[Error detected] flawfinder `ale_cpp_flawfinder_options` misses space

## Information

**VIM version**

VIM - Vi IMproved 9.2 (2026 Feb 14 kompiliert am Jul 24 2026 20:21:32)
Inklusive der Patches: 1-849

Operating System:

Arch Linux

## What went wrong

Setting `ale_cpp_flawfinder_options` needs a prefix space to work.

## Reproducing the bug

1. `let g:ale_cpp_flawfinder_options = ' --allowlink --followdotdir' `
2. produces unrecognised option `-CDQS`

### Error source

https://github.com/dense-analysis/ale/blob/9e2efaa4d348b1f93200b24e5540c670eb6fdd3f/ale_linters/cpp/flawfinder.vim#L13

### :ALEInfo

Expand



Current Filetype: cpp
Available Linters: ['astgrep', 'cc', 'ccls', 'clangcheck', 'clangd', 'clangtidy', 'clazy', 'cppcheck', 'cpplint', 'cquery', 'cspell', 'flawfinder']
Linter Aliases:
'cc' -> ['gcc', 'clang', 'g++', 'clang++']
Enabled Linters: ['clangtidy', 'flawfinder']
Ignored Linters: []
Suggested Fixers:
'ast-grep' - Apply ast-grep rules.
'astyle' - Fix C/C++ with astyle.
'clang-format' - Fix C, C++, C#, CUDA, Java, JavaScript, JSON, ObjectiveC and Protobuf files with clang-format.
'clangtidy' - Fix C/C++ and ObjectiveC files with clang-tidy.
'remove_trailing_lines' - Remove all blank lines at the end of a file.
'replace_emdash' - Replace em dash with -- ASCII characters.
'trim_whitespace' - Remove all trailing whitespace characters at the end of every line.
'uncrustify' - Fix C, C++, C#, ObjectiveC, ObjectiveC++, D, Java, Pawn, and VALA files with uncrustify.

Linter Variables:
let g:ale_cpp_clangtidy_checks = []
let g:ale_cpp_clangtidy_executable = 'clang-tidy'
let g:ale_cpp_clangtidy_extra_options = '--config-file=/home/matheus/.config/clang/clang-tidy.yaml'
let g:ale_cpp_clangtidy_options = ''
let g:ale_cpp_flawfinder_executable = 'flawfinder'
let g:ale_cpp_flawfinder_minlevel = 0
let g:ale_cpp_flawfinder_options = '--allowlink --followdotdir'

