Flawfinder vs Xygeni

Flawfinder is a free tool for finding possible security weaknesses in C and C++ source code. It compares source text with a built-in database of functions associated with security problems, generally disregarding comments and strings except for Flawfinder directives. Findings are ordered by risk, which depends on the function and its parameter values; the tool may reduce some false positives when it identifies a construct as not risky. Reports can be generated as text, HTML, CSV, or SARIF. The --patch option narrows findings to changed lines in a unified diff, with a one-line margin. Installation is documented through pip, source downloads, and distribution packages, and the tool requires Python 2.7 or Python 3. The project says it works on Unix-like systems, including GNU/Linux, and on Windows with Cygwin; direct Windows use has also been reported to work. Flawfinder is released under GPL-2.0+. It does not perform control-flow or data-flow analysis, so its output is an aid to review rather than a substitute for security knowledge or human judgment.

Xygeni describes itself as an application security platform for risks across the software supply chain. Its scanner runs inside the customer’s network and can inspect directories, repositories, container images, or source-control organizations. Findings can be sent to a cloud dashboard or kept locally; Xygeni says source code is not uploaded for scanning. The platform checks configuration files, build scripts, and CI job definitions for supply-chain misconfigurations, and performs automated audits against OpenSSF Scorecard and CIS Software Supply Chain Security. Secrets Security identifies more than 100 types of secrets and can block commits through Git hooks. Xygeni supports SSO with SAML2 and offers a REST API for security issues, risk summaries, trends, reports, and administration. Documented integrations include GitHub, GitLab, Azure DevOps, Bitbucket, Jenkins, Slack, and Jira. It supports ecosystems including Maven, Gradle, npm,.NET, Go, Python, PHP, Ruby, and Dart/Flutter, as well as SBOM generation, reachability analysis, and pull-request scanning. The free plan covers five contributors, up to 10 repositories, and 200 scans per month.