Skip to content
SPECIFICTION
Get listed

Flawfinder

dwheeler.com

Free plan WindowsmacOSLinuxSelf-hosted
Visit dwheeler.com
Spec score 8.1 #6 of 24 in Static Application Security Testing Sast

What it is

Flawfinder is a free tool for finding possible security weaknesses in C and C++ source code. It compares source text with a built-in database of functions associated with security problems, generally disregarding comments and strings except for Flawfinder directives. Findings are ordered by risk, which depends on the function and its parameter values; the tool may reduce some false positives when it identifies a construct as not risky. Reports can be generated as text, HTML, CSV, or SARIF. The --patch option narrows findings to changed lines in a unified diff, with a one-line margin. Installation is documented through pip, source downloads, and distribution packages, and the tool requires Python 2.7 or Python 3. The project says it works on Unix-like systems, including GNU/Linux, and on Windows with Cygwin; direct Windows use has also been reported to work. Flawfinder is released under GPL-2.0+. It does not perform control-flow or data-flow analysis, so its output is an aid to review rather than a substitute for security knowledge or human judgment.

Spec sheet

Purpose
Flawfinder examines C/C++ source code and reports possible security weaknesses sorted by risk level.Read 4 Oct 2026 · dwheeler.com
Intended users
The site presents Flawfinder as an aid for developers seeking to find potential security problems in C/C++ application source before release, and cautions that it does not replace security knowledge or human review.Read 4 Oct 2026 · dwheeler.com
Integrations
The site describes CSV output as useful for integrating with other tools and also offers SARIF output in JSON format.Read 4 Oct 2026 · dwheeler.com
Support
The project directs general questions to its mailing list and specific bugs or feature requests to git or the issue tracker on SourceForge.Read 4 Oct 2026 · dwheeler.com
License
Flawfinder is released under GNU General Public License version 2 or later, with SPDX expression GPL-2.0+.Read 4 Oct 2026 · dwheeler.com
CWE and practices
The project says Flawfinder is CWE-compatible and has earned the CII Best Practices passing badge.Read 4 Oct 2026 · dwheeler.com
Detection method
It matches source text against a built-in database of C/C++ functions associated with security problems, ignoring comments and strings except for Flawfinder directives.Read 4 Oct 2026 · dwheeler.com
Installation
The site documents installation with pip, direct source download, and distribution packages; it requires Python 2.7 or Python 3.Read 4 Oct 2026 · dwheeler.com
Maintainer
David A. Wheeler says he created and maintains Flawfinder, a C/C++ security static analysis tool, since 2001.Read 4 Oct 2026 · dwheeler.com
Output formats
It can produce text, HTML, CSV, and SARIF output.Read 4 Oct 2026 · dwheeler.com
Patch review
The --patch option limits reported hits to lines related to changes in a unified diff, with a one-line margin around changed lines.Read 4 Oct 2026 · dwheeler.com
Risk ranking
Reported hits are sorted by risk, which depends on the function and its parameter values; the tool may reduce some false positives when it determines a construct is not risky.Read 4 Oct 2026 · dwheeler.com
Safe use
The site advises analyzing a copy of source code and warns against loading or diffing hitlists from untrusted sources because they use Python pickle.Read 4 Oct 2026 · dwheeler.com
Security limits
Flawfinder does not perform control-flow or data-flow analysis, and the site warns that some reported hits are not vulnerabilities and some vulnerabilities may not be found.Read 4 Oct 2026 · dwheeler.com
Supported systems
The site says Flawfinder works on Unix-like systems, including tested GNU/Linux, and on Windows using Cygwin; it also reports that direct Windows use has been reported to work.Read 4 Oct 2026 · dwheeler.com

Plans and prices

Flawfinder Free Free for anyone to use · GPL-2.0+ open source Read 4 Oct 2026 · dwheeler.com

Every Flawfinder plan and price →

Strong points and limits

Strong points

  • Reports findings ordered by risk.
  • Supports text, HTML, CSV, and SARIF output.
  • Patch mode narrows results to changed lines.
  • Free under GPL-2.0+.
  • Installation options include pip and distribution packages.

Limits

  • Requires Python 2.7 or Python 3.
  • Does not perform control-flow analysis.
  • Does not perform data-flow analysis.
  • Some vulnerabilities may not be found.

Who it suits

It suits developers looking for potential security problems in C or C++ application source before release. Users should be prepared to assess findings with human review.

Verdict

Flawfinder offers a free way to scan C/C++ source text and produce findings in several formats. Its lack of control-flow and data-flow analysis means results need informed human review.

Where Specifiction places it

Alternatives to FlawfinderAll alternatives →