SEI CERT C Coding Standard

Free

The SEI CERT C Coding Standard is a software coding standard for the C programming language to improve the safety, reliability, and security of software systems.

FreeFree tier

Type

Open Source

Company

Software Engineering Institute, Carnegie Mellon University

Visit Website GitHub (38 stars)

About SEI CERT C Coding Standard

The SEI CERT C Coding Standard, developed by the Software Engineering Institute (SEI) at Carnegie Mellon University, is a comprehensive set of guidelines for writing secure, reliable, and safe C code. It comprises rules (normative requirements) and recommendations (guidance) organized into categories such as preprocessor, declarations, expressions, integers, memory management, and concurrency. The standard covers vulnerabilities and undefined/unspecified behavior, and is supported by conformance testing via SCALe, Juliet test cases for static analysis tools, and a downloadable PDF of the 2016 edition. The community can contribute through GitHub issues, and the standard is continually refined based on feedback from the secure coding community.

Key Features

Rules and recommendations covering 22 categories (PRE, DCL, EXP, INT, FLP, ARR, STR, MEM, FIO, ENV, SIG, ERR, API, CON, MSC, POS, WIN)

Conformance testing through SCALe (Source Code Analysis Laboratory)

Juliet test suite with 61,387 test cases for static analysis coverage

Available as a downloadable PDF (2016 Edition)

Community contributions via GitHub issues and subject matter expert review

Risk assessments and references to undefined/unspecified behavior

Pros & Cons

Pros

Comprehensive coverage of C security vulnerabilities and secure coding best practices
Community-driven with peer review and regular updates
Published in official book form and backed by SEI/CMU expertise
Includes risk assessment methodology to prioritize fixes
Conformance testing available through SCALe for formal verification

Cons

The website is a work in progress; many pages are incomplete or contain errors
Not an automated tool – requires manual implementation or use of external static analyzers
Adopting all rules may require significant code refactoring and developer training
May not be suitable for projects with very tight deadlines or legacy code without extensive revision

Best For

Improving safety, reliability, and security of C software systemsEnsuring compliance with C11 and C99 standardsTraining developers in secure coding practicesTesting static analysis tool coverage of secure coding rulesReducing vulnerabilities in critical software (e.g., embedded, systems programming)

FAQ

What is the difference between rules and recommendations in the SEI CERT C Coding Standard?

Rules are normative requirements that must be followed to claim conformance, while recommendations provide guidance that, when followed, should improve safety, reliability, and security of software systems.

How can I contribute to the SEI CERT C Coding Standard?

You can open a GitHub issue for questions or comments about the standards. For other inquiries, use the feedback form on the site. Subject matter experts can request privileges to contribute.

What is SCALe?

SCALe (Source Code Analysis Laboratory) offers conformance testing of C language software systems against the CERT C Secure Coding Standard.

Is the SEI CERT C Coding Standard available for download?

Yes, the 2016 Edition is available as a downloadable PDF from the SEI website (accompanying errata is also provided).