Install flawfinder with Homebrew, apk, apt, dnf, MacPorts, Nix, pacman, zypper

Project links

• Homepage
• Repository
• Upstream docs
• Package manager page

Commands and aliases

• flawfinder

Project history

Wheeler developed flawfinder as an open source source-code scanner for security weaknesses. The official site explains that it was created to encourage use of static analysis tools and that no one tool is sufficient; flawfinder is meant to be one simple advisor among several.

The project has long been hosted through SourceForge for source, releases, mailing lists, and issue tracking, while later documentation also references GitHub issues, pull requests, a GitHub Action, SARIF output, SonarQube integration, and modern Python packaging. The ChangeLog records the 2.0 series move to semantic versioning in 2017, Python 2.7/3 compatibility, direct pip installation through setuptools, SARIF support in 2021, and security hardening in 2.0.20 in 2026.

Adoption history

The official homepage says prepackaged versions are available for many Unix-like systems, explicitly naming Fedora, Debian, Ubuntu, Cygwin, FreeBSD Ports, OpenBSD ports, NetBSD pkgsrc, and Fink. The supplied package-manager metadata also records packaging in Homebrew, MacPorts, Nix, pacman, zypper, apk, Debian, Ubuntu, and Fedora ecosystems.

flawfinder also earned official CWE compatibility and a CII Best Practices passing badge, which helped make it recognizable in security tooling catalogs and CI pipelines.

How it is used

The basic use case is intentionally small: install with pip or a system package manager, then run `flawfinder` over a file or directory. Findings are assigned risk levels, and output formats include text, HTML, CSV, SARIF, and SonarQube-compatible output.

The tool's design trades deep semantic analysis for speed and availability. Its README notes that it can analyze programs that cannot be built or linked, while also warning that it can produce false positives and miss issues because it lacks full control-flow, data-flow, type, namespace, and scope information.

Why package nerds care

flawfinder is a classic small security package: a single-purpose scanner with no heavyweight service dependency, available through many OS package managers, pip, and CI integrations. It is especially relevant to package history because it bridges early-2000s free-software security scanning, distribution packaging, CWE-era rule classification, and modern SARIF-based code scanning.

Timeline

• 2001: flawfinder and RATS are released simultaneously on May 21.
• 2002: SANS review coverage appears among the official site's collected reviews.
• 2004: Debian Security Audit Project testimonial records use of flawfinder.
• 2017: 2.0.0 changes versioning to semantic versioning.
• 2017: 2.0.2 adds Python 2.7 and Python 3 support.
• 2017: 2.0.4 switches to setuptools and direct pip install support.
• 2021: 2.0.16 adds SARIF output.
• 2026: 2.0.20 ships security hardening, Sonar output, encoding handling improvements, and CI workflow updates.

Related projects

• RATS is the historically closest related project; the official site says the two scanners were developed independently and released simultaneously.
• ITS4, Warnbuf, Stumoch, CWE, SARIF, SonarQube, and GitHub code scanning are related security-analysis or reporting contexts discussed by the official documentation.

Sources

• https://dwheeler.com/flawfinder
• https://dwheeler.com/flawfinder/flawfinder.pdf
• https://formulae.brew.sh/formula/flawfinder
• https://sourceforge.net/p/flawfinder/code
• https://sourceforge.net/p/flawfinder/code/ci/master/tree/ChangeLog?format=raw
• https://sourceforge.net/p/flawfinder/code/ci/master/tree/README.md?format=raw