Bearer CLI

Bearer CLI is an open-source static application security testing (SAST) tool built by Bearer (now part of Cycode) that scans source code and analyzes data flows to identify security vulnerabilities and privacy risks. It is available as a free CLI tool under the Elastic License 2.0, with a commercial extension called Bearer Pro available through Cycode. The project is part of Cygives, described as the community hub for free and open developer security tools.

What It Is

Bearer CLI is a command-line SAST scanner that goes beyond traditional vulnerability detection by combining security analysis with sensitive data flow tracking. It scans codebases in Go, Java, JavaScript, TypeScript, PHP, Python, and Ruby, checking against built-in rules that cover the OWASP Top 10 and CWE Top 25. Its distinguishing feature is the ability to trace how personally identifiable information (PII), personal health information (PHI), and other sensitive data types move through an application — enabling both security and privacy compliance reporting from a single scan.

Security and Privacy Coverage

Bearer CLI covers a broad range of vulnerability categories through its built-in rule set:

• Access control: Path traversal, open redirect, exposure of sensitive information (OWASP A01)
• Cryptographic failures: Weak algorithms, insecure communication (A02)
• Injection: SQL injection, XSS, XPath, input validation (A03)
• Design flaws: Missing encryption of sensitive data, persistent cookies with sensitive info (A04)
• Security misconfiguration: Cleartext storage in cookies or JWTs (A05)
• Authentication failures: Hard-coded passwords, improper certificate validation (A07)
• Data integrity failures: Deserialization of untrusted data (A08)
• Logging failures: Insertion of sensitive information into log files (A09)
• SSRF (A10)

On the privacy side, Bearer CLI identifies over 120 sensitive data types and can detect components — databases like pgSQL, third-party APIs like OpenAI and Sentry — that process sensitive data. This output feeds directly into Privacy Impact Assessments (PIA), Data Protection Impact Assessments (DPIA), and Records of Processing Activities (RoPA) for GDPR compliance.

How It Works

Bearer CLI performs static analysis without ever reading actual runtime values — it analyzes code patterns and data flow paths. The scanner classifies data types by matching patterns in source code, then traces how those data types flow through the application. Findings are ranked by severity (CRITICAL, HIGH, MEDIUM, LOW) and linked to specific file locations and line numbers.

The tool supports multiple installation methods: a shell install script, Homebrew, Debian/Ubuntu apt, RHEL/CentOS yum, Docker (available on Docker Hub and ghcr.io), and direct binary download. It integrates with CI/CD pipelines via GitHub Actions and GitLab CI/CD, and supports diff scanning to limit checks to changed code on a branch.

Bearer Pro and Open-Source Distinction

The README distinguishes between two tiers: Bearer CLI (open source) and Bearer Pro (commercial, via Cycode). Bearer Pro extends the open-source tool with:

• Advanced cross-file and interprocedural analysis for Java, Python, C#, and Go
• Additional language support: C#, Kotlin, Elixir, VB.Net, Rust, and Swift

The README notes that Bearer Pro's interprocedural analysis for Java achieved a score of 76% on the OWASP Java Benchmark with a reported false positive rate of less than 2%.

Update: v2.1.1

The latest release is v2.1.1, published on August 24, 2026, according to the GitHub repository metadata. The project remains actively maintained, with the repository last pushed to on August 24, 2026, and 2,737 stars and 149 forks as of that date. Bearer CLI is licensed under the Elastic License 2.0 (ELv2), which permits free internal use within an organization but restricts offering it as a hosted or managed service to third parties without explicit approval from Bearer Inc.