Flawfinder

Flawfinder is a programming tool that examines C programming language or C plus plus source code looking for security weaknesses. It examines the source code at a simple (lexical) level, primarily looking for function names, which it then compares to a rule database. It then uses the rule database, and the parameters provided to the function, to assign a risk level to that particular code structure. Typical rules involves issues such as string functions that may overflow buffers, format strings that may be controlled by users, and so on. Once it completes examining the source code, it reports the potential security flaws, sorted by risk level. Flawfinder is implemented in Python programming language, and was developed by David A. Wheeler.

It is licensed under the General Public License, and is thus both Open source software and Free software (in the libre sense).

---

FlawFinder, Flawfinder and Computer Security Specialists are also Trademarks of Flawfinder.com.

=See also=

*Static code analysis *Source code scanner *Software testing *Internet security *Advisor

=External links=

*[http://www.dwheeler.com/flawfinder/ Flawfinder program] - flaw detection *[http://www.flawfinder.com/ FlawFinder™ company] - The Internet Security People.