Global Variables:
let g:ale_cache_executable_check_failures = v:null
let g:ale_change_sign_column_color = v:false
let g:ale_command_wrapper = ''
let g:ale_completion_delay = v:null
let g:ale_completion_enabled = v:false
let g:ale_completion_max_suggestions = v:null
let g:ale_disable_lsp = 'auto'
let g:ale_echo_cursor = v:true
let g:ale_echo_msg_error_str = 'Error'
let g:ale_echo_msg_format = '%code: %%s'
let g:ale_echo_msg_info_str = 'Info'
let g:ale_echo_msg_warning_str = 'Warning'
let g:ale_enabled = 1
let g:ale_fix_on_save = 1
let g:ale_fixers = {'vim': ['remove_trailing_lines', 'trim_whitespace'], 'typescript': ['dprint', 'remove_trailing_lines', 'trim_whitespace'], 'cmake': ['cmakeformat', 'remove_trailing_lines', 'trim_whitespace'], 'html': ['remove_trailing_lines', 'tidy', 'trim_whitespace'], 'cpp': ['clang-format', 'remove_trailing_lines', 'trim_whitespace'], 'markdown': ['dprint', 'remove_trailing_lines', 'trim_whitespace'], 'lua': ['remove_trailing_lines', 'stylua', 'trim_whitespace'], 'yaml': ['remove_trailing_lines', 'trim_whitespace', 'yamlfmt'], 'po': ['remove_trailing_lines', 'trim_whitespace'], 'jinja': ['remove_trailing_lines', 'tidy', 'trim_whitespace'], 'bib': ['bibclean', 'remove_trailing_lines', 'trim_whitespace'], 'tex': ['remove_trailing_lines', 'tex-fmt', 'trim_whitespace'], 'zsh': ['remove_trailing_lines', 'shfmt', 'trim_whitespace'], 'toml': ['remove_trailing_lines', 'tombi_format', 'trim_whitespace'], 'PKGBUILD': ['remove_trailing_lines', 'shfmt', 'trim_whitespace'], 'sh': ['remove_trailing_lines', 'shfmt', 'trim_whitespace'], 'systemd': ['remove_trailing_lines', 'trim_whitespace'], 'gitcommit': ['remove_trailing_lines', 'trim_whitespace'], 'make': ['remove_trailing_lines', 'trim_whitespace'], 'css': ['dprint', 'remove_trailing_lines', 'trim_whitespace'], 'xml': ['remove_trailing_lines', 'trim_whitespace', 'xmllint'], 'jsonc': ['dprint', 'remove_trailing_lines', 'trim_whitespace'], 'json': ['dprint', 'remove_trailing_lines', 'trim_whitespace'], 'sql': ['remove_trailing_lines', 'sqlfluff', 'trim_whitespace'], '*': ['remove_trailing_lines', 'trim_whitespace'], 'desktop': ['remove_trailing_lines', 'trim_whitespace']}
let g:ale_history_enabled = v:true
let g:ale_info_default_mode = 'preview'
let g:ale_history_log_output = v:true
let g:ale_keep_list_window_open = 0
let g:ale_lint_delay = 200
let g:ale_lint_on_enter = v:true
let g:ale_lint_on_filetype_changed = v:true
let g:ale_lint_on_insert_leave = v:true
let g:ale_lint_on_save = v:true
let g:ale_lint_on_text_changed = 'normal'
let g:ale_linter_aliases = {'jinja': ['html', 'jinja'], 'jsonc': ['json'], 'zsh': ['sh'], 'html': ['html', 'jinja'], 'PKGBUILD': ['sh']}
let g:ale_linters = {'vim': ['vint'], 'typescript': ['biome'], 'cmake': ['cmake_lint', 'cmakelint'], 'html': ['htmlhint', 'j2lint', 'tidy'], 'cpp': ['clangtidy', 'flawfinder'], 'markdown': ['rumdl'], 'lua': ['luac', 'selene'], 'yaml': ['yamllint'], 'po': ['msgfmt'], 'jinja': ['j2lint', 'tidy'], 'bib': ['bibclean'], 'tex': ['chktex'], 'zsh': ['shell', 'shellcheck'], 'toml': [], 'PKGBUILD': ['shell', 'shellcheck'], 'sh': ['shell', 'shellcheck'], 'systemd': ['systemd_analyze'], 'gitcommit': ['gitlint'], 'make': ['checkmake'], 'xml': ['xmllint'], 'jsonc': ['biome'], 'json': ['biome'], 'sql': ['sqlfluff'], 'css': ['stylelint'], 'desktop': ['desktop_file_validate']}
let g:ale_linters_explicit = 1
let g:ale_linters_ignore = {}
let g:ale_list_vertical = v:false
let g:ale_list_window_size = 10
let g:ale_loclist_msg_format = '%code: %%s'
let g:ale_max_buffer_history_size = 20
let g:ale_max_signs = -1
let g:ale_maximum_file_size = v:null
let g:ale_open_list = v:false
let g:ale_pattern_options = v:null
let g:ale_pattern_options_enabled = v:null
let g:ale_root = {}
let g:ale_set_balloons = v:false
let g:ale_set_highlights = v:true
let g:ale_set_loclist = v:true
let g:ale_set_quickfix = v:false
let g:ale_set_signs = v:true
let g:ale_sign_column_always = v:false
let g:ale_sign_error = 'E'
let g:ale_sign_info = 'I'
let g:ale_sign_offset = 1000000
let g:ale_sign_style_error = 'E'
let g:ale_sign_style_warning = 'W'
let g:ale_sign_warning = 'W'
let g:ale_sign_highlight_linenrs = v:false
let g:ale_type_map = {}
let g:ale_use_neovim_diagnostics_api = v:false
let g:ale_use_global_executables = v:null
let g:ale_virtualtext_cursor = 0
let g:ale_warn_about_trailing_blank_lines = v:true
let g:ale_warn_about_trailing_whitespace = v:true

Command History:

