Flawfinder
Flawfinder: A free, focused scanner for finding potential C/C++ security weaknesses. Ranked #24 of 26 in SAST Tools by our editors (6.8/10); pricing: Free plan; best for C/C++ teams needing simple free scanning.
At a glance
- Editor score6.8 / 10
- PricingFree plan
- Best forC/C++ teams needing simple free scanning
- Free planYes
- Paid fromFree
- Facts checked21 Sep 2026
Where it wins
- Free open-source scanning for C and C++ source code
- CWE identifiers and risk levels from 0 through 5
- SARIF, HTML, CSV, and SonarQube-compatible reports
Where it doesn't
- Lexical analysis is less deep than interprocedural analysis
- No custom rules or autofix
- Patch scanning reviews unified diffs rather than providing native pull-request integration
Our verdict on Flawfinder
Flawfinder is an open-source static analysis command-line tool for developers and security reviewers working with C and C++ source code. It lexically scans source files for tokens and function calls associated with potential security weaknesses, then assigns risk levels from 0 through 5 and includes relevant Common Weakness Enumeration identifiers. Because it can analyze incomplete or unbuildable source, it fits teams that need an accessible first layer of source-code review across Linux, macOS, or Windows through Cygwin.
Its strongest practical advantage is focused reporting control. Teams can set a minimum risk level, filter results with regular expressions, add suppression comments, or disable ignores. Findings can be saved, reloaded, and diffed, while unified-diff patch scanning helps reviewers focus on changed lines. Output is available in text, HTML, CSV, SARIF, and SonarQube-compatible formats, with integrations for GitHub Actions, SonarQube, Vim, and Emacs. These options make Flawfinder suitable for command-line workflows and lightweight CI reporting without requiring a broader development platform.
The trade-off is analysis depth. Flawfinder performs lexical scanning rather than the deeper interprocedural analysis some SAST tools provide, and its published capabilities do not include custom rules or autofix. Its patch-scanning feature reviews unified diffs, but it is not documented as a native pull-request provider integration. Choose Flawfinder when free, open-source C/C++ scanning, configurable filtering, and portable reports are the priority. Teams seeking custom rule authoring, automated code changes, or deeper program-flow analysis should consider a different SAST approach.
Your product? Our editors can test Flawfinder in depth and publish a review, labelled as paid · from $149/mo →
Flawfinder pricing
Flawfinder fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Analysis targets | source code |
| Languages supported | Not verified |
| Pull request scans | Not verified |
| IDE support | Not verified |
| CI/CD integration | Yes |
| Custom security rules | Not verified |
| Automated fixes | Not verified |
| Deployment | Self-hosted |
| Platforms | Windows, macOS, Linux |
| Support | Community, Docs |
| Built for | Solo, Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 2 integrations: GitHub Actions, SonarQube |
| Pricing | Free plan |
| Website | dwheeler.com |
| Facts checked | 21 Sep 2026 |
Flawfinder integrations
Flawfinder lists 2 integrations on its own site.
- GitHub Actions
- SonarQube
Alternatives to Flawfinder
- Semgrep CodeBroad SAST coverage with pull-request, CI/CD, IDE, custom-rule, and AI-assisted workflows.9.4
- Snyk CodeAffordable source-code SAST with pull-request, IDE, CI/CD, and automated-fix workflows.9.2
- GitHub CodeQLDeep SAST for GitHub workflows, with free public-repository scanning.9.0
See all Flawfinder alternatives →
Also Ranked In
Flawfinder is ranked in 5 of our directories.
Used Flawfinder? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Flawfinder for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Flawfinder is listed in our SAST Tools directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/flawfinder/"><img src="https://www.itechguides.com/best/badge/flawfinder.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update