Flawfinder vs LDRA Tool Suite
Flawfinder
dwheeler.com
LDRA Tool Suite
ldra.comSide by side
| Figure | Flawfinder | LDRA Tool Suite |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | Yes |
| Open source | — | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · C and C++ Static Analysis Tools | 8.1 (#9) | 7.7 (#12) |
| Spec score · Static Analysis Tools | 8.0 (#14) | 7.7 (#19) |
| Integrations | The site describes CSV output as useful for integrating with other tools and also offers SARIF output in JSON format. | LDRA lists integrations with requirements and lifecycle tools including Atlassian Jira and IBM Engineering Requirements Management DOORS. |
| Purpose | Flawfinder examines C/C++ source code and reports possible security weaknesses sorted by risk level. | An integrated suite for verification, testing, and requirements traceability in safety-, security-, and mission-critical software development. |
| Support | The project directs general questions to its mailing list and specific bugs or feature requests to git or the issue tracker on SourceForge. | LDRA lists support contact channels by email and phone for EMEA, the USA, and India. |
Plans
In their own words
Flawfinder
Flawfinder is a free tool for finding possible security weaknesses in C and C++ source code. It compares source text with a built-in database of functions associated with security problems, generally disregarding comments and strings except for Flawfinder directives. Findings are ordered by risk, which depends on the function and its parameter values; the tool may reduce some false positives when it identifies a construct as not risky. Reports can be generated as text, HTML, CSV, or SARIF. The --patch option narrows findings to changed lines in a unified diff, with a one-line margin. Installation is documented through pip, source downloads, and distribution packages, and the tool requires Python 2.7 or Python 3. The project says it works on Unix-like systems, including GNU/Linux, and on Windows with Cygwin; direct Windows use has also been reported to work. Flawfinder is released under GPL-2.0+. It does not perform control-flow or data-flow analysis, so its output is an aid to review rather than a substitute for security knowledge or human judgment.
LDRA Tool Suite
LDRA Tool Suite combines verification, testing, and requirements traceability for safety-, security-, and mission-critical software development. Its core capabilities include static and dynamic analysis, coding standards checks, unit, integration, and system testing, plus compliance reporting. The main components are TBvision, TBrun, TBmanager, and LDRA Testbed. TBmanager links requirements and design artifacts with source code, test cases, and verification results to maintain audit trails. Structural coverage analysis includes statement, branch, and MC/DC metrics at unit, integration, and system levels. LDRA lists support for standards including DO-178C, ISO 26262, IEC 61508, IEC 62304, and EN 50716, as well as integrations with Atlassian Jira, IBM Engineering Requirements Management DOORS, Jenkins, Bamboo, and GitLab. Listed languages include C, C++, Java, Ada95, and Assemblers. The suite is self-hosted on listed Windows, Linux, and Mac hosts. Pricing is on request. LDRA offers a 30-day free trial through a registration page that requests company and contact information.