Flawfinder review
A free, focused scanner for finding potential C/C++ security weaknesses.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Flawfinder is an open-source static analysis command-line tool for developers and security reviewers working with C and C++ source code. It lexically scans source files for tokens and function calls associated with potential security weaknesses, then assigns risk levels from 0 through 5 and includes relevant Common Weakness Enumeration identifiers. Because it can analyze incomplete or unbuildable source, it fits teams that need an accessible first layer of source-code review across Linux, macOS, or Windows through Cygwin.
Its strongest practical advantage is focused reporting control. Teams can set a minimum risk level, filter results with regular expressions, add suppression comments, or disable ignores. Findings can be saved, reloaded, and diffed, while unified-diff patch scanning helps reviewers focus on changed lines. Output is available in text, HTML, CSV, SARIF, and SonarQube-compatible formats, with integrations for GitHub Actions, SonarQube, Vim, and Emacs. These options make Flawfinder suitable for command-line workflows and lightweight CI reporting without requiring a broader development platform.
The trade-off is analysis depth. Flawfinder performs lexical scanning rather than the deeper interprocedural analysis some SAST tools provide, and its published capabilities do not include custom rules or autofix. Its patch-scanning feature reviews unified diffs, but it is not documented as a native pull-request provider integration. Choose Flawfinder when free, open-source C/C++ scanning, configurable filtering, and portable reports are the priority. Teams seeking custom rule authoring, automated code changes, or deeper program-flow analysis should consider a different SAST approach.
Flawfinder pros and cons
- Where it wins
- Free open-source scanning for C and C++ source code
- CWE identifiers and risk levels from 0 through 5
- SARIF, HTML, CSV, and SonarQube-compatible reports
- Where it doesn't
- Lexical analysis is less deep than interprocedural analysis
- No custom rules or autofix
- Patch scanning reviews unified diffs rather than providing native pull-request integration
Flawfinder fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update