Flawfinder alternatives

Ranked alternatives

1. 1
   
   CppcheckFree

   Cppcheck is a prominent static analysis tool for Windows, Mac, Debian, and Fedora that allows you to identify bugs in your C++/C code. It uses unique code analysis to scan your project and find harmful coding constructs and undefined behavior, giving you the opportunity to fix them once they are found. The aim behind its development is to reduce the number of false positives significantly. The best feature is that you can use it can also work with code having non-standard syntax.

   The characteristics of Cppcheck include the ability to locate undefined behavior, can be utilized using the GUI and command-line interface and identifies multiple bugs in source code through Unique code analysis. The Undefined behavior contains Invalid usage of STL, Dead pointers, Uninitialized variables, Integer overflows, and many more. It is integrated with various development tools widely used by developers such as Visual Studio, Buildbot, Hudson, CLion, Tortoise SVN, CodeDX, Jenkins, QtCreator, Eclipse, Mercurial, and many more.

   Cppcheck alternatives
2. 2
   
   Clang Static AnalyzerFree

   Clang Static Analyzer is an open-source source code analysis tool compatible with Mac OS X and Linux distributions that makes it easy for you to find bugs in your Objective-C, C, and C++ code. You can launch and use it via the command line or within Xcode, in case you are using macOS. It is currently used by many developers worldwide to hunt bugs and potentially harmful coding constructs and fix them before product release.

   It is a work-in-progress tool, meaning many updates featuring major enhancements are planned for release in the near future. Another thing to know is that static code analysis consumes a lot of CPU time and is, therefore, slower than compile time. Lastly, it is not perfect and can sometimes flag correct code as false positive, but this is being addressed by the developers of the tool to ensure that false positives remain as low as possible.

   Clang Static Analyzer alternatives
3. 3
   
   Lgtm.comFree

   Lgtm.com is a popular code analysis platform that enables developers to locate zero-days, identify common problems, and ensures that vulnerabilities don’t go unchecked. It is developed by a qualified team of security researchers and is, therefore, a great resource for security analysis. You can catch bugs in the review process and stop them from making their way into the final project. It can be used for free by open-source projects and is integrated with Bitbucket and GitHub to test projects developed in various programming languages, including Java, C++, Python, C, and JavaScript.

   There are currently millions of commits made by thousands of developers, which means your project may have been analyzed too. Use automated reviews to capture bugs and prevent them from getting inside the final project. A major focus of the platform is to decrease the number of false positives so that you won’t receive uninteresting alerts each time anyone makes a code submission. Thanks to its effectiveness Lgtm.com is currently utilized by major tech giants such as Dell and Microsoft.

   Lgtm.com alternatives
4. 4
   
   VisualCodeGrepperFree

   VisualCodeGrepper is a powerful code security review tool built from the ground up to help you analyze code in multiple programming languages, including COBOL, C++, PHP, PL/SQL. It gives you the opportunity to locate bad/insecure code so as to increase the speed of the code review process. It comes packed with many essential features that make it a must-have for any developer who is working in one of the supported languages. Besides reviewing code, it also provides you with a config file that you can use to add bad functions. VisualCodeGrepper is great for finding broken code, bad code, and other issues that can slow down the speed and effectiveness of your project.

   VisualCodeGrepper alternatives
5. 5
   
   Parasoft C/C++testPaid

   Parasoft C/C++test is a feature-rich, easy-to-use, and reliable testing solution that you can use to identify problems and in your C++/C code. It can help you track down bad code, speed up the performance, and save a lot of money. It complies with modern Industry standards and uses test automation to produce verification reports. You can end money loss and preserve time by identifying and solving issues early on, which makes it easy to avoid challenging and costly errors later on.

   The software also gives a boost to your productivity and uses AI and machine learning technology to decrease the responsibilities on employees, and allows you to repair serious design flaws first. The features provided by the solution include Static Analysis, Unit Testing, Code Coverage and Traceability, Technical Specs, Reporting and Analytics, Functional Safety and Compliance, Runtime Analysis, and Security Testing. Parasoft C/C++test assists Development Managers, Software Engineers, and QA Testers in performing their tasks with high efficiency.

