Flawfinder vs SeaHorn
Flawfinder
dwheeler.comSeaHorn
seahorn.github.ioSide by side
| Figure | Flawfinder | SeaHorn |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | — |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 0 |
| Spec score · C and C++ Static Analysis Tools | 8.1 (#9) | 7.2 (#17) |
| Integrations | The site describes CSV output as useful for integrating with other tools and also offers SARIF output in JSON format. | The site identifies CRAB as the abstract interpretation analyzer SeaHorn uses to provide numerical invariants. |
| License | Flawfinder is released under GNU General Public License version 2 or later, with SPDX expression GPL-2.0+. | SeaHorn is distributed under a modified BSD license. |
| Purpose | Flawfinder examines C/C++ source code and reports possible security weaknesses sorted by risk level. | SeaHorn is a verification framework for LLVM-based programs. |
| Support | The project directs general questions to its mailing list and specific bugs or feature requests to git or the issue tracker on SourceForge. | The project says it provides support to new users and invites users to report issues when Docker tags become stale. |
Plans
In their own words
Flawfinder
Flawfinder is a free tool for finding possible security weaknesses in C and C++ source code. It compares source text with a built-in database of functions associated with security problems, generally disregarding comments and strings except for Flawfinder directives. Findings are ordered by risk, which depends on the function and its parameter values; the tool may reduce some false positives when it identifies a construct as not risky. Reports can be generated as text, HTML, CSV, or SARIF. The --patch option narrows findings to changed lines in a unified diff, with a one-line margin. Installation is documented through pip, source downloads, and distribution packages, and the tool requires Python 2.7 or Python 3. The project says it works on Unix-like systems, including GNU/Linux, and on Windows with Cygwin; direct Windows use has also been reported to work. Flawfinder is released under GPL-2.0+. It does not perform control-flow or data-flow analysis, so its output is an aid to review rather than a substitute for security knowledge or human judgment.
SeaHorn
SeaHorn is a free, open-source framework for automated analysis of C and other LLVM-based programs, developed mainly for research in automated verification. It is not an out-of-the-box static analyzer. Its frontend prepares LLVM IR bitcode, and its middle end converts optimized bitcode into verification conditions written as Constrained Horn Clauses. Backend engines use SMT-based model checking, including PDR/IC3 techniques, and CRAB can provide numerical invariants through abstract interpretation. SeaHorn supports abstract interpretation, context-sensitive pointer analysis, bounded model checking, constrained-Horn-clause software model checking, and termination or non-termination analysis. For C programs with assertions, `sea pf` translates the program, generates and solves verification conditions, displays invariants for safe results, or saves a counterexample for violations. `sea inspect` reports program structure and can produce memory or call-graph data. The framework also checks generated clauses for inconsistent code fragments using path coverage. Docker is described as the easiest starting point, with a nightly image refreshed daily. Building requires LLVM, Z3, and Boost, whose exact versions change. SeaHorn runs on Linux, macOS, or self-hosted systems under a modified BSD license.