> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/sast-and-sca/prezero/static-analysis-sast/analyzing-applications/c.md).
# C/C++
This article shows you how to analyze your applications written in C/C++ using Qwiet AI by Harness. It assumes that you have already [set up and authenticated](broken://spaces/uPVBkglG6gsk2SsnsKgG/pages/fDfomI4jhzwCNFxmGSLc) with Qwiet.
## Requirements
See [Prerequisites](broken://spaces/uPVBkglG6gsk2SsnsKgG/pages/0c1ezDgaUil5NxR4VnY3#language-support-and-requirements) for more information.
## Analyzing your C/C++ application
note
Qwiet offers a [sample application](https://github.com/ShiftLeftSecurity/shiftleft-c-demo) that you can use to run and test Qwiet AI by Harness.
To analyze your C/C++ application, run:
```
sl analyze --app --c
```
 
| Parameter | Description |
| ---------------- | --------------------------------------------------------------------------- |
| `--app ` | The name of the application to be analyzed (maximum length: 100 characters) |
| `--c` | The flag identifying the application's language |
| `` | The path to your project |
See the [CLI reference](broken://spaces/4t03gua31tHpZwtcczPO/pages/bfq0NtVB7O7f6pFvFzK3) for additional `sl analyze` options.
### Additional parameters
The analysis accepts additional parameters after a double hyphen `--`.
For example, the following enables scanning of C/C++ system header files if you have GCC and g++ installed for the auto-discovery of such files:
```
sl analyze --app --c -- --with-include-auto-discovery
```
 
| Parameter | Description |
| ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--exclude ` | Exclude the specified file/directory during code analysis; the path provided must either be an absolute path or a relative path to the project directory; can be specified multiple times |
| `--exclude-regex ` | A regex specifying the files to exclude during the analysis (the match is to the absolute file path), e.g., `--exclude-regex ".*([-.])min\\.c"` |
| `--with-include-auto-discovery` | Enables scanning of system header files if you have GCC and g++ installed for the auto-discovery of such files |
| `--compilation-database ` | Enables the processing of compilation database files (e.g., compile\_commands.json) |
### Using a compilation database
When analyzing C/C++ applications, Qwiet AI by Harness can extract compiler options, source files, and other build information from a compilation database. This allows the analysis to be more consistent with the build configuration.
To generate a compilation database for **CMake** based builds, use the `CMAKE_EXPORT_COMPILE_COMMANDS` environment variable. See the [CMake documentation](https://cmake.org/cmake/help/latest/variable/CMAKE_EXPORT_COMPILE_COMMANDS.html) for additional details. **Clang** based builds are also supported, but additional tools such as [Build EAR](https://github.com/rizsotto/Bear) or [Compilation Database Generator](https://github.com/nickdiego/compiledb) might be required. See the [Clang documentation](https://clang.llvm.org/docs/JSONCompilationDatabase.html) for additional details.
For example, take the following `Makefile`:
```
all: shiftleft-c-demo
shiftleft-c-demo:
gcc -o shiftleft-c-demo main.c
clean:
rm shiftleft-c-demo
```
 
To generate a compilation database for a Make-based project using [compiledb](https://github.com/nickdiego/compiledb), run the following command:
```
compiledb make
```
 
The compilation database will look something like this:
```
[
{
"directory": "/Users/gacevedo/Development/shiftleft-c-demo",
"arguments": [
"gcc",
"-o",
"shiftleft-c-demo",
"main.c"
],
"file": "main.c"
}
]
```
 
Once you have a compilation database, you can provide it during the analysis invocation:
```
sl analyze --app --c -- --compilation-database compile_commands.json
```
 
### SCA
To [identify open-source vulnerabilities](/sast-and-sca/prezero/oss-vulnerabilities.md), Qwiet AI by Harness automatically searches for build manifests in the project path you provided when running `sl analyze`. Currently, only the [Conan](https://conan.io) package manager is supported. Note that if you only have a `conanfile.txt`, Qwiet will only be able to list your direct dependencies. Therefore we recommend to generate a `conan.lock` file using `conan lock create`, Qwiet will also include all transitive dependencies.
### Tagging results with your branch name
To include the branch name in your Qwiet AI by Harness results, allowing you to distinguish one set of results from another, add the following to your invocation of Qwiet:
```
sl analyze --app --c --tag branch=`git symbolic-ref --short HEAD`
```
 
If you're working in a GitHub environment (e.g., [GitHub Actions](https://github.com/features/actions)), you can also use `--tag branch=${{ github.head_ref }}` to populate your branch name.
If you don't provide a branch name, but Qwiet detects one available in your environment, it will use that name.
## Troubleshooting
If you have any issues scanning your project, please see our [general troubleshooting page](/sast-and-sca/prezero/tutorials/troubleshooting.md).