Side by side
Flawfinder vs gosec
Both stand on static application security testing sast. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan LinuxMacSelf-hosted+1
Flawfinder offers risk-ranked checks for C/C++ source with several report formats and a patch-focused option. Treat it as an aid to security review, not a complete vulnerability detector.
Visit Flawfinder Free plan Open source APILinuxMac+1
gosec offers configurable static security analysis for Go, with several output formats and CI integration options. Teams should review findings because automated detection can flag safe code.
Visit gosecThe facts
| Flawfinder | gosec | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Not published | Yes |
| Runs on | Linux, Mac, Self-hosted, Windows | API, Linux, Mac, Self-hosted |
| Lowest paid plan | Free or on request | Free or on request |
| Plans published | 1 | 1 |
| Maker | Not published | Not published |
| Website | dwheeler.com | github.com |
| On static application security testing sast | #4 of 24 | #1 of 24 |
Flawfinder: what it does well
- Free to use under GPL-2.0+.
- Reports in text, HTML, CSV, and SARIF.
- Patch option narrows findings to changed lines.
- Installation options include pip and distribution packages.
What to know first
- Does not perform control-flow or data-flow analysis.
- Some hits are not vulnerabilities; some vulnerabilities may be missed.
- Requires Python 2.7 or Python 3.
gosec: what it does well
- Checks map findings to CWE entries
- Supports rule selection and path-based exclusions
- Reports include SARIF, JSON, and JUnit XML
- Documented GitHub Actions and GitHub code scanning use
- Apache License 2.0
What to know first
- Local installation requires Go 1.25 or newer
- Automated detection can produce false positives
- AI fix suggestions call an AI API
Alternatives to Flawfinder Alternatives to gosec The whole list