(executable check - success) flawfinder
(finished - exit code 16) ['/bin/zsh', '-c', '''flawfinder'' -CDQS--allowlink --followdotdir --minlevel=0 ''/tmp/vJQr8bs/0/a.cpp''']

<<>>
*** getopt error: option -- not recognized

flawfinder [--help | -h] [--version] [--listrules]
[--allowlink] [--followdotdir] [--nolink]
[--exclude PATTERN]
[--patch filename | -P filename]
[--inputs | -I] [--minlevel X | -m X]
[--falsepositive | -F] [--neverignore | -n]
[--context | -c] [--columns | -C] [--dataonly | -D]
[--html | -H] [--immediate | -i] [--sarif | --sonar]
[--singleline | -S] [--omittime] [--quiet | -Q]
[--loadhitlist F] [--savehitlist F] [--diffhitlist F]
[--] [source code file or source root directory]+

The options cover various aspects of flawfinder as follows.

Documentation:
--help | -h Show this usage help.
--version Show version number.
--listrules List the rules in the ruleset (rule database).

Selecting Input Data:
--allowlink Allow symbolic links.
--followdotdir
Follow directories whose names begin with ".".
Normally they are ignored.
--nolink Skip symbolic links (ignored).
--exclude PATTERN
Skip files or directories whose path matches PATTERN
(a glob pattern matched against the full path).
May be repeated to exclude multiple patterns.
Example: --exclude '*/third_party/*'
--patch F | -P F
Display information related to the patch F
(patch must be already applied).

Selecting Hits to Display:
--inputs | -I
Show only functions that obtain data from outside the program;
this also sets minlevel to 0.
-m X | --minlevel=X
Set minimum risk level to X for inclusion in hitlist. This
can be from 0 (``no risk'') to 5 (``maximum risk''); the
default is 1.
--falsepositive | -F
Do not include hits that are likely to be false positives.
Currently, this means that function names are ignored if
they're not followed by "(", and that declarations of char-
acter arrays aren't noted. Thus, if you have use a vari-
able named "access" everywhere, this will eliminate refer-
ences to this ordinary variable. This isn't the default,
because this also increases the likelihood of missing
important hits; in particular, function names in #define
clauses and calls through function pointers will be missed.
--neverignore | -n
Never ignore security issues, even if they have an ``ignore''
directive in a comment.
--regex PATTERN | -e PATTERN
Only report hits that match the regular expression PATTERN.

Selecting Output Format:
--columns | -C
Show the column number (as well as the file name and
line number) of each hit; this is shown after the line number
by adding a colon and the column number in the line (the first
character in a line is column number 1).
--context | -c
Show context (the line having the "hit"/potential flaw)
--dataonly | -D
Don't display the headers and footers of the analysis;
use this along with --quiet to get just the results.
--html | -H
Display as HTML output.
--immediate | -i
Immediately display hits (don't just wait until the end).
--sarif Generate output in SARIF format.
--sonar Generate output in SonarQube format.
--singleline | -S
Single-line output.
--omittime Omit time to run.
--quiet | -Q
Don't display status information (i.e., which files are being
examined) while the analysis is going on.
--error-level=LEVEL
Return a nonzero (false) error code if there is at least one
hit of LEVEL or higher. If a diffhitlist is provided,
hits noted in it are ignored.
This option can be useful within a continuous integration script,
especially if you mark known-okay lines as "flawfinder: ignore".
Usually you want level to be fairly high, such as 4 or 5.
By default, flawfinder returns 0 (true) on a successful run.

Hitlist Management:
--savehitlist=F
Save all hits (the "hitlist") to F.
--loadhitlist=F
Load hits from F instead of analyzing source programs.
Only use hitlists you created; untrusted hitlists could
contain misleading results.
--diffhitlist=F
Show only hits (loaded or analyzed) not in F.
Only use hitlists you created; untrusted hitlists could
contain misleading results.

For more information, please consult the manpage or available
documentation.

<<>>

Start in ale_linters/cpp/flawfinder.vim at the linked line and inspect how ale_cpp_flawfinder_options is joined into the command shown in :ALEInfo. Reproduce the setting with the reported options, then verify that flawfinder receives valid separate options and no longer reports the getopt error.

Written by the indexing model from the issue text.