flawfinder

Flawfinder is a static analysis tool designed to scan C/C++ source code for potential security vulnerabilities by reporting findings categorized by risk levels. It supports Common Weakness Enumeration (CWE) and offers various output formats such as SARIF, SonarQube, and HTML, making it compatible with other AI-based code analysis tools for more detailed examination. The tool is easy to install, operate from the command line on Unix/Linux/POSIX systems, and provides fine-grained control over the risk level output.