Flawfinder vs Microsoft DevSkim
Flawfinder
dwheeler.comMicrosoft DevSkim
github.comSide by side
| Figure | Flawfinder | Microsoft DevSkim |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Static Application Security Testing Software | 8.1 (#8) | 7.9 (#12) |
| Intended users | The site presents Flawfinder as an aid for developers seeking to find potential security problems in C/C++ application source before release, and cautions that it does not replace security knowledge or human review. | The project describes its goal as helping developers identify and fix security vulnerabilities early and build security awareness. |
| License | Flawfinder is released under GNU General Public License version 2 or later, with SPDX expression GPL-2.0+. | DevSkim is licensed under the MIT License. |
| Output formats | It can produce text, HTML, CSV, and SARIF output. | The tool supports SARIF, JSON, and text output formats. |
| Purpose | Flawfinder examines C/C++ source code and reports possible security weaknesses sorted by risk level. | DevSkim provides IDE plugins, language analyzers, and rules for security linting and static source-code analysis. |
| Support | The project directs general questions to its mailing list and specific bugs or feature requests to git or the issue tracker on SourceForge. | Support is limited to GitHub issues and the project wiki resources listed in its support policy. |
Plans
In their own words
Flawfinder
Flawfinder is a free tool for finding possible security weaknesses in C and C++ source code. It compares source text with a built-in database of functions associated with security problems, generally disregarding comments and strings except for Flawfinder directives. Findings are ordered by risk, which depends on the function and its parameter values; the tool may reduce some false positives when it identifies a construct as not risky. Reports can be generated as text, HTML, CSV, or SARIF. The --patch option narrows findings to changed lines in a unified diff, with a one-line margin. Installation is documented through pip, source downloads, and distribution packages, and the tool requires Python 2.7 or Python 3. The project says it works on Unix-like systems, including GNU/Linux, and on Windows with Cygwin; direct Windows use has also been reported to work. Flawfinder is released under GPL-2.0+. It does not perform control-flow or data-flow analysis, so its output is an aid to review rather than a substitute for security knowledge or human judgment.
Microsoft DevSkim
Microsoft DevSkim is a free, MIT-licensed toolkit for security linting and static source-code analysis. It provides IDE extensions, language analyzers, and rules to help developers identify and address security vulnerabilities early. It includes built-in rules and allows teams to write their own using JSONPath, XPath, and YmlPath. Listed language support includes C, C++, C#, Cobol, Go, Java, JavaScript/TypeScript, and Python, among others. Its cross-platform .NET CLI analyzes files and directories and can be installed as a global tool or obtained as binaries for Windows, macOS, and Linux. A C# library is also available for embedding analysis in other tools. Results can be emitted as SARIF, JSON, or text; the CLI can apply suggested fixes from SARIF results and add suppression comments. The project lists extensions for Visual Studio Code and Visual Studio, and supports CI/CD in self-hosted environments. Support is limited to GitHub issues and project wiki resources. Vulnerability reports should be sent privately to Microsoft's Security Response Center rather than posted publicly.