- Home
- SAST Tools
- Flawfinder
Flawfinder
What it is
Flawfinder is a free tool for examining C and C++ source code for possible security weaknesses. It searches source text for matches in a built-in database of functions associated with security problems, while generally ignoring comments and strings except for its own directives. Results are ordered by risk based on the function and its parameter values, and the tool may reduce some false positives when it recognizes a construct as not risky. Reports can be produced as text, HTML, CSV or SARIF. Its patch option narrows results to lines related to changes in a unified diff, with a one-line margin around them. Flawfinder is released under GPL-2.0+ and requires Python 2.7 or Python 3; installation options include pip, source download and distribution packages. The project says it works on Unix-like systems, including GNU/Linux, and on Windows with Cygwin; direct Windows use has also been reported to work. It does not perform control-flow or data-flow analysis, so reported hits need review and some vulnerabilities may not be detected.
For and against
For
- Free to use under GPL-2.0+
- Sorts reported hits by risk
- Reports in text, HTML, CSV and SARIF
- Patch option focuses on changed code
- Installation options include pip and distribution packages
Against
- Does not perform control-flow or data-flow analysis
- Some hits are not vulnerabilities
- Some vulnerabilities may not be found
The verdict
Flawfinder offers a focused way to flag possible weaknesses in C and C++ source, including changes under review. Its stated analysis limits mean results should be assessed by a person.
Who it suits
Flawfinder suits developers looking for potential security problems in C or C++ source before release. It is an aid to, not a replacement for, security knowledge and human review.
Plans and prices
Flawfinder
Free for anyone to use · GPL-2.0+ open source
Read 4 Oct 2026 · dwheeler.com
On the record
- CWE and practices
- The project says Flawfinder is CWE-compatible and has earned the CII Best Practices passing badge.dwheeler.com · read 4 Oct 2026
- Detection method
- It matches source text against a built-in database of C/C++ functions associated with security problems, ignoring comments and strings except for Flawfinder directives.dwheeler.com · read 4 Oct 2026
- Installation
- The site documents installation with pip, direct source download, and distribution packages; it requires Python 2.7 or Python 3.dwheeler.com · read 4 Oct 2026
- Integrations
- The site describes CSV output as useful for integrating with other tools and also offers SARIF output in JSON format.dwheeler.com · read 4 Oct 2026
- Intended users
- The site presents Flawfinder as an aid for developers seeking to find potential security problems in C/C++ application source before release, and cautions that it does not replace security knowledge or human review.dwheeler.com · read 4 Oct 2026
- License
- Flawfinder is released under GNU General Public License version 2 or later, with SPDX expression GPL-2.0+.dwheeler.com · read 4 Oct 2026
- Maintainer
- David A. Wheeler says he created and maintains Flawfinder, a C/C++ security static analysis tool, since 2001.dwheeler.com · read 4 Oct 2026
- Output formats
- It can produce text, HTML, CSV, and SARIF output.dwheeler.com · read 4 Oct 2026
- Patch review
- The --patch option limits reported hits to lines related to changes in a unified diff, with a one-line margin around changed lines.dwheeler.com · read 4 Oct 2026
- Purpose
- Flawfinder examines C/C++ source code and reports possible security weaknesses sorted by risk level.dwheeler.com · read 4 Oct 2026
- Risk ranking
- Reported hits are sorted by risk, which depends on the function and its parameter values; the tool may reduce some false positives when it determines a construct is not risky.dwheeler.com · read 4 Oct 2026
- Safe use
- The site advises analyzing a copy of source code and warns against loading or diffing hitlists from untrusted sources because they use Python pickle.dwheeler.com · read 4 Oct 2026
- Security limits
- Flawfinder does not perform control-flow or data-flow analysis, and the site warns that some reported hits are not vulnerabilities and some vulnerabilities may not be found.dwheeler.com · read 4 Oct 2026
- Support
- The project directs general questions to its mailing list and specific bugs or feature requests to git or the issue tracker on SourceForge.dwheeler.com · read 4 Oct 2026
- Supported systems
- The site says Flawfinder works on Unix-like systems, including tested GNU/Linux, and on Windows using Cygwin; it also reports that direct Windows use has been reported to work.dwheeler.com · read 4 Oct 2026
