diff --git a/scripts/check_format.sh b/scripts/check_format.sh
index 1053647af..2bb3a8c21 100755
--- a/scripts/check_format.sh
+++ b/scripts/check_format.sh
@@ -51,6 +51,19 @@ else
 fi
 rm -f comment.log
 
+echo -n "Checking for use of forbidden library functions..."
+
+git grep -w strcpy -- app examples lib test > badfunc.log || true
+
+if [ -s badfunc.log ]; then
+	echo " Forbidden library functions detected"
+	cat badfunc.log
+	rc=1
+else
+	echo " OK"
+fi
+rm -f badfunc.log
+
 echo -n "Checking blank lines at end of file..."
 
 if ! git grep -I -l -e . -z | \
diff --git a/test/unit/lib/iscsi/param.c/param_ut.c b/test/unit/lib/iscsi/param.c/param_ut.c
index 81c2eadde..a132f41e4 100644
--- a/test/unit/lib/iscsi/param.c/param_ut.c
+++ b/test/unit/lib/iscsi/param.c/param_ut.c
@@ -240,7 +240,7 @@ parse_valid_test(void)
 	data = malloc(len);
 	SPDK_CU_ASSERT_FATAL(data != NULL);
 	memset(data, 'A', len);
-	strcpy(data, "CHAP_C");
+	memcpy(data, "CHAP_C", 6);
 	data[6] = '=';
 	data[len - 1] = '\0';
 	rc = spdk_iscsi_parse_params(&params, data, len, false, NULL);
@@ -315,7 +315,7 @@ parse_invalid_test(void)
 	data = malloc(len);
 	SPDK_CU_ASSERT_FATAL(data != NULL);
 	memset(data, 'A', len);
-	strcpy(data, "CHAP_C");
+	memcpy(data, "CHAP_C", 6);
 	data[6] = '=';
 	data[len - 1] = '\0';
 	rc = spdk_iscsi_parse_params(&params, data, len, false, NULL);
diff --git a/test/unit/lib/jsonrpc/jsonrpc_server.c/jsonrpc_server_ut.c b/test/unit/lib/jsonrpc/jsonrpc_server.c/jsonrpc_server_ut.c
index 7b6727a19..7661e2bd5 100644
--- a/test/unit/lib/jsonrpc/jsonrpc_server.c/jsonrpc_server_ut.c
+++ b/test/unit/lib/jsonrpc/jsonrpc_server.c/jsonrpc_server_ut.c
@@ -361,7 +361,8 @@ test_parse_request_streaming(void)
 	FREE_REQUEST();
 
 	/* Partial (but not invalid) requests - parse should not consume anything. */
-	strcpy(g_buf, "{\"jsonrpc\":\"2.0\",\"method\":\"b\",\"params\":[2],\"id\":2}");
+	snprintf(g_buf, sizeof(g_buf), "%s",
+		 "{\"jsonrpc\":\"2.0\",\"method\":\"b\",\"params\":[2],\"id\":2}");
 	len = strlen(g_buf);
 
 	/* Try every partial length up to the full request length */