Flawfinder examines source code and reports possible security weaknesses (``flaws'') sorted by risk level. It's very useful for quickly finding and removing at least some potential security problems before a program is widely released to the public. Flawfinder works on Unix-like systems today (it's been tested on GNU/Linux), and it should be easy to port to Windows systems. It requires Python 1.5 or greater to run (Python 1.3 or earlier won't work).
Splint is a tool for statically checking C programs for security vulnerabilities and coding mistakes. With minimal effort, Spl ...
Coverity Scan Static Analysis allows to find and fix defects in your Java, C/C++ or C# open source project for free. It tests ...
lgtm.com is a platform for code analytics. It's free to use for open source software; results for over 55k projects are readil ...
Facebook Infer is a static analysis tool - if you give Infer some Objective-C, Java, or C code, it produces a list of potentia ...
Cppcheck is an static analysis tool for C/C++ code. Unlike C/C++ compilers and many other analysis tools it does not detect sy ...
VCG is an automated code security review tool that handles C/C++, Java, C#, VB and PL/SQL. It has a few features that should h ...
EDoC++ is a C++ source analysis tool designed to identify problems associated with the use of exceptions in C++ code. Addition ...