Infer vs Semgrep Secrets

Infer is a static analysis tool that examines compiled Java, C, C++, Objective-C, and Erlang code and reports potential bugs before release. Its checks include null pointer problems, resource or memory leaks, coding conventions, unavailable APIs, and concurrency issues such as data races. Some analyses can follow an issue across multiple functions or methods and files. Pulse provides memory-safety analysis, while RacerD checks thread safety. Cost analysis estimates asymptotic function complexity for Java and C-family languages; Hack support is experimental, and Python, Rust, and Swift are not supported by that analysis. Infer captures compilation commands, analyzes the captured files, and writes reports that can be reviewed with `infer explore`; files that are not compiled are not analyzed. Integrations are documented for build tools including Buck, CMake, Gradle, Make, Maven, Xcodebuild, and xctool. It can be installed from binary releases, built from source, or run in Docker. The free plan costs nothing. Infer runs on Linux and macOS, with web and self-hosted options; Windows is not supported.

Semgrep Secrets has no write-up on Specifiction yet; its figures are above.