == compressStream.write(reinterpret_cast<uint8_t*>(const_cast<char*>("bar")), bar_length));
     original += "bar";
   }
   SECTION("Large data") {
@@ -97,7 +106,8 @@
     for (size_t i = 0U; i < 1024U; i++) {
       std::generate(buf.begin(), buf.end(), [&](){return dist(gen);});
       original += std::string(reinterpret_cast<const char*>(buf.data()), buf.size());
-      REQUIRE(buf.size() == compressStream.write(buf.data(), buf.size()));
+      int buffer_size = gsl::narrow<int>(buf.size());
+      REQUIRE(buffer_size == compressStream.write(buf.data(), buffer_size));
     }
   }
 
diff --git a/main/AgentDocs.cpp b/main/AgentDocs.cpp
index 92c3e78..7307828 100644
--- a/main/AgentDocs.cpp
+++ b/main/AgentDocs.cpp
@@ -44,15 +44,11 @@
 namespace docs {
 
 std::string AgentDocs::extractClassName(const std::string &processor) const {
-  auto lastOfIdx = processor.find_last_of(".");
-  if (lastOfIdx != std::string::npos) {
-    lastOfIdx++;  // if a value is found, increment to move beyond the .
-    int nameLength = processor.length() - lastOfIdx;
-    std::string processorName = processor.substr(lastOfIdx, nameLength);
-    return processorName;
+  auto positionOfLastDot = processor.find_last_of(".");
+  if (positionOfLastDot != std::string::npos) {
+    return processor.substr(positionOfLastDot + 1);
   }
   return processor;
-
 }
 
 void AgentDocs::generate(const std::string &docsdir, std::ostream &genStream) {
diff --git a/nanofi/include/sitetosite/CPeer.h b/nanofi/include/sitetosite/CPeer.h
index d145e0b..12af30e 100644
--- a/nanofi/include/sitetosite/CPeer.h
+++ b/nanofi/include/sitetosite/CPeer.h
@@ -79,7 +79,7 @@
   peer->_host[host_len] = '\0';
   peer->_url[host_len + 7] = ':';
   if(peer->_port != 0) {
-    snprintf(peer->_url + host_len + 8, 5, "%d", peer->_port);
+    snprintf(peer->_url + host_len + 8, 6, "%d", peer->_port);
   }
   return;
 }
@@ -88,7 +88,7 @@
   peer->_port = port;
   if(peer->_url != NULL) {
     int i;
-    for(i = strlen(peer->_url) -1; i >= 0; --i) {  // look for the last ':' in the string
+    for(i = (int)(strlen(peer->_url)) - 1; i >= 0; --i) {  // look for the last ':' in the string
       if(peer->_url[i] == ':'){
         memset(peer->_url + i + 1, 0, 6);  // zero the port area  - the new port can be shorter
         snprintf(peer->_url + i + 1, 6, "%d", peer->_port);
diff --git a/nanofi/tests/CTestsBase.h b/nanofi/tests/CTestsBase.h
index b3c0767..8c37e3a 100644
--- a/nanofi/tests/CTestsBase.h
+++ b/nanofi/tests/CTestsBase.h
@@ -138,7 +138,8 @@
   }
 
   ~TestControllerWithTemporaryWorkingDirectory() {
-    chdir(old_cwd_);
+    int success = chdir(old_cwd_);
+    (void) success;
     free(old_cwd_);
   }