Flawfinder vs GitHub CodeQL
Flawfinder
dwheeler.com
GitHub CodeQL
codeql.github.comSide by side
| Figure | Flawfinder | GitHub CodeQL |
|---|---|---|
| Price from | Free | $30/mo |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | — | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 5 |
| Spec score · Static Application Security Testing Sast | 8.1 (#6) | 8.5 (#4) |
| Spec score · Static Application Security Testing Software | 8.1 (#8) | 8.6 (#3) |
| Spec score · SAST Tools | 8.1 (#9) | 8.5 (#5) |
| Spec score · C and C++ Static Analysis Tools | 8.1 (#9) | 8.5 (#4) |
| Spec score · Static Analysis Tools | 8.0 (#15) | 8.5 (#8) |
| Purpose | Flawfinder examines C/C++ source code and reports possible security weaknesses sorted by risk level. | CodeQL is a language and toolchain for code analysis that treats code as data. |
Plans
GitHub CodeQL
- Free for research and open sourceFree
- GitHub Code Security$30 a month
- CodeQL for open source and researchFree
- GitHub Code Security$30 a month
- GitHub Free with CodeQL code scanningPrice not published
In their own words
Flawfinder
Flawfinder is a free tool for finding possible security weaknesses in C and C++ source code. It compares source text with a built-in database of functions associated with security problems, generally disregarding comments and strings except for Flawfinder directives. Findings are ordered by risk, which depends on the function and its parameter values; the tool may reduce some false positives when it identifies a construct as not risky. Reports can be generated as text, HTML, CSV, or SARIF. The --patch option narrows findings to changed lines in a unified diff, with a one-line margin. Installation is documented through pip, source downloads, and distribution packages, and the tool requires Python 2.7 or Python 3. The project says it works on Unix-like systems, including GNU/Linux, and on Windows with Cygwin; direct Windows use has also been reported to work. Flawfinder is released under GPL-2.0+. It does not perform control-flow or data-flow analysis, so its output is an aid to review rather than a substitute for security knowledge or human judgment.
GitHub CodeQL
GitHub CodeQL has no write-up on Specifiction yet; its figures are above.