   Parasoft C/C++test alternatives
6. 6
   
   LDRA TestbedPaid

   LDRA Testbed enables you to conduct static and dynamic code analysis and find critical vulnerabilities early on. It offers an interactive environment called “TBvision” which comes in handy for checking the quality metrics and coding standard compliance and quickly locating and solving problems at the source code level. It aligns with industry coding standards and shows issues that can make their way into the standard build, leading to costly mistakes in the future.

   The solution features a parsing engine that rapidly implements new analysis techniques to fulfill new standards requirements, ensuring that you will be able to compete in the market. The highlights include improvement in testing efficiency, analysis that aligns with MISRA C compliance, got certification from FAA DO-178B standard before anyone else, and more.

   LDRA Testbed alternatives
7. 7
   
   PolyspacePaid

   Polyspace is a suite of static code analysis products developed by Matlab to help software developers, QA Testers, and engineers find critical problems in their code and fix them before they become a serious threat. There are various benefits associated with it, such as checkers for coding rules, code metrics, and more, making it a top resource for the developer community. The product line consists of Polyspace Code Prover, Polyspace Bug Finder, and Polyspace for Ada.

   The best feature is that you can enhance the quality of code by identifying bugs and fix them early on without the need for code execution or test cases. It also helps you align with the indicated document compliance and safety standards such as DO-178, MISRA, regulations from FDA, and more. Another great feature is that it gives you the opportunity to visualize security weaknesses and standards like CERT-C, CWE, and more.

   Polyspace alternatives
8. 8
   
   Perforce Helix QACPaid

   Perforce Helix QAC is a handy, reliable, and highly rated Static Code Analysis solution that aids you in the process of finding vulnerabilities and problems within your C/C++ code. It is fully compliant with major standards, ensures faster releases, and allows you to optimize your code quality. It works using a Risk Prioritization approach in which issues are ranked based on their severity. The software makes it easy for you to fix the most harmful flaws through baselines, filters, and suppressions.

   It offers the right diagnostics and meaningful results to help you solve the major issues early on. You can use the Analysis Dashboard, which contains all the results of concluded analysis and requires a web browser to launch. It records results in the form of ‘snapshots, which are uploaded soon after the conclusion of each analysis.

   Other benefits include tracking growing trends with customizable reports, spotting deviations and issues, evaluating the quality of code, review notifications and updates for a project, and more. Lastly, Perforce Helix QAC is used by multiple industries, including Aerospace and Defense, Embedded Development, Automotive, and Energy Technology, and Medical devices.

   Perforce Helix QAC alternatives
9. 9
   
   SonarSourceFreemium

   SonarSource is a famous company known for building top-quality products for optimizing Code Security and Code Quality and can analyze over 25 programming languages, including Java, COBOL, JavaScript, C++, C#, Python, Go, PHP, Scala, HTML5, and many more. The product line contains SonarLint, SonarCloud, and SonarQube. SonarLint is an IDE extension that you can install for free and use to identify and fix coding problems early in the development lifecycle.

   It works by highlighting Security Vulnerabilities and Bugs the moment the code is being typed and provides detailed guidance to make it easy for you to repair them before committing the project. The extension can be installed with some of the major IDE’s such as Eclipse, VS Code, IntelliJ, and Visual Studio. Other features of SonarLint include Instant View, On-the-fly Detection, Smart Education, and Push Notifications. Another great product offered by SonarSource is SonarQube, which gives developers the tools to write safe, secure, and cleaner code. All the products are highly effective in enhancing the quality of code and delivering the best experience for the end-user.

   SonarSource alternatives
10. 10
    
    PVS-StudioPaid

    PVS-Studio is a static analyzer that is designed to identify multiple errors/bugs such as potential vulnerabilities, typos, and dead code in several programming languages including C#, Java, C, and C++ on different operating systems like macOS, Microsoft Windows, and Linux. It assists developers, managers, and security professionals in different time periods. Developers can use it to debug the code and quickly detect errors, find errors that have penetrated the version control system, and utilize it during development to spot an error as soon as it occurs.

    Managers can take advantage of its features to root out bugs, resolve errors reported by the end-user, improve code quality, and enhance code quality and reliability. PVS-Studio can be easily integrated with many applications like Visual Studio, Eclipse, Rider, Intellij Idea, MSBuild, Ninja, SonarQube, CircleCI, Azure DevOps, Travis CI, WSL, Docker, IncrediBuild, Jenkins, TeamCity, Maven, CMake, Unreal Engine, and many more.

    PVS-Studio alternatives