Flawfinder vs Semgrep Code
Flawfinder
dwheeler.com
Semgrep Code
semgrep.devSide by side
| Figure | Flawfinder | Semgrep Code |
|---|---|---|
| Price from | Free | $15/mo |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Web | — | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 7 |
| Spec score · Static Application Security Testing Sast | 8.1 (#6) | 8.7 (#2) |
| Spec score · Static Application Security Testing Software | 8.1 (#8) | 8.7 (#2) |
| Spec score · SAST Tools | 8.1 (#9) | 8.7 (#3) |
| Spec score · C and C++ Static Analysis Tools | 8.1 (#9) | 8.7 (#3) |
| Installation | The site documents installation with pip, direct source download, and distribution packages; it requires Python 2.7 or Python 3. | Official installation paths include Homebrew on macOS, pip on Windows and Linux, and a semgrep/semgrep Docker image on Linux. |
| Integrations | The site describes CSV output as useful for integrating with other tools and also offers SARIF output in JSON format. | Supported workflow connections include GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure, Buildkite, HackerOne, Slack, email, webhooks, VS Code and IntelliJ. |
| Purpose | Flawfinder examines C/C++ source code and reports possible security weaknesses sorted by risk level. | Semgrep Code is a static application security testing product that finds code vulnerabilities and helps developers fix them. |
| Support | The project directs general questions to its mailing list and specific bugs or feature requests to git or the issue tracker on SourceForge. | Paid customers receive technical support from 8 AM to 1 AM UTC on weekdays through private Slack, the web help area or support email. |
Plans
Semgrep Code
- Free EditionFree
- Free EditionFree
- Teams Secrets$15 a month
- Teams — Code$30 a month
- Teams Code$30 a month
- Teams Supply Chain$30 a month
- EnterprisePriced on request
In their own words
Flawfinder
Flawfinder is a free tool for finding possible security weaknesses in C and C++ source code. It compares source text with a built-in database of functions associated with security problems, generally disregarding comments and strings except for Flawfinder directives. Findings are ordered by risk, which depends on the function and its parameter values; the tool may reduce some false positives when it identifies a construct as not risky. Reports can be generated as text, HTML, CSV, or SARIF. The --patch option narrows findings to changed lines in a unified diff, with a one-line margin. Installation is documented through pip, source downloads, and distribution packages, and the tool requires Python 2.7 or Python 3. The project says it works on Unix-like systems, including GNU/Linux, and on Windows with Cygwin; direct Windows use has also been reported to work. Flawfinder is released under GPL-2.0+. It does not perform control-flow or data-flow analysis, so its output is an aid to review rather than a substitute for security knowledge or human judgment.
Semgrep Code
Semgrep Code is a cloud-based static application security testing product for finding vulnerabilities in source code and helping developers address them. It combines deterministic analysis for issues such as XSS and SQL injection with AI analysis aimed at complex flaws, including IDOR and business logic vulnerabilities. Pull requests can carry tailored, step-by-step remediation instructions, and the product supports 35 programming languages. Semgrep lists integrations with GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure and Buildkite, plus VS Code and IntelliJ extensions and Slack, email and webhook notifications. The Free Edition includes Code and Supply Chain, with scanning for up to 10 repositories and a limit of 10 contributors. Teams supports up to 500 private repositories; Enterprise has no repository or contributor limit. For local or fully CI-based scans, code stays on the user's computer or CI environment; opting into AI processing sends part of a file containing a finding to a model. The Free Edition costs nothing. Teams — Code is listed at $30 a month.