diff --git a/coder_review/includes/coder_review_security.inc b/coder_review/includes/coder_review_security.inc
index 655c2b9..371f530 100644
--- a/coder_review/includes/coder_review_security.inc
+++ b/coder_review/includes/coder_review_security.inc
@@ -366,9 +366,9 @@ function _coder_review_security_callback(&$coder_args, $review, $rule, $lines, &
       }
     }
 
-    // FAPI #title and #description
-    $regex = '/[\'"]#(title|description)[\'"]\s*=>\s*.*?\$(\w+)\s*.*?[,\)]/';
-    $never_regex = '/([\'"]#(title|description)[\'"]\s*=>\s*((((st|t|\$t)\s*\(((\s*[\'"][^!]+?[\'"]\s*,)|(.*?array\([^!]+\))))|(format_plural|field_filter_xss|filter_xss|filter_xss_admin|check_plain|check_markup)\s*\().*))/';
+    // FAPI #title, #description, and #markup
+    $regex = '/[\'"]#(title|description|markup)[\'"]\s*=>\s*.*?\$(\w+)\s*.*?[,\)]/';
+    $never_regex = '/([\'"]#(title|description|markup)[\'"]\s*=>\s*((((st|t|\$t)\s*\(((\s*[\'"][^!]+?[\'"]\s*,)|(.*?array\([^!]+\))))|(format_plural|field_filter_xss|filter_xss|filter_xss_admin|check_plain|check_markup)\s*\().*))/';
     if (preg_match($regex, $line, $matches) && preg_match('/_form(_alter)*$/', $function_name, $function_matches)) {
       if (!preg_match($never_regex, $coder_args['#all_lines'][$lineno])) {
         $before_never_regex = '/[\s]\$' . $matches[1] . '\s*=\s*(((st|t|\$t)\s*\(((\s*[\'"][^!]+?[\'"]\s*,)|(.*?array\([^!]+\))))|(format_plural|field_filter_xss|filter_xss|filter_xss_admin|check_plain|check_markup)\s*\()/';
@@ -502,7 +502,7 @@ function _coder_review_security_request_uri_warning() {
 
 function _coder_review_security_fapi_title_description_warning() {
   return array(
-    '#text' => "Potential problem: FAPI elements '#title' and '#description' only accept filtered text, be sure to use !check_plain(), !filter_xss() or similar to ensure your \$variable is fully sanitized.",
+    '#text' => "Potential problem: FAPI elements '#title', '#description', and '#markup' only accept filtered text, be sure to use !check_plain(), !filter_xss() or similar to ensure your \$variable is fully sanitized.",
     '#args' => array(
       '!hook_form' => _drupalapi('hook_form'),
       '!check_plain' => _drupalapi('check_plain'),