CodeSonar vs Flawfinder
CodeSonar
adacore.com
Flawfinder
dwheeler.comSide by side
| Figure | CodeSonar | Flawfinder |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | — |
| Windows | Yes | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Static Application Security Testing Sast | 8.1 (#5) | 8.1 (#6) |
| Spec score · Static Application Security Testing Software | 8.1 (#7) | 8.1 (#8) |
| Spec score · SAST Tools | 8.1 (#8) | 8.1 (#9) |
| Integrations | The product page identifies Visual Studio, GitLab, Jira, Jenkins, and VS Code integrations, and says CodeSonar integrates with project management, CI/CD workflows, and developer IDEs. | The site describes CSV output as useful for integrating with other tools and also offers SARIF output in JSON format. |
| Purpose | CodeSonar is a static application security testing solution that finds security and quality defects in code. | Flawfinder examines C/C++ source code and reports possible security weaknesses sorted by risk level. |
| Support | AdaCore says its engineering team is directly accessible through support and that customers can speak with the developers of the technology. | The project directs general questions to its mailing list and specific bugs or feature requests to git or the issue tracker on SourceForge. |
Plans
In their own words
CodeSonar
CodeSonar is AdaCore’s static application security testing solution for finding security and quality defects in source code and compiled binaries. It supports C/C++, Java, C#, Kotlin, Python, Go, Rust, JavaScript and TypeScript. Abstract interpretation and symbolic execution examine feasible execution paths across procedures and modules. Binary analysis covers mixed-language environments and cases where source is unavailable. Security coverage includes OWASP Top 10, SANS/CWE 25, SEI CERT C/C++ and DISA STIG; coding standards include MISRA-C, MISRA-C++, AUTOSAR C++, JSF++ and CERT. Integrations include Visual Studio, GitLab, Jira, Jenkins and VS Code, alongside project-management, CI/CD and IDE workflows. Pull-request scans, custom security rules and report exports to PDF, HTML or XML are supported. AdaCore offers on-premises, air-gapped and private-cloud deployment. The tool runs on supported 64-bit Windows and Linux distributions with glibc 2.39 or higher. Pricing is on request, with a trial available.
Flawfinder
Flawfinder is a free tool for finding possible security weaknesses in C and C++ source code. It compares source text with a built-in database of functions associated with security problems, generally disregarding comments and strings except for Flawfinder directives. Findings are ordered by risk, which depends on the function and its parameter values; the tool may reduce some false positives when it identifies a construct as not risky. Reports can be generated as text, HTML, CSV, or SARIF. The --patch option narrows findings to changed lines in a unified diff, with a one-line margin. Installation is documented through pip, source downloads, and distribution packages, and the tool requires Python 2.7 or Python 3. The project says it works on Unix-like systems, including GNU/Linux, and on Windows with Cygwin; direct Windows use has also been reported to work. Flawfinder is released under GPL-2.0+. It does not perform control-flow or data-flow analysis, so its output is an aid to review rather than a substitute for security knowledge or human judgment.