Flawfinder
6.3#8 in c and c++ static analysis toolsFree planFree planLinuxmacOSSelf-hostedWindows
VisitFlawfinder vs Semgrep Code
Semgrep Code
8.3#1 in sast toolsFrom $15 a monthFree planWebAPIExtensionLinux
VisitWhat both publish
| Fact | Flawfinder | Semgrep Code |
|---|---|---|
| Installation | The site documents installation with pip, direct source download, and distribution packages; it requires Python 2.7 or Python 3. | Official installation paths include Homebrew on macOS, pip on Windows and Linux, and a semgrep/semgrep Docker image on Linux. |
| Integrations | The site describes CSV output as useful for integrating with other tools and also offers SARIF output in JSON format. | Supported workflow connections include GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure, Buildkite, HackerOne, Slack, email, webhooks, VS Code and IntelliJ. |
| Purpose | Flawfinder examines C/C++ source code and reports possible security weaknesses sorted by risk level. | Semgrep Code is a static application security testing product that finds code vulnerabilities and helps developers fix them. |
Flawfinder plans
- FlawfinderFree
Semgrep Code plans
- Free EditionFree
- Teams Secrets$15 a month
- Teams — Code$30 a month
- Teams Code$30 a month
- Teams Supply Chain$30 a month
- EnterprisePriced on request
Pick Flawfinder if…
Flawfinder suits developers reviewing C or C++ source for potential security problems before release. It can also help teams that want text, CSV, or SARIF output for review workflows.
Pick Semgrep Code if…
Semgrep Code suits development teams looking for source-code vulnerability scanning within pull request, IDE or CI workflows. The listed Free Edition is for teams within its repository and contributor limits; larger teams can consider the paid tiers.