Bearer CLI is a free static application security testing (SAST) tool that scans source code for vulnerabilities and prioritizes them by the sensitive data they touch. SAST means the tool reads code without running it. Organizations can use it freely, with a license restriction covered below.

Bearer CLI

Bearer’s complaint is that SAST tools can hand developers hundreds of findings with no sense of which to fix first. Its fix is to follow sensitive data through the code and put the flaws on those paths first, so whoever is triaging can start with the findings that can expose that data.

What Bearer CLI scans for

Built-in rules cover the OWASP Top 10 and CWE Top 25, two standard lists of common security weaknesses, including SQL injection, cross-site scripting, path traversal, and hard-coded passwords.

Bearer CLI can also run a privacy report. It identifies more than 120 data types, from personal data to health information, and flags components that handle them, including databases like pgSQL and third-party APIs like OpenAI and Sentry. The output is meant as evidence for privacy impact assessments and GDPR records of processing activities.

Bearer says the scanner reads only code, never actual values. A result can therefore show where code handles a field called email without showing whether real customer emails reach it.

Languages and license

The CLI supports Go, Java, JavaScript, TypeScript, PHP, Python, and Ruby. The license is Elastic License 2.0. Organizations can use the CLI internally without commercial requirements, but providing it to third parties as a hosted or managed service requires approval.

Bearer CLI is available for free on GitHub.

Must read:

Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!